The Communications Decency Act of 19961 (CDA) provides immunity to websites for certain torts committed on their platforms by third-party users.2 To do so, section 509 of the CDA (codified at 47 U.S.C. § 230) states that websites cannot be “treated as the publisher or speaker of any information provided by another information content provider.”3 A dating website, for example, is not liable for defamatory content posted by one of its users.4 Recently, in Doe v. Internet Brands, Inc.,5 the Ninth Circuit held that § 230 immunity did not protect Internet Brands, the owner of the website Model Mayhem, from a failure-to-warn claim.6 In doing so, the court declined to adopt an alternative understanding of the statute more in line with the law’s stated policy objectives.
Lavont Flanders and Emerson Callum used Model Mayhem, a networking site for models, to find their victims. Posing as talent agents, they contacted women advertising on the website and invited them to fake auditions. There, they would drug and then rape their victims, recording the crimes to sell as pornography.7 Flanders used a fake identity to contact Jane Doe.8 Doe went to the fake “audition, where Flanders and Callum drugged, raped, and recorded her.”9
Doe sued Internet Brands in the Central District of California for failure to warn under California law.10 She alleged that Internet Brands had detailed knowledge of the criminal scheme but did nothing to warn users.11 Internet Brands moved to dismiss, contending that § 230 barred the claim.12
The district court granted the motion to dismiss.13 It analogized to Doe v. MySpace, Inc.,14 a Fifth Circuit case in which a mother sued MySpace, a social networking website, for negligently allowing children to create public profiles and meet adult predators.15 The Fifth Circuit held that § 230 immunity applied to MySpace because the mother’s claims were “merely another way of claiming that MySpace was liable for publishing the communications and they sp[oke] to MySpace’s role as a publisher of online third-party-generated content.”16 Similarly, the district court held, “despite Plaintiff’s characterization of her claim, Plaintiff is essentially asking Defendant to advise its users of known risks associated with content provided by third parties on its website,” and “any duty Defendant has to notify its users of known risks derives solely from its status as a publisher of that content.”17 Doe appealed.18
The Ninth Circuit reversed.19 Writing for the panel, Judge Clifton20 held that § 230 did not bar Doe’s failure-to-warn claim because the claim did not treat Internet Brands as the “publisher or speaker” of third-party content on the website.21 Instead, Doe sought “to hold Internet Brands liable for failing to warn her about information it obtained from an outside source about how third parties targeted and lured victims through Model Mayhem.”22 The court distinguished Doe’s claims from a paradigmatic case of § 230 immunity: a defamation claim against a website for hosting defamatory content from a third party.23 Here, the court said that Doe “does not seek to hold Internet Brands liable as a ‘publisher or speaker’ of content someone posted on the Model Mayhem website, or for Internet Brands’ failure to remove content posted on the website.”24 The court reasoned that the duty would not require Model Mayhem to delete any third-party content or affect content monitoring.25 The court said a warning posted on the website or sent by email would suffice.26
The court also addressed the policy objectives of § 230. Section 230 was a direct response to Stratton Oakmont, Inc. v. Prodigy Services Co.,27 a decision that held a message board website liable as a publisher because it selectively removed posts.28 Section 230 seeks to spare websites the choice “between voluntarily removing some offensive third party content, which would expose the site to liability for the content it did not remove, or filtering nothing, which would prevent liability for all third party content,”29 and does so by permitting them to perform editorial functions without incurring liability. The court reasoned that its decision would be unrelated to websites’ efforts to monitor and filter content.30 Acknowledging that another policy objective of § 230 is preventing the chilling effect of tort liability on internet intermediaries, the court stated that Doe’s cause of action would not have this effect.31 In short, while imposing liability would impose costs on websites, § 230 is not “an all purpose get-out-of-jail-free card.”32
The court also held that while Internet Brands acted as a publisher of third-party content (Doe’s profile), a “but-for” cause of the harm, this action was insufficient to immunize the website. Model Mayhem “is an internet publishing business,” so “[p]ublishing activity is a but-for cause of just about everything [it] is involved in.”33
Finally, the court distinguished MySpace. MySpace held that § 230 barred a negligence claim against MySpace for not preventing a thirteen-year-old from lying about her age and creating a profile, which led to her assault.34 Here, “[t]he tort duty asserted . . . does not arise from an alleged failure to adequately regulate access to user content or to monitor internal communications that might send up red flags about sexual predators.”35 Instead, it arises from “actual knowledge by Internet Brands from an outside source of information about criminal activity.”36
By holding that immunity did not apply to Internet Brands, the court construed § 230 narrowly. Doe sought to hold the website liable as a publisher of user-generated content: her profile. A reading of the statute more in line with existing case law and § 230’s stated policy objectives favors immunity. For instance, this ruling could chill speech. Additionally, while the court sought improved safety, the ruling may in fact discourage websites from investigating dangers, and any warnings the ruling elicits may be ineffective. The argument for immunity therefore does not ignore the gravity of the crime, but rather respects it.
The court allowed a claim that, in the words of the statute, “treated” Internet Brands as “the publisher or speaker” of “information provided by another information content provider,” the profile provided by Jane Doe.37 The claim “treats” the website as the publisher of Doe’s profile because the claim places a duty to warn on the party that published the profile, the website.38 A claim treats a website as a publisher when the website’s decision to publish a third-party profile creates the duty; accordingly, websites could avoid potential failure-to-warn liability by deciding not to publish content that may require a warning. Facing this liability, websites engage in “traditional” publisher activities: deciding whether to continue publishing third-party content, such as profiles or contact information, and whether to publish it with a warning.39
From the court’s perspective, Doe “does not seek to hold Internet Brands liable for its content.”40 However, her claim does so because it treats Internet Brands as though it were the direct “publisher or speaker” itself of the content, Doe’s profile. Had Internet Brands been the direct speaker and created a model directory without third-party content but included an entry on Doe, all else remaining the same, a failure-to-warn claim by Doe for that conduct would treat Internet Brands identically: as a publisher of that content.41 Alternatively, imagine that Model Mayhem was a physical book that Internet Brands published. If Doe asked for her profile to be included and later sued Internet Brands for failure to warn after a similar crime, the claim would seek to hold Internet Brands liable for the content it published. The court rightly contended that the “obligation to warn could have been satisfied without changes to the content posted by the website’s users.”42 Yet, the obligation to warn could also have been satisfied by removing or modifying Doe’s profile and contact information, the content that gave rise to the duty to warn. Similarly, in a paradigmatic case of immunity, the obligation not to defame could be met “without changes to the content posted by the website’s users” if the website inserted, as a newspaper might, a “warning” that certain content was of doubtful veracity.43 Doe’s claim treats Internet Brands not as the publisher of defamatory content, but of potentially dangerous content.
Indeed, the court acknowledged that “Internet Brands acted as the ‘publisher or speaker’” of Doe’s profile, which was a “‘but-for’ cause of her injuries.”44 However, the court stated: “Publishing activity is a but-for cause of just about everything Model Mayhem is involved in. . . . Without publishing user content, it would not exist.”45 Yet this argument is why § 230 applies. The fact that publishing third-party content is a but-for cause of much of what the website does, like many websites, is why courts have read § 230 so expansively.46 This acknowledgement shows that holding a website liable because of its decision to publish particular content naturally treats it as a “publisher” of that content. It is beside the point that different content, the warning itself, “could be deemed an act of publishing” by the website, not a third party.47 In addition, § 230’s subject-matter exceptions, for instance federal criminal law,48 should assuage the concern that it is a “get-out-of-jail-free card.”49 These exceptions, among others,50 provide a relevant limiting principle for § 230: websites are not immune from accomplice liability.
Case law bolsters a broad understanding of the statute. Just as in the MySpace decision that Internet Brands distinguished, the claim here arises from a failure to intervene in third-party communications that exposed the plaintiff to dangerous predators. The Myspace court cited a Third Circuit case that held that a subscriber’s failure-to-protect claim “attempts to hold AOL liable for decisions relating to the monitoring, screening, and deletion of content from its network — actions quintessentially related to a publisher’s role. Section 230 ‘specifically proscribes liability’ in such circumstances.”51 As the district court here distilled, the inquiry focuses on how the cause of action treats the defendant, not the name of the cause of action.52 Internet Brands faced the same decisions as MySpace: how to monitor content and what content, such as profiles and contact information, to allow or reject based on potential liability. Regardless of the cause of action’s name, Doe’s claim seeks to hold the website liable for its decision to host a third-party communication — her profile — and therefore the claim treats the website as a publisher.
At most, the statute is ambiguous as applied to Doe’s claim. If a statute is ambiguous but announces policies, interpreting courts should defer to those statutory statements of purpose enacted by Congress.53 In § 230, Congress announced the “policy of the United States.”54 These policy objectives favor immunity in this case.
As the court recognized, a key policy of § 230 is to refrain from chilling online speech55 and, “[a]s section 230(b) itself explains, ‘[i]t is the policy of the United States . . . to promote the continued development of the Internet . . . [and] to preserve the vibrant and competitive free market that presently exists for the Internet.’”56 The court itself acknowledged that imposing liability on websites “could be said to have a ‘chilling effect’ on the internet” because it makes operating websites “marginally more expensive.”57 These marginal costs chill speech, and as Professor David Ardia noted in his empirical study of § 230, “[b]ecause revenue from each marginal customer is small and the cost of a legal defense, not to mention potential monetary sanctions, is high, it is almost always cheaper for the intermediary to remove speech than to expend time or resources contesting even meritless claims.”58 Specifically, when faced with the potential for costly lawsuits, websites may be reluctant to publish third-party content that could incur failure-to-warn liability and they might err toward limiting third-party speech.59 The burden applies to any website that may become aware of dangers to users from its content, from Facebook to Match.com.60 Accordingly, § 230 has been called “the most important law protecting internet speech” and “perhaps the most influential law to protect the kind of innovation that has allowed the Internet to thrive since 1996.”61
While Internet Brands may chill speech, its safety benefits will likely be limited. The court noted that § 230’s “core policy” is to allow websites to regulate third-party content without incurring liability.62 As the court explained, Congress adopted § 230 to avoid forcing a website “to choose between voluntarily removing some offensive third party content, which would expose the site to liability for the content it did not remove, or filtering nothing, which would prevent liability for all third party content.”63 The court’s ruling, however, exposes websites to this dilemma: choosing between investigating risks presented by their website in order to eliminate or warn of them, which would expose a website to potential liability for warnings it failed to convey, or doing nothing, staying in the dark to prevent liability for all third-party content. The ruling, therefore, may discourage websites from seeking knowledge to prevent the harms that occurred here because efforts to investigate or warn could incur liability.
Finally, any safety benefits from the court’s ruling also depend on effective warnings. In order to protect themselves from as much liability as possible, websites are also likely to make their warnings long and detailed in order to cover many dangers.64 For instance, websites would have an incentive to warn of the exact type of dangers here, in detail, but would also provide a dense litany of additional specific warnings about many other scams and risks. Websites may even attempt to include waivers of liability along with the warnings. They would be unlikely to include names of specific people out of concern over defamation.65 In addition, a specific warning can be circumvented; Flanders used a fake identity and targeted other websites.66 The court said that the warning could be given “by posting a notice on the website or by informing users by email.”67 Websites would likely opt to “post[] a notice” because conveying comprehensive warnings through their Terms of Service easily ensures all users have constructive notice of a warning and any updates.68 Such a system would lead to very few safety benefits because users almost never read the pages containing the terms that bind them69 and are even less likely to read litanies of warnings buried in those pages. Finally, any benefits should be discounted by the existing incentives websites have to monitor content and warn users of various dangers in order to maintain users’ trust and business.70 Indeed, since § 230’s adoption, websites have adopted various screening programs, even though they are not legally obligated to do so.71
Even if the statute is ambiguous in this case, its policy objectives tip the scales in favor of immunity. The court’s narrow definition of “publisher” will likely chill speech and fail to achieve the safety benefits the court seeks. The court’s ruling perversely discourages monitoring, and any additional warnings resulting from this case will have limited efficacy.