Harvard Law Review Harvard Law Review Harvard Law Review


Doe v. Internet Brands, Inc.

Ninth Circuit Declines to Extend § 230 Immunity to Failure-to-Warn Claims.

The Communications Decency Act of 19961×1. Pub. L. No. 104-104, tit. V, 110 Stat. 56, 133–43 (codified in scattered sections of 18 and 47 U.S.C.). The CDA was anti-indecency legislation. (CDA) provides immunity to websites for certain torts committed on their platforms by third-party users.2×2. 47 U.S.C. § 230 (2012). To do so, section 509 of the CDA (codified at 47 U.S.C. § 230) states that websites cannot be “treated as the publisher or speaker of any information provided by another information content provider.”3×3. Id. § 230(c)(1). A dating website, for example, is not liable for defamatory content posted by one of its users.4×4. See Carafano v. Metrosplash.com, Inc., 339 F.3d 1119, 1125 (9th Cir. 2003). Recently, in Doe v. Internet Brands, Inc.,5×5. 824 F.3d 846 (9th Cir. 2016). the Ninth Circuit held that § 230 immunity did not protect Internet Brands, the owner of the website Model Mayhem, from a failure-to-warn claim.6×6. Id. at 854. In doing so, the court declined to adopt an alternative understanding of the statute more in line with the law’s stated policy objectives.

Lavont Flanders and Emerson Callum used Model Mayhem, a networking site for models, to find their victims. Posing as talent agents, they contacted women advertising on the website and invited them to fake auditions. There, they would drug and then rape their victims, recording the crimes to sell as pornography.7×7. Id. at 848. Flanders used a fake identity to contact Jane Doe.8×8. Id. at 849. It is disputed whether Flanders contacted Doe via the website or directly. Id. at 849 n.2. Doe went to the fake “audition, where Flanders and Callum drugged, raped, and recorded her.”9×9. Id. at 849.

Doe sued Internet Brands in the Central District of California for failure to warn under California law.10×10. Id. at 848–49. She alleged that Internet Brands had detailed knowledge of the criminal scheme but did nothing to warn users.11×11. Id. Doe alleged that Internet Brands knew the details of the scheme from prior criminal charges against Flanders and Callum. Id. at 849. Internet Brands moved to dismiss, contending that § 230 barred the claim.12×12. Id. at 848–49.

The district court granted the motion to dismiss.13×13. Doe v. Internet Brands, Inc., No. 12-cv-3626, 2012 WL 12882765, at *3 (C.D. Cal. Aug. 16, 2012). It analogized to Doe v. MySpace, Inc.,14×14. 528 F.3d 413 (5th Cir. 2008). a Fifth Circuit case in which a mother sued MySpace, a social networking website, for negligently allowing children to create public profiles and meet adult predators.15×15. Internet Brands, 2012 WL 12882765, at *2–3; see Myspace, 528 F.3d 413. The Fifth Circuit held that § 230 immunity applied to MySpace because the mother’s claims were “merely another way of claiming that MySpace was liable for publishing the communications and they sp[oke] to MySpace’s role as a publisher of online third-party-generated content.”16×16. MySpace, 528 F.3d at 420. Similarly, the district court held, “despite Plaintiff’s characterization of her claim, Plaintiff is essentially asking Defendant to advise its users of known risks associated with content provided by third parties on its website,” and “any duty Defendant has to notify its users of known risks derives solely from its status as a publisher of that content.”17×17. Internet Brands, 2012 WL 12882765, at *3 (emphasis added). Doe appealed.18×18. Internet Brands, 824 F.3d at 849.

The Ninth Circuit reversed.19×19. Id. at 851. The Ninth Circuit originally issued an opinion in September 2014 that held that the CDA did not bar the model’s claim. Doe v. Internet Brands, Inc., 767 F.3d 894 (9th Cir. 2014), vacated, 778 F.3d 1095 (9th Cir. 2015). In February 2015, the Ninth Circuit granted Internet Brands’ petition for rehearing and vacated its prior opinion. Internet Brands, 778 F.3d 1095. Writing for the panel, Judge Clifton20×20. Judge Clifton was joined by Judge Schroeder and Judge Cogan, sitting by designation from the Eastern District of New York. held that § 230 did not bar Doe’s failure-to-warn claim because the claim did not treat Internet Brands as the “publisher or speaker” of third-party content on the website.21×21. Internet Brands, 824 F.3d at 850–51. Instead, Doe sought “to hold Internet Brands liable for failing to warn her about information it obtained from an outside source about how third parties targeted and lured victims through Model Mayhem.”22×22. Id. at 851. The court distinguished Doe’s claims from a paradigmatic case of § 230 immunity: a defamation claim against a website for hosting defamatory content from a third party.23×23. Id. Here, the court said that Doe “does not seek to hold Internet Brands liable as a ‘publisher or speaker’ of content someone posted on the Model Mayhem website, or for Internet Brands’ failure to remove content posted on the website.”24×24. Id. The court reasoned that the duty would not require Model Mayhem to delete any third-party content or affect content monitoring.25×25. Id. The court said a warning posted on the website or sent by email would suffice.26×26. Id.

The court also addressed the policy objectives of § 230. Section 230 was a direct response to Stratton Oakmont, Inc. v. Prodigy Services Co.,27×27. 1995 WL 323710 (N.Y. Sup. Ct. May 24, 1995). a decision that held a message board website liable as a publisher because it selectively removed posts.28×28. Id. at *4. Section 230 seeks to spare websites the choice “between voluntarily removing some offensive third party content, which would expose the site to liability for the content it did not remove, or filtering nothing, which would prevent liability for all third party content,”29×29. Internet Brands, 824 F.3d at 852. and does so by permitting them to perform editorial functions without incurring liability. The court reasoned that its decision would be unrelated to websites’ efforts to monitor and filter content.30×30. Id. Acknowledging that another policy objective of § 230 is preventing the chilling effect of tort liability on internet intermediaries, the court stated that Doe’s cause of action would not have this effect.31×31. Id. In short, while imposing liability would impose costs on websites, § 230 is not “an all purpose get-out-of-jail-free card.”32×32. Id. at 853.

The court also held that while Internet Brands acted as a publisher of third-party content (Doe’s profile), a “but-for” cause of the harm, this action was insufficient to immunize the website. Model Mayhem “is an internet publishing business,” so “[p]ublishing activity is a but-for cause of just about everything [it] is involved in.”33×33. Id. The court cited Barnes v. Yahoo!, Inc., 570 F.3d 1096 (9th Cir. 2009), in which the Ninth Circuit rejected § 230 immunity from a promissory estoppel claim even though publication was a “but-for” cause of the injury. See Internet Brands, 824 F.3d at 853; see also Barnes, 570 F.3d at 1109.

Finally, the court distinguished MySpace. MySpace held that § 230 barred a negligence claim against MySpace for not preventing a thirteen-year-old from lying about her age and creating a profile, which led to her assault.34×34. Doe v. MySpace, Inc., 528 F.3d 413, 416–18 (5th Cir. 2008). Here, “[t]he tort duty asserted . . . does not arise from an alleged failure to adequately regulate access to user content or to monitor internal communications that might send up red flags about sexual predators.”35×35. Internet Brands, 824 F.3d at 853. Instead, it arises from “actual knowledge by Internet Brands from an outside source of information about criminal activity.”36×36. Id.

By holding that immunity did not apply to Internet Brands, the court construed § 230 narrowly. Doe sought to hold the website liable as a publisher of user-generated content: her profile. A reading of the statute more in line with existing case law and § 230’s stated policy objectives favors immunity. For instance, this ruling could chill speech. Additionally, while the court sought improved safety, the ruling may in fact discourage websites from investigating dangers, and any warnings the ruling elicits may be ineffective. The argument for immunity therefore does not ignore the gravity of the crime, but rather respects it.

The court allowed a claim that, in the words of the statute, “treated” Internet Brands as “the publisher or speaker” of “information provided by another information content provider,” the profile provided by Jane Doe.37×37. See 47 U.S.C. § 230(c)(1) (2012). The claim “treats” the website as the publisher of Doe’s profile because the claim places a duty to warn on the party that published the profile, the website.38×38. This type of claim is similar to a failure-to-warn claim against a print publisher, which naturally treats the publisher as a publisher. See, e.g., Brocklesby v. United States, 767 F.2d 1288, 1297 (9th Cir. 1985) (holding publisher liable for failure to warn). A claim treats a website as a publisher when the website’s decision to publish a third-party profile creates the duty; accordingly, websites could avoid potential failure-to-warn liability by deciding not to publish content that may require a warning. Facing this liability, websites engage in “traditional” publisher activities: deciding whether to continue publishing third-party content, such as profiles or contact information, and whether to publish it with a warning.39×39. See Zeran v. Am. Online, Inc., 129 F.3d 327, 330 (4th Cir. 1997) (upholding immunity for a “publisher’s traditional editorial functions — such as deciding whether to publish, withdraw, postpone or alter content”).

From the court’s perspective, Doe “does not seek to hold Internet Brands liable for its content.”40×40. Internet Brands, 824 F.3d at 851. However, her claim does so because it treats Internet Brands as though it were the direct “publisher or speaker” itself of the content, Doe’s profile. Had Internet Brands been the direct speaker and created a model directory without third-party content but included an entry on Doe, all else remaining the same, a failure-to-warn claim by Doe for that conduct would treat Internet Brands identically: as a publisher of that content.41×41. Section 230 would not apply here because the website would be the content developer, but the hypothetical illustrates that Doe’s claim treats the website as though it were the publisher. Alternatively, imagine that Model Mayhem was a physical book that Internet Brands published. If Doe asked for her profile to be included and later sued Internet Brands for failure to warn after a similar crime, the claim would seek to hold Internet Brands liable for the content it published. The court rightly contended that the “obligation to warn could have been satisfied without changes to the content posted by the website’s users.”42×42. Internet Brands, 824 F.3d at 851. Yet, the obligation to warn could also have been satisfied by removing or modifying Doe’s profile and contact information, the content that gave rise to the duty to warn. Similarly, in a paradigmatic case of immunity, the obligation not to defame could be met “without changes to the content posted by the website’s users” if the website inserted, as a newspaper might, a “warning” that certain content was of doubtful veracity.43×43. See Dworkin v. Hustler Magazine, Inc., 668 F. Supp. 1408, 1416 (C.D. Cal. 1987), aff’d, 668 F.2d 1188 (9th Cir. 1989) (holding that a disclaimer thwarted a defamation claim because the disclaimer “would put a reasonable reader on notice that the material is, at least, of questionable veracity”). Doe’s claim treats Internet Brands not as the publisher of defamatory content, but of potentially dangerous content.

Indeed, the court acknowledged that “Internet Brands acted as the ‘publisher or speaker’” of Doe’s profile, which was a “‘but-for’ cause of her injuries.”44×44. Id. at 853. However, the court stated: “Publishing activity is a but-for cause of just about everything Model Mayhem is involved in. . . . Without publishing user content, it would not exist.”45×45. Id. Yet this argument is why § 230 applies. The fact that publishing third-party content is a but-for cause of much of what the website does, like many websites, is why courts have read § 230 so expansively.46×46. See, e.g., Doe v. Myspace, Inc., 528 F.3d 413, 420 (5th Cir. 2008). This acknowledgement shows that holding a website liable because of its decision to publish particular content naturally treats it as a “publisher” of that content. It is beside the point that different content, the warning itself, “could be deemed an act of publishing” by the website, not a third party.47×47. Internet Brands, 824 F.3d at 851. In addition, § 230’s subject-matter exceptions, for instance federal criminal law,48×48. 47 U.S.C. § 230(e)(1) (2012). should assuage the concern that it is a “get-out-of-jail-free card.”49×49. Internet Brands, 824 F.3d at 853. These exceptions, among others,50×50. Most obviously, a website is not immune if it develops the content at issue. See § 230(c)(1) (providing immunity only when the information is provided by “another information content provider”); id. § 230(f)(3) (defining “information content provider”). provide a relevant limiting principle for § 230: websites are not immune from accomplice liability.

Case law bolsters a broad understanding of the statute. Just as in the MySpace decision that Internet Brands distinguished, the claim here arises from a failure to intervene in third-party communications that exposed the plaintiff to dangerous predators. The Myspace court cited a Third Circuit case that held that a subscriber’s failure-to-protect claim “attempts to hold AOL liable for decisions relating to the monitoring, screening, and deletion of content from its network — actions quintessentially related to a publisher’s role. Section 230 ‘specifically proscribes liability’ in such circumstances.”51×51. Green v. Am. Online, 318 F.3d 465, 471 (3d Cir. 2003) (quoting Zeran v. Am. Online, Inc., 129 F.3d 327, 333 (4th Cir. 1997)); see also Fair Hous. Council v. Roommates.com, LLC, 521 F.3d 1157, 1170–71 (9th Cir. 2008) (en banc) (“[A]ny activity that can be boiled down to deciding whether to exclude material that third parties seek to post online is perforce immune under section 230.”). As the district court here distilled, the inquiry focuses on how the cause of action treats the defendant, not the name of the cause of action.52×52. See Doe v. Internet Brands, Inc., No. 12-cv-3626, 2012 WL 12882765, at *2 (C.D. Cal. Aug. 16, 2012). Internet Brands faced the same decisions as MySpace: how to monitor content and what content, such as profiles and contact information, to allow or reject based on potential liability. Regardless of the cause of action’s name, Doe’s claim seeks to hold the website liable for its decision to host a third-party communication — her profile — and therefore the claim treats the website as a publisher.

At most, the statute is ambiguous as applied to Doe’s claim. If a statute is ambiguous but announces policies, interpreting courts should defer to those statutory statements of purpose enacted by Congress.53×53. See United States v. Turkette, 452 U.S. 576, 588–90 (1981) (relying on “the declared purpose of Congress” in interpreting the Racketeering Influenced and Corrupt Organizations Act, id. at 589). In § 230, Congress announced the “policy of the United States.”54×54. 47 U.S.C. § 230(b) (2012). These policy objectives favor immunity in this case.

As the court recognized, a key policy of § 230 is to refrain from chilling online speech55×55. See Internet Brands, 824 F.3d at 852. and, “[a]s section 230(b) itself explains, ‘[i]t is the policy of the United States . . . to promote the continued development of the Internet . . . [and] to preserve the vibrant and competitive free market that presently exists for the Internet.’”56×56. Id. (quoting 47 U.S.C. § 230(b)). The court itself acknowledged that imposing liability on websites “could be said to have a ‘chilling effect’ on the internet” because it makes operating websites “marginally more expensive.”57×57. Id. These marginal costs chill speech, and as Professor David Ardia noted in his empirical study of § 230, “[b]ecause revenue from each marginal customer is small and the cost of a legal defense, not to mention potential monetary sanctions, is high, it is almost always cheaper for the intermediary to remove speech than to expend time or resources contesting even meritless claims.”58×58. David S. Ardia, Free Speech Savior or Shield for Scoundrels: An Empirical Study of Intermediary Immunity Under Section 230 of the Communications Decency Act, 43 Loy. L.A. L. Rev. 373, 379 n.8 (2010). Specifically, when faced with the potential for costly lawsuits, websites may be reluctant to publish third-party content that could incur failure-to-warn liability and they might err toward limiting third-party speech.59×59. See id.; see also Zeran v. Am. Online, Inc., 129 F.3d 327, 331 (4th Cir. 1997) (“The specter of tort liability in an area of such prolific speech would have an obvious chilling effect.”). The burden applies to any website that may become aware of dangers to users from its content, from Facebook to Match.com.60×60. See Beckman v. Match.com, LLC, No. 13-16324, 2016 WL 4572383 (9th Cir. Sept. 1, 2016) (relying on Internet Brands to reverse dismissal of failure to warn claim against Match.com). Accordingly, § 230 has been called “the most important law protecting internet speech” and “perhaps the most influential law to protect the kind of innovation that has allowed the Internet to thrive since 1996.”61×61. CDA 230: The Most Important Law Protecting Internet Speech, Elec. Frontier Found., https://www.eff.org/issues/cda230 [https://perma.cc/VSY8-LR3A]; see also David Post, A Bit of Internet History, or How Two Members of Congress Helped Create a Trillion or So Dollars of Value, Wash. Post: Volokh Conspiracy (Aug. 27, 2015), https://www.washingtonpost.com/news/volokh-conspiracy/wp/2015/08/27/a-bit-of-internet-history-or-how-two-members-of-congress-helped-create-a-trillion-or-so-dollars-of-value [https://perma.cc/L7GS-5G9M].

While Internet Brands may chill speech, its safety benefits will likely be limited. The court noted that § 230’s “core policy” is to allow websites to regulate third-party content without incurring liability.62×62. See Internet Brands, 824 F.3d at 851–52 (relying on 47 U.S.C. § 230(c) (2012)). As the court explained, Congress adopted § 230 to avoid forcing a website “to choose between voluntarily removing some offensive third party content, which would expose the site to liability for the content it did not remove, or filtering nothing, which would prevent liability for all third party content.”63×63. Id. at 852. The court’s ruling, however, exposes websites to this dilemma: choosing between investigating risks presented by their website in order to eliminate or warn of them, which would expose a website to potential liability for warnings it failed to convey, or doing nothing, staying in the dark to prevent liability for all third-party content. The ruling, therefore, may discourage websites from seeking knowledge to prevent the harms that occurred here because efforts to investigate or warn could incur liability.

Finally, any safety benefits from the court’s ruling also depend on effective warnings. In order to protect themselves from as much liability as possible, websites are also likely to make their warnings long and detailed in order to cover many dangers.64×64. See Eric Goldman, Section 230 Baffles 9th Circuit (Again) — Doe #14 v. Modelmayhem, Tech. & Marketing L. Blog (May 31, 2016), http://blog.ericgoldman.org/archives/2016/05/section-230-baffles-9th-circuit-again-doe-14-v-modelmayhem.htm [https://perma.cc/8EL6-RASN]. For instance, websites would have an incentive to warn of the exact type of dangers here, in detail, but would also provide a dense litany of additional specific warnings about many other scams and risks. Websites may even attempt to include waivers of liability along with the warnings. They would be unlikely to include names of specific people out of concern over defamation.65×65. See Robert L. Rogers III, Ninth Circuit Court of Appeals Holds that Communications Decency Act Does Not Bar Actions Against Website Operators for Failure to Warn, Comm. Law., Winter 2015, at 8, 9–10. In addition, a specific warning can be circumvented; Flanders used a fake identity and targeted other websites.66×66. Internet Brands, 824 F.3d at 849; see Brian Hamacher, Sex Abuse Lawsuit Filed in Talent Agent Rape Case, NBC 6 S. Fla. (Oct. 25, 2011, 2:26 PM), http://www.nbcmiami.com/news/Sex-Abuse-Lawsuit-Filed-in-Talent-Agent-Rape-Case-132540048.html [https://perma.cc/YS8L-WWET]. The court said that the warning could be given “by posting a notice on the website or by informing users by email.”67×67. Internet Brands, 824 F.3d at 851. Websites would likely opt to “post[] a notice” because conveying comprehensive warnings through their Terms of Service easily ensures all users have constructive notice of a warning and any updates.68×68. See Nguyen v. Barnes & Noble Inc., 763 F.3d 1171, 1175–77 (9th Cir. 2014) (explaining how Terms of Service bind users). Such a system would lead to very few safety benefits because users almost never read the pages containing the terms that bind them69×69. See Florencia Marotta-Wurgler, Will Increased Disclosure Help? Evaluating the Recommendations of the ALI’s “Principles of the Law of Software Contracts,” 78 U. Chi. L. Rev. 165, 168, 179 (2011) (finding low rates of readership in a specific online setting). and are even less likely to read litanies of warnings buried in those pages. Finally, any benefits should be discounted by the existing incentives websites have to monitor content and warn users of various dangers in order to maintain users’ trust and business.70×70. Cf. Eric Goldman, Online User Account Termination and 47 U.S.C. § 230(c)(2), 2 UC Irvine L. Rev. 659, 672 (2012) (discussing website efforts to remove offensive content). Indeed, since § 230’s adoption, websites have adopted various screening programs, even though they are not legally obligated to do so.71×71. Ardia, supra note 58, at 489–92 (discussing voluntary content removal by websites).

Even if the statute is ambiguous in this case, its policy objectives tip the scales in favor of immunity. The court’s narrow definition of “publisher” will likely chill speech and fail to achieve the safety benefits the court seeks. The court’s ruling perversely discourages monitoring, and any additional warnings resulting from this case will have limited efficacy.