Comments on the “Platform Accountability and Consumer Transparency Act” (the “PACT Act”)

Last month, Sens. Schatz and Thune introduced S. 4066, “Platform Accountability and Consumer Transparency Act” (the “PACT Act”). The bill was pitched as a narrow and modest bipartisan reform of Section 230; and Daphne Keller of Stanford labeled the bill an “intellectually serious effort” and a “huge step forward” compared to other alternatives. While the PACT Act may lack the malevolence of more extreme Section 230 reform proposals, it’s not narrow, modest, or good. Some of the bill’s biggest problems: the bill doesn’t appear to solve any problems; its regulatory approach contravenes the First Amendment; and it imposes significant costs on UGC sites that will grow exponentially when the bill’s features are weaponized. Unless you generously grade this bill on a curve against the burn-it-all-down anti-Section 230 proposals, this is not the reform alternative you are looking for.

Overview of the Bill

The bill has three main components: dictating procedural operations for UGC sites (what I call the “Santa Clara Principles”); reducing Section 230; and requesting studies.

1) “Santa Clara Principles”

The Santa Clara Principles emerged alongside the Santa Clara University conference on Content Moderation and Removal in 2018. The Santa Clara Principles encourage UGC sites to improve their disclosures through transparency reports (“numbers”) and adopt more due process-like procedures, including providing users with notice of the site’s editorial decisions (“notice”) and the right to appeal (“appeals”).

The bill contains a package of reforms loosely following the Santa Clara Principles, plus a requirement to honor court decisions that declare content/actions illegal. Pursuant to the bill, UGC sites would be required to:

• adopt an “acceptable use policy” (AUP) that describes what content is acceptable on the site and what steps the site takes to ensure AUP compliance.
• accept notifications of court decisions and complaints of AUP violations via an email address, a web form, AND a toll-free phone number staffed by humans.
• provide an “easily accessible” mechanism (presumably an automated web tool) for complainers to track their complaints.
• honor court decisions within 24 hours of receipt, but only if the court found “illegal activity” under federal law or “illegal content” under federal law or state defamation law. This provision would partially overturn Blockowicz v. Williams, Hassell v. Bird, and a few similar decisions.
• act on notices of alleged AUP violations in 14 days.
• if the UGC site removes content based on an alleged AUP violation identified in a third-party’s complaint, it must (1) give an explanation to the content uploader and complainer, and (2) provide an appeals process to the uploader.
• if the UGC site removes content for alleged AUP violations for other reasons (such as human or automated moderation), then the uploader can complain to the UGC site, which then has 14 days to review the content (again?), determine if there was in fact an AUP violation, “take appropriate action” in response to that determination, and notify the uploader of its decision and the actions it took.
• publish an exceptionally detailed quarterly transparency report via an “open license” and in a “machine-readable and open” format.
  • To get a flavor for the requirements, here’s just one of the reporting obligations: “the number of instances in which the interactive computer service provider took action with respect to illegal content, illegal activity, or known potentially policy-violating content due to its nature as illegal content, illegal activity, or known potentially policy-violating content, including content removal, content demonetization, content deprioritization, appending content with an assessment, account suspension, account removal, or any other action taken in accordance with the acceptable use policy of the provider, categorized by—(i) the category of rule violated; (ii) the source of the flag, including government, user, internal automated detection tool, coordination with other interactive computer service providers, or personnel employed or contracted for by the provider; (iii) the country of the information content provider; and (iv) coordinated campaign, if applicable”

The Santa Clara Principles provisions do not apply to vendors who provide “web hosting, domain registration, content delivery networks, caching, back-end data storage, and cloud management.” The transparency report and toll-free number obligations do not apply to “small” UGC sites who in the “most recent 24-month period (A) received fewer than 1,000,000 monthly active users or monthly visitors; and (B) accrued revenue of less than $25,000,000.” Instead of the 24 hour/14 day turnarounds, small UGC sites would need to act within a “reasonable time.”

As an FTC Act Section 5 violation, the FTC can enforce the provisions on transparency reports and notifications to complainers and uploaders. The bill doesn’t specify enforcement for the other Santa Clara Principles.

2) Section 230 Amendments

The bill proposes to amend Section 230 three ways:

• Paralleling the affirmative obligation to honor court decisions, to reinforce that Section 230(c)(1) does not apply when UGC sites are notified of court decisions (subject to the same exclusions referenced above).
• To add a new exclusion for federal government enforcement of any “[Federal] civil statute, or any regulations of an Executive agency (as defined in section 105 of title 5, United States Code) or an establishment in the legislative or judicial branch of the Federal Government.” I’m not sure exactly what an “establishment” is, but this page might help.
• State AGs may enforce federal civil law without restriction from Section 230.

3) Studies

The bill authorizes two studies:

• GAO should research the costs/benefits of providing whistleblower protections and awards to employees/contractors of Internet companies.
• NIST should develop voluntary standards for “good faith moderation practices.” FWIW, the Trust & Safety Professional Association will provide the infrastructure to help improve industry-wide moderation practices without any government involvement.

My Top 9 Concerns (yes, and I could write SO MUCH MORE)

1) What Problems Do the Bill Seek to Solve? 

This bill contains a lot of different policy ideas. It adds multiple disclosure obligations, regulates several aspects of sites’ editorial processes, makes three different changes to Section 230, and asks for two different studies. Any one of these policy ideas, standing alone, might be a significant policy change. But rather than proposing a narrow and targeted solution to a well-identified problem, the drafters packaged this jumble of ideas together to create a broad and wide-ranging omnibus reform proposal. The spray-and-pray approach to policymaking betrays the drafters’ lack of confidence that they know how to achieve their goals.

2) What Problems Do the Section 230 Amendments Solve?

At the App Coalition event, Sen. Schatz stressed that Section 230 needed to be refreshed due to its age. To me, that perfectly encapsulated my problem with the bill–it seeks to do something to Section 230, but lacks clarity about why other than Section 230 is a quarter-century old and the Internet “is different now” (I believe that’s what he said). We especially see the problem-solution nexus concern with the Section 230 reforms. What problems are those intended to solve?

First, regarding removing content/activity that courts have declared as illegal–how often does this problem come up? Virtually every UGC site routinely honors court decisions without hesitation, even though they are not legally required to do so. So, what are the situations where that is not happening, and what evidence indicates this is a problem? I’ll address many other concerns with the court decision issue in a moment.

Second, the bill seeks to exclude federal government enforcement of federal civil law from Section 230. This is puzzling because the federal government is rarely limited by Section 230. The few examples stand out because of their rarity: HUD ran into a Section 230 defense in its enforcement action against Facebook for discriminatory ad delivery (it’s not clear Facebook’s defense was meritorious); and the FTC occasionally runs into Section 230 defenses, though it overcomes them (see, e.g., FTC v. Accusearch; FTC v. LeadClick). Despite that, this is not a narrow change. The federal civil law is massive and wide-ranging, so it’s hard for me to enumerate all of the potential consequences of excluding federal civil law from Section 230. The bill drafters should be explicit about why this exception is needed, its potential unintended consequences, and if a more precise exemption would adequately address the places (if any) where Section 230 is being overly restrictive.

Third, why are state AGs needed to help enforce the federal civil law newly exposed by Section 230? If federal civil law needs to be excluded from 230 (which I don’t think is the case), this should be done in two stages: first, relax Section 230 for federal civil laws; and if that change doesn’t produce the intended result because the DOJ can’t adequately enforce, then deputize the state AGs to supplement the DOJ. Doing both changes at once doesn’t make sense, as illustrated by FOSTA. Among other changes, FOSTA partially removed Section 230’s constraints on state AGs’ actions, but I am not aware that any state AG has yet used this new power–so why was the FOSTA exclusion needed? Meanwhile, there are good reasons to be concerned about how state AGs would enforce Section 230. Most critically, state AGs are provincial and many are elected, so their motivations differ–usually in unfavorable ways–from the DOJ’s administrative and national orientation. I explain these and other concerns more here.

Note: this obviously wrong “finding” (emphasis added) undermines the bill’s credibility: “Online consumers are not adequately protected in the United States because, with the exception of Federal criminal statutes, providers of interactive computer services are immune from the enforcement of most Federal statutes and regulations.” Sorry, what? In addition to the federal crimes exception, Section 230 statutorily excludes federal IP claims (except DTSA) and ECPA claims. Furthermore, general-purpose laws not specific to UGC are untouched by Section 230. See, e.g., Chicago v. StubHub (involving a local tax, but the general principle would extend to general-purpose federal laws).

3) Unconstitutional Regulation of Editorial Functions

I generally support the Santa Clara Principles as aspirational goals for the few large players that can afford them, but I did not sign onto the principles because I don’t believe the UGC community should be subject to one-size-fits-all obligations. For this reason, it’s easy to simultaneously like the Santa Clara Principles and not like the PACT Act. Making the principles compulsory would impose detailed new requirements on small and mid-sized companies that even Internet giants like Facebook or YouTube will struggle to meet.

The bill also runs head-first into a huge First Amendment brick wall. If mandatory, the Santa Clara Principles tell online publishers how to manage their editorial practices, which the First Amendment doesn’t permit the government to do. Imagine how it would look if a legislature tried to compel book publishers to follow the Santa Clara Principles, such as:

• mandating that book publishers publicly announce what book manuscripts they consider acceptable and which they won’t. Book publishers routinely voluntarily post submission standards, but I can’t think of any medium where a law mandates that private publishers make such disclosures.
• dictating how book publishers accept complaints about book content and requiring publishers to provide an easily accessible tracking mechanism for those complaints.
• requiring that the publishers stop publishing books within 24 hours of a court finding that the book has defamatory content (indeed, recall the old maxim that equity doesn’t enjoin a libel, though that principle isn’t absolute).
• acting on complaints that published books that don’t comply with the publisher’s submission guidelines within 14 days.
• giving book authors a mandatory right to appeal rejections of their manuscripts.
• mandating quarterly reports about book manuscript submissions, complaints received about published books, etc. (cf. Washington Post v. McManus).

I’m not sure which of these obligations would be constitutional. I suspect none of them. The reality is that most regulators would never go there, even in heavily concentrated media niches. I hope some of my colleagues will do the detailed, time-consuming, and tedious work to explore the unconstitutionality of each of the Santa Clara Principles requirements.

4) The Challenges of Honoring Court Decisions

Superficially, it sounds appealing to require UGC sites to honor court determinations of illegal content/activities. Stanford’s Keller called it “low-hanging fruit.” We trust courts as authoritative decision-makers, and we trust they will make better illegality determinations than UGC sites will. Yet, there are good reasons to be skeptical of the bill’s approach.

First, illegitimate court orders are a serious concern. There are many ways to game the system. One known approach is to intentionally sue the wrong content uploader, establish “service,” and then get a default judgment. Some plaintiffs have literally forged court orders. Prof. Volokh has documented dozens of examples. The bill acknowledges this risk, specifying that the plaintiff tendering a court decision must include a pointer to the court docket and make declarations under “penalty of perjury” (a statement that is toothless, as we’ve seen with the perjury declaration requirement in 512(c)(3) notices). However, as I mentioned above, UGC sites routinely honor court decisions already, so the bill’s atmospherics about better quality notifications won’t abate any gaming.

Second, as the EFF points out, the bill requires UGC sites to honor lower court decisions before the defendant has exhausted all of its appeals. We saw an example of how premature content removal can go wrong in Garcia v. Google, when the Ninth Circuit dubiously issued a secret court order compelling Google to remove the Innocence of Muslims video that the Ninth Circuit later concluded was always legal.

Third, I don’t understand how the UGC site is supposed to implement a court decision that content or activity is illegal. The bill seems to contemplate that the decision will give the UGC site a roadmap of exactly how to surgically excise the illegal stuff, but in reality many orders are likely to be unspecific about exactly what is illegal and how it’s supposed to be remedied. The plaintiff’s notice to the UGC site is supposed to include an “[i]dentification of the illegal content or illegal activity, and information reasonably sufficient to permit the provider to locate the content or each account involved”–but how granular must this be? What happens if the plaintiff’s instructions are not consistent with the court order, or the instructions are imprecise and require the UGC site to make judgment calls on how to implement it? Remember, the UGC site has to implement the court decision in 24 hours, so it doesn’t have the luxury of seeking clarification.

Two related questions: (1) does the court order impose ongoing obligations on the UGC site? The bill says “Nothing in this paragraph shall be construed to condition the applicability of paragraph (1) to a provider of an interactive computer service on the provider monitoring the interactive computer service or affirmatively seeking facts indicating illegal content or illegal activity in order to identify instances of noticed activity or content additional to any instances about which the provider has received a notification.” However, the bill contemplates that UGC sites must honor the removal of accounts, which prospectively eliminates all future activity–legitimate or not–by that account. Also, I wonder how UGC sites will handle a court order that prospectively bans certain content or accounts in the future; even if this bill says the UGC site doesn’t have an ongoing monitoring duty, will UGC sites feel comfortable ignoring the court order with the associated risk of being held in contempt?

(2) the obligation to remove accounts will remove all content associated with that account, even legitimate content; and removing accounts and content can orphan any third-party content attached to the removed material, such as Facebook comments to someone else’s post that gets removed. The fact the bill mandates this collateral damage on legitimate content highlights some of the bill’s significant First Amendment and due process problems.

Note: in addition to the mandatory removal requirement, the bill carves back Section 230(c)(1) protection for content/activity identified by the court decisions but surgically leaves Section 230(c)(2) in place. Section 230(c)(2) generally doesn’t protect leave-up decisions (the only decisions that would be targeted by court orders contemplated by the bill), but this distinction still confused me.

Fourth, the bill sidesteps the vexing problem of whether or not the plaintiff must sue UGC sites as part of obtaining the court order. There are downsides to each approach.

[Note: in part, this issue arises because FRCP 65 doesn’t allow courts to impose injunctions on unrelated parties, but this bill seeks to require UGC sites to honor court orders that FRCP 65 would not otherwise apply to them. I couldn’t tell if the bill is amending FRCP 65, directly or implicitly, and if this bill follows the proper process for such an amendment.]

If UGC sites must be named defendants in order to be bound by the court decision, UGC sites will be included in pretty much every lawsuit over online content to preserve the remedy option. That would impose substantial litigation costs on them.

If UGC sites aren’t named as defendants, then it’s an obvious due process problem to obligate them to comply with court decisions from litigation they didn’t participate in. This is why FRCP 65 restricts who can be bound by a court decision. Cf. Hassell v. Bird, where the plaintiff improperly tried to bind Yelp to the results of a lawsuit even though it wasn’t a defendant in the suit. Notice how the bill’s 24 hour turnaround time exacerbates the due process problem because the UGC site won’t have time to challenge the court decision. 24 hours isn’t even enough time to conduct a cursory investigation of the order’s legitimacy; so where the bill says the UGC site can have more time “based on concerns about the legitimacy of the notice,” that will occur only when gross problems are impossible to ignore.

Not only does this compulsion raise due process problems, but it highlights the First Amendment defects with the bill. The bill ignores that UGC sites may have their own independent freedom of speech/freedom of press interests in publishing third-party content. I address this issue more in my analysis of California’s online eraser law. (There never has been a First Amendment challenge to that law because everyone has ignored it). The omission of UGC sites from the underlying litigation would mean that the court didn’t properly consider the UGC sites’ independent First Amendment interests in crafting the outcome (part of the due process problem).

5) Compliance Costs and the Small Business Carveout

The bill imposes compliance costs on UGC sites. To comply with the bill, UGC sites would have to revamp their UGC operations, build custom software tools, transition their databases to meet the law’s requirements, hire new employees to deal with all of the complaints, explanations, and appeals, obtain new insurance coverage, and spend money on lawyers to redraft their policies and review all of the compliance obligations.

To mitigate the costs of complying with the Santa Clara Principles, UGC sites would cut as many corners as possible. Most obviously, the UGC sites would make their AUPs as unspecific as possible–in direct contravention of the bill’s purported transparency goal. The bill says that the AUPs must “reasonably inform” users about what content is acceptable, but because every detail in the AUP will create compliance obligations, the lawyers will push to disclose as little as possible. Similarly, the explanations will be quite general–how much transparency does it really add to tell an uploader that their content was removed due to a hate speech violation? And where possible, all of the interactions (other than the toll-free number) will be automated and not actually involve human interaction. Thus, if the bill permits it, the “reviews” of complained-about content will be automated as much as possible, even if the initial editorial decisions were also automated. (If not, the costs of doing manual human reviews on demand could be overwhelming, especially after the bill is weaponized as discussed below).

Furthermore, the bill eliminates some obligations for small businesses, but the quantitative standards for determining small business eligibility are poorly designed:

• the traffic measuring stick is 1M “monthly active users or monthly visitors.” How are months measured–calendar months or any 30-day period? How are “visitors” counted–is it unique visitors or does it include repeat visits? No matter; “monthly visitors” always will be larger than “monthly active users,” so MAUs is the only relevant test.
• there is a 24-month lookback period for the traffic measuring stick. The bill doesn’t distinguish between averages and maxima. If the latter, a small UGC site with seasonal spikes or a single viral hit will get walloped with a payload of compliance obligations.
• is there a phase-in period? Or does a UGC site need to comply immediately after it crosses the numerical threshold?
• the revenue measuring stick is over 24 months, not the more typical annual measure. So the $25M standard is more like $12.5M annually.
• the revenue covers the entire enterprise, not just the UGC functions. So a large company with a small UGC offering will clear the standard even if the UGC offering is not integral to the business. A good example would be online retailers that let shoppers comment on vended items. The bill would encourage big companies with small UGC functions to shut down the UGC component due to the costs.
• the bill applies if a UGC site satisfies either the traffic or revenue measuring sticks. Thus, a UGC site drops out of the small business exception if it has more than 1M MAUs OR $25M in revenues over 2 years.

For reasons that are unclear to me, bill-drafters routinely struggle to distinguish bigger from smaller UGC sites. Small-business carveouts don’t cure bad policy ideas, but they don’t do anything useful when improperly designed. Any attempt to distinguish big from small Internet services should, at a minimum:

• require the regulated company to meet both the traffic and revenue measures, not just one or the other. Otherwise, the carveout creates false positives for low revenue but highly leveraged sites and for big companies with a small UGC presence.
• use MAUs as a traffic measure, but only if they are averaged over a sufficiently long period to avoid the seasonal/viral spikes.
• measure only revenue from the UGC function, not the overall corporate enterprise–say, a newspaper’s UGC tools, not its entire revenues including print subscriptions.
• provide a proper phase-in period after both measurements are met.

The bill’s Santa Clara Principles can apply to nonprofit UGC sites (the bill expressly says this) and UGC sites with no revenue at all. It’s perplexing to see non-commercial and non-revenue services included within FTC”s Section 5 authority.

Because the bill reaches every UGC site, even the tiniest ones, many sites will exit the UGC industry. For example, I’d probably shut down blog comments rather than creating a complaint tracking system. The costs also raise entry barriers, discouraging new entrants, and solidifying the position of incumbents. The bill claims that it’s our country’s policy “to preserve the internet and other interactive computer services as forums for diversity of political discourse, unique opportunities for cultural development, and myriad avenues for intellectual and commercial activity,” but this bill is a hard shove in the opposite direction.

6) Weaponized Complaints and the Decline of Automated Editorial Practices

The bill makes an unstated assumption that notices to the UGC site (e.g., a third party notice of an alleged AUP violation, or an uploader protesting the removal of its content) are legitimate. At this point in the Internet’s history, that assumption is not credible. The bill acknowledges that “the user may submit a complaint in good faith” through the required notification systems, but the bill doesn’t explain what happens if the complaint isn’t made in good faith. Can the UGC site just ignore it without legal consequence? Who knows.

The bill could have specified more details for submitting notices, like the requirements of Section 512(c)(3) (including, crucially, precisely specifying the location of the allegedly AUP-violative content) and meaningful legal consequences for bogus notifications (not like the toothless 512(f)). It makes sense to raise notification costs, even minimally, and any mandatory prerequisites would help the UGC site weed out non-compliant notices. The bill seems to contemplate that UGC sites can structure their web intake forms with mandatory fields, but that won’t affect notices submitted via the required email and toll-free intake systems.

These Santa Clara Principle features are easily weaponized. Some of the many possible ways:

• a user could submit an alleged AUP-violation that “content on the site defames me.” The bill requires UGC sites to “review the content”–presumably the entire site, since the complaint didn’t specify an individual item of content. Multiply that by thousands or millions of clueless and malicious similar notifications. Now what?
• a coordinated group of attackers could target a site author, submitting complaints about each and every post and forcing the site to review every single post by the targeted author for AUP violations. At some point, the cost of keeping that author might be prohibitive (something that almost certainly would come up for speakers from marginalized communities). This is especially true if the attackers can use the toll-free number to drain the company’s costs and tie up the review process.
• Because AUP policies will certainly restrict IP violations by users, IP owners will flood the system with the robo-notices they are already generating. More on that in a moment.
• A malicious content submitter, like a spammer, can demand a review for every single removed item. If a spammer submits millions of filtered items, the spammer can demand millions of reviews. Spammers might do this for shits-and-giggles, but it’s also a way of increasing the costs of a targeted UGC site. This poses a significant threat to all content moderation processes.

Every extrajudicial notice process, such as 512(c)(3) notices and other types of NOCIs, gets weaponized, so of course the bill’s features will be weaponized too.

7) The Bill’s Interplay With Section 512 and Other Laws

The bill doesn’t mention the notice-and-takedown procedures in Section 512 at all. Per the 512 prerequisites, AUPs are essentially required to prohibit copyright infringement (512 says sites must notify users of their repeat infringer policy). This means copyright owners can simultaneously take advantage of both the DMCA procedures and this bill’s Santa Clara Principles features. That means:

• all UGC sites would need to provide a way for copyright owners to easily track the status of their 512(c)(3) notices. In light of the millions of robo-notices already being sent, this sounds like a major engineering expense for many UGC sites.
• all UGC sites would need to investigate any alleged copyright infringement (the bill says the site must “review the content [and] determine whether the content adheres to the acceptable use policy of the provider”). This implicitly modifies the DMCA notice-and-takedown scheme, which lets service providers honor or ignore takedown notices without doing any investigation at all (though those choices may have liability implications).
• the bill also requires UGC sites to “determine whether the content adheres to the acceptable use policy of the provider; and (iii) take appropriate steps based on the determination made under clause (ii).” This overlays the notice-and-takedown scheme by creating a 14 day resolution period; in contrast to the DMCA’s prerequisite of an “expeditious” response. I think most people nowadays would say that 14 days isn’t an expeditious response (see, e.g., Feingold v. RageOn, saying an 18 day turnaround was not expeditious); but the PACT Act would create a hard stop.
• unlike 512(c)(3), the bill would let copyright owners submit complaints as generic as “your site has content that infringes my copyright” and force UGC sites to review those unspecific complaints. Every copyright owner will love this; it would be a great supplement to the 512(c)(3) notices they send, plus the PACT Act-required reviews could create actual knowledge or red flags of infringement that disqualifies the UGC site from the 512 safe harbors.

The bill also doesn’t address its interactions with the 512(g) counternotification process. In addition to or instead of the 512(g) process, an uploader accused of posting copyright-infringing material could respond with a PACT Act appeal. But this would put the UGC site in a worse-off position. Per 512(g), the UGC site can restore the complained-about work without doing any further investigation. The PACT Act requires the UGC site to review the appeal, make a determination, and notify the content uploader AND the copyright owner of the determination. What will result if, after review, the UGC site concludes that the uploader is indeed infringing and the UGC site tells the copyright owner of that conclusion? Where 512(g) would have kicked this issue completely over to the courts, the UGC site is likely to pull the content–despite the counternotification & 512(g) terms–to avoid hosting infringing content that it has concluded likely infringes. All of these troubles can be avoided if the content uploader only files a 512(g) counternotice and not a PACT Act appeal. Did the bill authors really intend to create a mechanism that would make users worse off compared to the existing baseline?

More generally, the bill overlays a massive range of laws that already cover similar ground, and it does little or nothing to harmonize with those laws. Some other examples:

• We generally assume that non-copyright IPs are subject to a common-law notice-and-takedown requirement, but without the DMCA’s specificity. How would the PACT Act requirements affect that common-law scheme? At a minimum, IP owners would get a complaint tracking system and a guaranteed response within 14 days (the common-law scheme may already require shorter reaction times–not sure). It’s unclear how a UGC site would evaluate a content uploader’s appeal. 512(g) provides an immunity for restoring content when the prerequisites are met, but the common law doesn’t–so UGC sites would regularly side against the content uploader at the peril of creating liability to the IP owner. I’m also unclear about the risks of the process to trade secret owners alleging misappropriation. Could the required explanation to the content uploader reveal what items are actually trade secrets…?
• With respect to third-party complaints asserting that content qualifies as child sexual abuse material (CSAM), the bill would require the UGC site to notify the uploader that it removed the content as CSAM. If the uploader knows anything about the law, this will tip off the uploader that the matter has been referred to NCMEC and likely to law enforcement. That would give the uploader a heads-up to take affirmative steps to mask their tracks for law enforcement. (The bill says that the UGC site doesn’t have to provide an explanation if there is a known “ongoing law enforcement investigation,” but that does not describe a NCMEC referral). Could the bill actually aid CSAM criminals???

8) Opening the Door to State-Level Variations. One of Section 230’s strengths is that it eliminates state law variation, a boon for UGC sites that necessarily have users across the country. The uniformity of federal law lets UGC sites worry only about one law–Section 230–plus the mostly federal nature of the Section 230 exclusions (such as federal criminal law and, in some jurisdictions, only federal IP claims).

To their credit, the bill drafters generally sought to preserve this benefit by focusing on federal law. Despite that, the bill opens up UGC sites to state law variation in two important ways. First, as discussed above, it would expose them to new enforcements by state AGs with heterogeneous motivations and disparate interpretations of the law. Second, the bill opens up Section 230 to court decisions on state defamation law–an area with significant variation among the states.

9) Is There a Private Right of Action for the Santa Clara Principles?

The bill’s Santa Clara Principles obligations (Section 5 of the bill) aren’t assigned to a specific part of the US code. I’m not sure what default enforcement options apply to them. Some violations of the Santa Clara Principles “shall be treated as a violation of a rule defining an unfair or deceptive act or practice” in the FTC Act. Normally, Section 5 of the FTC Act does not authorize private rights of action. However, the bill does not make those portions exclusively subject to FTC enforcement. The other parts are not enforceable by the FTC. So who has enforcement authority? Would the entire Santa Clara Principles be subject to a private right of action? That would be devastating because the bill requirements are detailed/technical and govern literally trillions of content decisions, so the volume of litigable questions could be enormous.

Conclusion

Some of the problems I identify could be fixed relatively easily. For example, the bill could add minimum specifications for notices complaining about user content (similar to 512(c)(3)), exclude copyright notices from its scope, and expressly eliminate any private right of action for the Santa Clara Principles. Those fixes seem so obvious to me that I don’t understand how the drafters introduced the bill without them. Still, minor tweaks won’t fix the bill’s architecture. Even with easy fixes, it will remain overstuffed with too many policy ideas, not enough clarity on the problems it seeks to fix, and intrinsic incompatibility with the First Amendment. As much as I’d love to give some love to the bill sponsors for their efforts, I cannot support this bill.