Created by ChatGPT May 2026

The issue is: if a website imposes a government-compelled age authentication wall, what percentage of users will stop at the authentication wall, either because the users turn around or fail to navigate the process? I call that percentage the “balk” rate. For background on prior studies and why balk rates can vary widely, read my prior coverage first.

I’m now reporting on a study by All About Cookies entitled “72% of Americans Don’t Trust the Companies Verifying Their Age Online.” The writeup qualifies the headline claim: “72% of Americans express low levels of trust in the companies and services handling age verification data, including 40% who do not trust them at all.” The other 32% say they “slightly” trust the authenticators.

This chart shows what happened when users were confronted with an age authentication wall (users could select multiple options):

I disregard the first and third options because they are self-reporting, and that isn’t an “authentication” at all. Instead, focus on the bottom three options, all of which are rejections of the age authentication wall (go somewhere else, abandon the effort, or bypass the wall using VPNs). The first two are balk rates; the third also rejects the age authentication wall.

One way of reading this data is that only 31% of consumers were willing to age-authenticate; all other consumers chose some other non-authentication option if they could. Because users could pick multiple choices, we can’t combine the three rejection options (which adds up to 32%) and compare it to the 31% who said they authenticate. But even if we take the most conservative reading of this data and say that there’s at least an 11% balk rate, that’s still a lot of disruption of existing user activity.

The report summarizes this chart with this confusing statement: “Age verification laws don’t get more people to verify: 31% complete verification in states with and without laws. Instead, people in law states are 7x more likely to give up entirely and 4x more likely to use a VPN.” The survey didn’t provide the supporting data to explain the 7x assessment, but I interpret it as a warning that the quantity of consumer balks will soar as more states’ age authentication mandates come into effect.

The next chart asks how comfortable users would be sharing the specific items of data to get through an age authentication wall:

As you can see, the “least” troubling option is an automatically scanned selfie, which more than 2/3 said they would be uncomfortable with sharing. Credit card authentication–which used to be the benchmark for age authentication in the 1990s and is now considered no longer credible–made nearly 9 of 10 consumers uncomfortable.

Over time, these discomfort rates might organically decline as age authentication mandates become ubiquitous, which will cause consumers become to desensitized to the omnipresent privacy invasions.

Zero-knowledge proofs might also change how consumers feel about sharing their government-issued IDs because the ID contents would not be shared. However, to reach that point, consumers first will have to overcome the many troubling implications of installing a government-issued digital ID on their device. Personally, I’m a hard “no” on digital IDs.

We can’t directly infer a balk rate from this data, but it’s not good. When users are uncomfortable with the data disclosure, they weigh the costs/benefits of proceeding. If they can’t easily assess the benefits–which will often be the case with new services that the consumer doesn’t know well–then the discomfort is likely to increase balk rates. As I mention in my Segregate-and-Suppress paper, the resulting changes in consumer behavior are likely to hinder new market entrants and overall market dynamism.

Overall, I don’t see how anyone, especially government regulators, can look at the emerging balk rate data and think that the Internet is going to be just fine when online age authentication mandates become ubiquitous.

Blog Posts on Segregate-and-Suppress Obligations

• More Data on Online Age Authentication Balk Rates
• Fifth Circuit Keeps Doing Fifth Circuit Things –SEAT v. Paxton
• How Often Do Consumers Balk at Doing Online Age Authentication?
• Court Enjoins Another Arkansas Segregate-and-Suppress Law–NetChoice v. Griffin
• Too Many Courts Are Letting States Take Wrecking Balls to the Internet (Roundup)
• Texas Judge Enjoins App Store Authentication Law–CCIA and SEAT v. Paxton
• Courts Enjoin Internet Censorship Laws in Louisana and Arkansas
• Challenge to Maryland’s “Kid Code” Survives Motion to Dismiss–NetChoice v. Brown
• My Testimony Against Mandatory Online Age Authentication
• Read the Published Version of My Paper Against Mandatory Online Age Authentication
• Prof. Goldman’s Statement on the Supreme Court’s Demolition of the Internet in Free Speech Coalition v. Paxton
• Court Permanently Enjoins Ohio’s Segregate-and-Suppress/Parental Consent Law–NetChoice v. Yost
• Arkansas’ Social Media Safety Act Permanently Enjoined—NetChoice v. Griffin
• Why I Emphatically Oppose Online Age Verification Mandates
• California’s Age-Appropriate Design Code (AADC) Is Completely Unconstitutional (Multiple Ways)–NetChoice v. Bonta
• Another Conflict Between Privacy Laws and Age Authentication–Murphy v. Confirm ID
• Recapping Three Social Media Addiction Opinions from Fall (Catch-Up Post)
• District Court Blocks More of Texas’ Segregate-and-Suppress Law (HB 18)–SEAT v. Paxton
• Comments on the Free Speech Coalition v. Paxton SCOTUS Oral Arguments on Mandatory Online Age “Verification”
• California’s “Protecting Our Kids from Social Media Addiction Act” Is Partially Unconstitutional…But Other Parts Are Green-Lighted–NetChoice v. Bonta
• Section 230 Defeats Underage User’s Lawsuit Against Grindr–Doll v. Pelphrey
• Five Decisions Illustrate How Section 230 Is Fading Fast
• Internet Law Professors Submit a SCOTUS Amicus Brief on Online Age Authentication–Free Speech Coalition v. Paxton
• Court Enjoins the Utah “Minor Protection in Social Media Act”–NetChoice v. Reyes
• Another Texas Online Censorship Law Partially Enjoined–CCIA v. Paxton
• When It Comes to Section 230, the Ninth Circuit is a Chaos Agent–Estate of Bride v. YOLO
• Court Dismisses School Districts’ Lawsuits Over Social Media “Addiction”–In re Social Media Cases
• Ninth Circuit Strikes Down Key Part of the CA Age-Appropriate Design Code (the Rest is TBD)–NetChoice v. Bonta
• Mississippi’s Age-Authentication Law Declared Unconstitutional–NetChoice v. Fitch
• Indiana’s Anti-Online Porn Law “Is Not Close” to Constitutional–Free Speech Coalition v. Rokita
• Fifth Circuit Once Again Disregards Supreme Court Precedent and Mangles Section 230–Free Speech Coalition v. Paxton
• Snapchat Isn’t Liable for Offline Sexual Abuse–VV v. Meta
• 2023 Quick Links: Censorship
• Court Enjoins Ohio’s Law Requiring Parental Approval for Children’s Social Media Accounts–NetChoice v. Yost
• Many Fifth Circuit Judges Hope to Eviscerate Section 230–Doe v. Snap
• Louisiana’s Age Authentication Mandate Avoids Constitutional Scrutiny Using a Legislative Drafting Trick–Free Speech Coalition v. LeBlanc
• Section 230 Once Again Applies to Claims Over Offline Sexual Abuse–Doe v. Grindr
• Comments on the Ruling Declaring California’s Age-Appropriate Design Code (AADC) Unconstitutional–NetChoice v. Bonta
• Two Separate Courts Reiterate That Online Age Authentication Mandates Are Unconstitutional
• Minnesota’s Attempt to Copy California’s Constitutionally Defective Age Appropriate Design Code is an Utter Fail (Guest Blog Post)
• Do Mandatory Age Verification Laws Conflict with Biometric Privacy Laws?–Kuklinski v. Binance
• Why I Think California’s Age-Appropriate Design Code (AADC) Is Unconstitutional
• An Interview Regarding AB 2273/the California Age-Appropriate Design Code (AADC)
• Op-Ed: The Plan to Blow Up the Internet, Ostensibly to Protect Kids Online (Regarding AB 2273)
• A Short Explainer of Why California’s Social Media Addiction Bill (AB 2408) Is Terrible
• A Short Explainer of How California’s Age-Appropriate Design Code Bill (AB2273) Would Break the Internet
• Is the California Legislature Addicted to Performative Election-Year Stunts That Threaten the Internet? (Comments on AB2408)
• Omegle Denied Section 230 Dismissal–AM v. Omegle
• Snapchat Isn’t Liable for a Teacher’s Sexual Predation–Doe v. Snap
• Will California Eliminate Anonymous Web Browsing? (Comments on CA AB 2273, The Age-Appropriate Design Code Act)
• Minnesota Wants to Ban Under-18s From User-Generated Content Services
• California’s Latest Effort To Keep Some Ads From Reaching Kids Is Misguided And Unconstitutional (Forbes Cross-Post)
• Backpage Gets Important 47 USC 230 Win Against Washington Law Trying to Combat Online Prostitution Ads (Forbes Cross-Post & More)
• Backpage Gets TRO Against Washington Law Attempting to Bypass Section 230–Backpage v. McKenna
• MySpace Wins Another 47 USC 230 Case Over Sexual Assaults of Users–Doe II v. MySpace
• MySpace Gets 230 Win in Fifth Circuit–Doe v. MySpace
• Website Isn’t Liable When Users Lie About Their Ages–Doe v. SexSearch

The post Some New Data on Age Authentication Balk Rates appeared first on Technology & Marketing Law Blog.

* * *

[Note: as discussed below, I previously missed a Florida case previews the developments in this post. It’s still worth talking now because Snap’s choices are wild.]

Kansas state AG Kobach sued Snap for “deceptive and unconscionable practices” in Kansas state court. Like many other plaintiffs, Kobach argues that: Snap publicly lies to avoid getting slapped with mature ratings in app stores, and Snap designed itself to be addictive. Snap removed the Kansas case from state court to federal court, but Kobach sought to remand the case back to state court. This ruling grants Kobach’s remand request.

A case can remain in federal court if it involves “any person acting under an officer of the United States for or relating to any act under color of such office.” The litigant must show “(1) they acted under the direction of a federal officer, (2) the claim has a connection or association with government-directed conduct, and (3) they have a colorable federal defense to the claim or claims.”

To keep the case in federal court, Snap claims that it acted under the direction of a federal officer based on its work for DHS and FDA. For example, “Snap argues that it was helping DHS and the FDA discharge statutorily mandated missions.” Say what now?

First, Snap might not want to be highlighting its work for DHS or the FDA during the Trump era. I imagine many Snap users would not appreciate Snap taking money to become a propaganda proxy for the Trump administration.

Second, and more importantly, Snap has provided fodder to future plaintiffs who want to argue that Snap has become a state actor when it makes content moderation decisions. (There are a variety of ways plaintiffs can state those claims, typically under the umbrella of jawboning). I cannot see any scenario where Snap can financially or logistically handle the legal status of being a state actor. And it’s exposing itself to this potentially existential risk for…the benefit of remanding cases from state to federal court?

Snap could try to mitigate these harms in two ways. First, it can argue that any direction it took from the government was limited to specified topics and doesn’t implicate its broader content moderation function. Second, it could try to distinguish between being a jawboned entity for Constitutional purposes and the specific statutory elements of the removal statute, an argument strengthened by the fact that Snap’s request failed here (but see the Florida counterpart).

Despite that, Snap has provided plaintiffs with easy cut-and-paste material to support those plaintiffs’ claims that Snap “censored” them on behalf of the US government. Perhaps those claims will survive to summary judgment or even a trial where they might have failed on a motion to dismiss. Thus, as the cost of trying to obtain a smallish procedural win (i.e., to reposition what courts hears the cases), Snap has planted the seeds for long-term, expensive, and high-risk legal entanglements.

For that reason, as I read this case, my brain kept thinking of this clip:

* * *

If you want details about Snap’s work for DHS, Snap worked on the following projects:

• “Know2Protect, an educational campaign aiming to prevent “online sexual exploitation and abuse” and promote online safety”
• “Pledge2Protect, a campaign encouraging people “to take action and educate themselves concerning online child exploitation and preventative measures.””
• “Snap has helped DHS build “custom ‘lenses’”—a Snapchat feature that “allow[s] users to add interactive animations to photos and videos”—for its two campaigns”
• “DHS controls “where and how” its advertisements appear in Snapchat. And Snap obeys DHS’s request by targeting its campaigns to teenage users.”
• “Blue Campaign [] aims to prevent human trafficking and educate the public about human trafficking. DHS advertised Blue Campaign in Snapchat and dictated the placement of the ads.”

Some details about Snap’s work for FDA:

“The Real Cost” and “Next Legends” [] try to educate teenagers about the risks of nicotine and tobacco use. Snap helped the FDA build custom lenses featuring interactive animations that give facts about cigarette and vape usage….the FDA advertises in Snapchat to promote its campaigns. It “dictates” “where and how the advertisements” appear in Snapchat. Snap, per the FDA’s request, targets these advertisements to teenage users.

Much of this sounds like standard publisher-advertiser ad targeting interactions, i.e., the advertiser-customer directs the publisher-vendor to get the best ROI from the ads; with the tiny twist that this advertiser is the federal government. However, I couldn’t tell from this discussion how deeply Snap’s DHS and FDA work might have reached into Snap’s general content moderation activities.

The court says none of Snap’s evidence satisfies the statutory standards for being directed by a federal officer. The court summarizes:

No doubt, Snap performed some services for federal officers. Some of those services—like advertising on Snapchat—reflect no more than a standard arms-length commercial transaction. Other services, like lens production and custom research, didn’t involve a federal officer’s “strict guidance or control” over Snap. Snap thus has failed to identify any conduct that qualifies it as acting under a federal officer.

That conclusion ought to save Snap from the risks it has created for itself. However, Snap has successfully advanced this federal officer direction remand/removal argument at least once before in a case I previously missed. Off. of Att’y Gen. v. Snap Inc., 2025 WL 4035005 (N.D. Fla. Aug. 13, 2025), appeal docketed, No. 25-12814 (11th Cir. Aug. 18, 2025).

The Kansas court acknowledges the Florida lower court opinion:

The court respectfully disagrees with that case’s analysis, which suggests that Snap needn’t show a close or extensive relationship with the federal government to satisfy the acting-under prong. That conclusion isn’t tenable under Tenth Circuit law, which requires “strict guidance or control” and “close supervision of the private entity by the government[.]”

The fact that the Florida case is headed to the 11th Circuit makes that a potentially risky case for Snap and the industry generally. Imprecise words or broad statements from the appellate court could really put Snap (and others) into a much deeper legal hole. There’s also the chance Snap will appeal the Kansas ruling, giving a different appellate court the chance to do something wacky and problematic.

Case Citation: State v. Snap, Inc., 2026 WL 2525593 (D. Kansas Aug. 27, 2026)

The post Snap Wants to be a State Actor??–Kansas v. Snap appeared first on Technology & Marketing Law Blog.

Created by ChatGPT Sept. 2026

Meta’s settlement with the state attorneys general has been touted as industry-redefining. Indeed, Meta desperately hopes it will be. Although Meta was the only industry player to negotiate its terms, the settlement agreement is structured to broadly reshape the social media industry. In addition to Meta’s guaranteed settlement payments of $12 billion, Meta will pay the state AGs a total of $5 billion in additional bonuses — if the state AGs restrict minors’ usage of Meta’s key competitors (and make comparable settlement payments).

The settlement’s quid-pro-quo effectively places a bounty on the heads of Meta’s competitors — and deputizes the state AGs as Meta’s bounty-hunters. Meta wants the government to hit Meta’s rivals. If state AGs deliver the results Meta wants, Meta pays them off. The quid-pro-quo is not subtle. It’s out in the open for everyone to see, but that doesn’t make it any less corrupt or corrosive.

It’s easy to understand why Meta dangled the bounty in front of the state AGs. For years, Meta has urged governments to increase their regulation of social media—but only so long as any new regulation doesn’t disadvantage Meta more than its rivals. By unilaterally entering into the settlement agreement, Meta has exposed itself to a risk that it ends up as the only major industry player hindered by the agreement’s restrictions.

This would put Meta in a precarious market position, especially given the settlement agreement’s time limits on use and the fact that Meta’s competitors are just a click away for consumers. The economic benefits of having its competitors equally restricted are surely worth far more than $5 billion to Meta. That’s why Meta will happily share a piece of its financial upside with the state AGs if they deliver their end of the bargain.

While it’s clearly in Meta’s interests to pay off the state AGs to impose the settlement terms on Meta’s rivals, why are state AGs so eager to become Meta’s bounty-hunters?

To be fair, the state AGs have plenty of motivation to prosecute Meta’s social media rivals without any additional bounties from Meta. Indeed, prior to the settlement, several state AGs had already initiated enforcement actions against some of Meta’s rivals. The state AGs might view the $5 billion bounty as a financial windfall for doing work they were willing to do for free.

Unfortunately, any windfall from Meta’s bounty arrangement comes at a high cost to the state AGs and their constituents.

First, the quid-pro-quo taints all further social media-related state AG enforcement efforts against Meta’s rivals. Going forward, judges, juries and Meta’s rivals will justifiably wonder: Are the state AGs bringing the enforcement action because they genuinely believe their constituents are being harmed, or because they hope to cash in Meta’s bounty?

Second, the state AGs have shown how justice is for sale in their offices. The state AGs will do the anticompetitive work of controlling the marketplace activities of a company’s rival — if enough money is on the table. Putting a price on justice this way degrades the rule of law.

In promoting the settlement, the state AGs have proudly claimed that they are working to protect the children in their states. Instead, Meta’s bounty demonstrates that the state AGs are actually working for Meta. This is a good reason for the courts to think carefully about whether the settlement should be approved.

Our society needs to have difficult and high-stakes conversations about how we can improve children’s welfare online. By selling out the integrity of their enforcement decisions, the state AGs have discredited themselves as contributors to those conversations.

Eric Goldman is a law professor and associate dean for research at Santa Clara University School of Law. He has been teaching and researching internet law for over 30 years.

The post Op-Ed: Meta’s $5 Billion Deal with the State AGs to Take Down its Rivals appeared first on Technology & Marketing Law Blog.

This is a defamation case between a professor and a student in the Emory School of Medicine. It is one of the countless lawsuits related to the Gaza war, Palestinian rights, and Zionism/anti-Zionism.

In this case, the student publicly and repreatedly criticized the professor for serving in the Israel Defense Forces (IDF), and in response the school suspended her. Her suspension became a cause celebre. Separately, the professor sued her and several outlets that amplified her remarks. It is a major proxy battle over its highly charged topics; about two dozen lawyers are litigating some aspect of this case.

This post focuses on one corner of that larger litigation endeavor. Two defendants, CAIR Georgia and CAIR Foundation, used the Instagram Collabs feature to jointly post allegedly defamatory content involving the student’s story. Instagram describes the Collabs feature:

Instagram Collabs allow you to co-author posts with other accounts, sharing the post with both sets of followers and listing both accounts as authors. To create one, tap Tag people and then Invite collaborator before publishing your post; the invited user must then accept the invite via their messages to be added.

CAIR Foundation claimed that Section 230 protected it from liability for the collaborated post with CAIR Georgia. The court disagrees:

it is apparent from the face of the Second Amended Complaint that CAIR Foundation served as a co-author of the IG Post and therefore cannot be considered a benign user under the CDA.

(I’m not sure the “benign user” term improves the Section 230 jurisprudence, but it might make a good band name).

The court describes Section 230’s limits:

It is true that CDA immunity generally applies to reposting content, as many courts have concluded that private individuals reposting are “users.” See, e.g., Life Mastery Network LLC v. Haygarth, 2026 WL 1622887, at *15-16 (D. Haw. May 22, 2026) (collecting cases). But the CDA does not immunize someone who posts original content, so “it makes sense that adding comments to something that is re-posted would not trigger CDA immunity.” As the Plaintiff pleads it, CAIR Foundation did not simply reshare the WSB-TV segment, nor was it just a tagged user in CAIR Georgia’s post. Instead, it co-authored and published a post to its own Instagram page. Even assuming, as CAIR Foundation alleges, that it did not contribute to authoring the post, it at minimum accepted the collaboration invitation from CAIR Georgia knowing it would be tagged as a collaborator with the post published on its own Instagram profile. Moreover, the IG Post did not “merely share” the WSB-TV segment, but included additional commentary in the caption, with comments from CAIR Georgia on the post sharing links.

These factual allegations are enough to overcome a Section 230 defense now. The court says “a jury could find that CAIR Foundation was responsible in part for the creation or development of the IG Post, including the added commentary.”

* * *

I don’t use Instagram, so this is my first time encountering the Collabs feature (though I’ve occasionally experimented with analogous functionality on other services). It makes me wonder how extensively the Collabs tool is used. I did find one other case mentioning the Collabs tool: Kennedy v. Prime Hydration, LLC, 2026 WL 2018652 (W.D. Ky. July 13, 2026) (the facts are too complicated to cover here). However, I did a search in Westlaw’s Law Reviews and Journals database and found only one mention of Instagram Collabs in that literature (in the footnotes of a 2025 student note). Given the novelty of the Collabs angle, I think this case breaks some new ground.

At the same time, this is a reimagining of the issues I was trying to cover in my Co-Blogging Law paper from over 20 years ago. The Internet enables new forms of joint or collaborative content creation and dissemination that overlay existing legal doctrines. In that paper, I wrote: “The law inevitably will blindside some of these co-bloggers. Bloggers may find unexpected liability for their co-bloggers’ posts or actions.” Here, the court says that CAIR Foundation may become a co-author of the Instagram post (at least for defamation purposes), even if CAIR Foundation did nothing other than accept the Collabs invitation and allow CAIR Georgia’s content to reach its audience. In that circumstance, Section 230 steps aside for the co-authored components, whether CAIR Foundation expected it or not. If you are considering using a Collabs functionality, be aware of these risks.

Still, I think Section 230 continues to cast a long shadow on the plaintiff’s allegations. Even though the Collabs feature presents the defendants as co-authors, they might still not be liable for each other’s contributions. It’s analogous to how an online publisher can extensively edit a third-party’s work and, per Section 230, still not become liable for the parts the publisher didn’t edit. In other words, the public-facing co-author characterization doesn’t end the inquiry.Thus, regardless of the labeling, the plaintiff will need to show that CAIR Foundation contributed to the creation or development of defamatory content. That kind of factual inquiry sounds like a typical jury question.

Case Citation: Winer v. Mohammad, 2026 WL 2523973 (N.D. Ga. August 26, 2026)

The post Collaborators Using the ‘Instagram Collabs’ Feature May Forego a Section 230 Defense–Winer v. Mohammed appeared first on Technology & Marketing Law Blog.

In response, the firm sued her for defamation and breach of contract. The firm enumerated seven allegedly defamatory statements, including “They are either scam artists or complete crooks” and “They are not tough, they are not effective and they will rob you blind.” The lower court held these statements were nonactionable hyperbole and the author’s opinion. Other claims failed because the firm didn’t show they were false.

With respect to the contract breach, Section 16 of the firm’s fee agreement said the parties “agree not to directly or indirectly disparage each other either electronically or otherwise.” Because of this, Yelp has flagged the firm’s Yelp business page with a “Questionable Legal Threats” warning:

The link goes to the full text of the Superior Court opinion in this case.

As every lawyer knows, suing a client entails substantial risk of blowback, including possibly a malpractice claim and a complaint to the state bar. Here, the law firm gets other unwanted consequences. Sedgwick successfully brought an anti-SLAPP motion to strike, which means the firm will be paying her legal fees.

The appeals court upholds the anti-SLAPP dismissal, saying “we readily agree with the trial court that the Yelp review criticizing the firm’s representation of Sedgwick is protected activity.” The appeals court adds that “calling someone crooked is ‘merely rhetorical and hyperbolic language’ and not defamatory.”

Of particular note is the court’s treatment of the fee agreement’s non-disparagement clause. The law firm equated disparagement with defamation, so the court said the contract breach claim failed when there was no defamation. The appeals court adds:

Section 16 violates Civil Code section 1670.8. That statute provides: “A contract … for the sale … of consumer goods or services may not include a provision waiving the consumer’s right to make any statement regarding the seller … or its employees or agents, or concerning the goods or services.” By its plain language, it precludes a provision that, like Section 16, purports to require Sedgwick “ ‘not to directly or indirectly disparage’ ” the firm.

We do not share the firm’s concern that this statute “would negate existing law and permit consumers to defame businesses … with impunity.” The statute cannot be reasonably read to immunize defamation. In our context, the statute does not prevent the firm from suing for defamation, if the firm could prove defamation sufficiently to survive an anti-SLAPP motion. The statute merely prevents the firm from including Section 16 in its fee agreement—or thereafter enforcing it.

I haven’t exhaustively researched the issue, but I couldn’t think of a prior court finding a 1670.8 violation. It’s 2026, and I can’t believe anyone–especially a law firm–still doesn’t know that contractual efforts to restrict consumer reviews are no bueno.

I’ve complained about the spate of bogus 1670.8 “drive-by” litigation that is clogging our courts, but here is a real-life bona fide example of an actual genuine 1670.8 violation. Review suppression like this is what the drive-by lawyers should be enforcing, not their current tendentious and tortured reading of TOSes.

The argument that the law firm needs a contractual anti-disparagement clause to prevent defamation is specious. If a client posts a defamatory review, defamation law applies–no contract overlay needed. I discuss that issue more in this post.

It would have been more interesting if the firm had claimed that the contract anti-disparagement clause applied even if there wasn’t any defamation. But 1670.8 would kick in, mooting that claim as unenforceable.

Case Citation: LS Carlson Law PC v. Sedgwick, 2026 WL 2410113 (Cal. App. Ct. August 17, 2026)

BONUS: Greenwich Building Company v. Hoots, 2026 WL 2408839 (N.Y. Supreme Ct. August 11, 2026). A real estate company sued a property buyer for negative reviews on Google and Houzz. The court finds the lawsuit was covered by New York’s anti-SLAPP laws. The court says “online review forums such as Google and Houzz have consistently been held to be public forums under New York’s anti-SLAPP law…The statements are of interest to members of the community who may consider buying or renting an apartment at 120 Java Street.”

The court then says the plaintiff showed a substantial basis for its defamation claim because there is some confusion about the identity of parties (the buyer’s complaints may relate to a different, though possibly, related company).

And yet, the plaintiff didn’t adequately show the buyer had actual malice: “Defendant left his reviews on plaintiff’s Google and Houzz pages after diligent pedestrian online research….defendant’s statements specifically on those online review pages appear to have been the result of an honest mistake and that defendant left his reviews on plaintiff’s pages after a good faith attempt to find the correct pages to leave such reviews….This court too chooses to err on the side of non-actionability in this case so as to promote the public’s right to free speech.”

As a result, the case is dismissed, and the defense will get its attorneys’ fees.

Selected Blog Posts Regarding 1670.8

• Another Court Shuts the Door on “Yelp Law” Drive-By Lawsuits–Arterberry v. Peet’s
• Appeals Court Shuts Down Bogus Private Enforcements of the ‘Yelp Law’–Moss v. GoDaddy
• Catching Up on the Bogus “Yelp Law” Litigation Campaign–Tao v. Uniqlo
• Amazon Must Defend “Yelp Law” Claim–Ramos v. Amazon
• Courts Are Rejecting Attempts to Weaponize Laws That Protect Consumer Reviews
• Businesses Cannot Contractually Ban “Abusive” Consumer Reviews
• California Tells Businesses: Stop Trying To Ban Consumer Reviews (Forbes Cross-Post)

The post Lawyer’s Fee Agreement Gagging Client Reviews Is Illegal–LS Carlson Law v. Sedgwick appeared first on Technology & Marketing Law Blog.

Last month, while sitting at Amsterdam’s Schiphol Airport, a passenger typed www.annefrankmanuscripten.org on her laptop to look up the website at issue in the latest judgment by the Court of Justice of the European Union (CJEU) on geoblocking—the Anne Frank Fonds judgment. The retrieved webpage notified her that “due to copyright considerations,” the content, a scholarly edition of Anne Frank manuscripts, was not available to users connecting from the Netherlands.

Using a VPN service, she connected through a server in Belgium. This time the content webpage appeared, asking her to confirm that she was located in one of the listed “public domain countries.” The page warned her that if she was not located in one of those countries, she was “circumventing protection measures” and possibly “infringing copyrights.”

Had she misrepresented her location and confirmed that she was connecting from Belgium, presumably she could have accessed the content, even though she was in the Netherlands, which is not one of the public domain countries of the publication. The content is still protected by copyright in the Netherlands, where the provider of the scholarly edition has no license to make the content available to the public.

The CJEU judgment in Anne Frank Fonds does not address the liability of the cyber-traveling passenger. Instead, it concerns the liability of other actors in the story—the providers of the content and, in the abstract, a VPN provider.

Given the trajectory of prior CJEU judgments that have discussed geoblocking, and the opinion of the Advocate General in this case, the CJEU’s holdings in Anne Frank Fonds are not surprising. Under EU law, a content provider is not liable for copyright infringement by communicating a work to the public in a country where the work is still protected by copyright and for which the provider has no license, if the provider uses an effective–meaning “state of the art”–geoblocking measure. In such a case, the provider is not communicating to the public in the geoblocked country, even if Internet users can circumvent the geoblocking measure with a VPN or similar service. If the geoblocking measure is not effective and therefore a copyright-infringing communication to the public does take place in the country where the work is still protected by copyright, that communication is attributable to the provider of the content and not to the provider of the VPN or similar service.

Several aspects of the Anne Frank Fonds judgment deserve thorough analysis. At the global level, the judgment might raise concerns that it signals the end of a free and open Internet, legitimizes the balkanization of the Internet, and marks a new era of territorialization of the Internet. But none of these trends are new or surprising. In fact, some commentators might argue the opposite. By clarifying how actors on the Internet may lawfully provide a work to users only in countries where the work is in the public domain or for which the actors hold a license, the judgment advances legal certainty for actors who seek to operate lawfully in cyberspace, thus ensuring that more content becomes available online in general.

Clarity about the ability of actors to geographically limit their conduct online might be an argument against the balkanization of the Internet. If access to content can be effectively regulated by content providers, no government intervention should be necessary to wall off the Internet in individual countries. Even the territorialization of the Internet is not new; the Internet has been subject to gradually increasing territorialization from its origins, and the end of the “Wild West era” of the Internet was inevitable.

Any comprehensive analysis of Anne Frank Fonds should be subject to further debate, but two aspects can be highlighted for now: the establishment of the knowledge standard, and the assessment of the effectiveness of geoblocking measures. Both of these aspects will be crucial for the future of the Internet under the legal regime that the judgment has created.

According to the CJEU, the “obligation to adopt effective technological measures to restrict access” to copyrighted content online falls on “any person who knows or ought reasonably to have known” that a work is protected by copyright in some EU member states, even though the work is in the public domain in other member states (par. 42). In the Anne Frank Fonds case, this knowledge standard presents no issue. The defendants clearly knew that the work was still protected by copyright in the Netherlands, as was confirmed by their deployment of geoblocking measures to prevent access from the Netherlands. But in many other cases, the reasonableness of having knowledge about foreign copyright protection might be debated. Will the expectation of knowledge be the same for corporate content providers, individual influencers, and occasional social media users? Imposition of an unreasonably high standard would translate into uneconomic costs that would deter speech, or at least some speech, on the Internet.

Cost considerations might also affect the standard of legal effectiveness of geoblocking measures. While some costs of doing business on the Internet are reasonable, a requirement that would result in unreasonable costs would negatively affect speech on the Internet. Geoblocking tools are not all created equal; their effectiveness varies. If the law is to rely on geoblocking, minimal technical standards must be set to identify geoblocking tools that meet any legal minimum. In the Anne Frank Fonds judgment, the CJEU confirmed, very sensibly, that a possibility of circumvention does not automatically render geoblocking measures ineffective for legal purposes (par. 51). However, the CJEU left it to the national court to decide whether the deployed measure was effective (par. 48).

The CJEU defined “a geo-blocking measure” as “a process that is aimed at enabling or preventing access to the work published on the website depending on the geographical location of the user in the light of the Internet Protocol address (‘IP address’) which he or she uses to connect to the website” (par. 44). We can only assume, and also hope, that by prefacing the court’s definition with the phrase “[i]n the present case,” the CJEU intended the wording not to be the legal definition of geoblocking measures, because newer geoblocking tools no longer rely solely on IP addresses. If the geoblocking measure deployed by the defendants in Anne Frank Fonds relied solely on IP addresses, the question whether the measure was “state of the art” might be warranted (par. 49).

The post CJEU Judgment on Geoblocking & Standards for Knowledge of Foreign Copyright Laws and Geoblocking Measures (Guest Blog Post) appeared first on Technology & Marketing Law Blog.

In short, California enacted the “Yelp Law” to restrict businesses from trying to stop their consumers from posting online reviews. The statute is divided into two main operative parts. (a)(1) targets TOS provisions that restrict consumer reviews. (a)(2) targets businesses’ efforts to enforce those TOS provisions. A small team of plaintiff lawyers have been cruising the Internet, looking for TOS provisions that they claim are consumer review restrictions, and then asserting (a)(1) violations for those TOS provisions hoping for payoffs. In these enforcements, no consumer has actually been stifled in their remarks (that would support an (a)(2) violation). Worse, the plaintiffs’ lawyers often fail to display basic reading comprehension because their claims target generic and standard TOS provisions that have nothing to do with consumer reviews.

[In this case, the offending TOS provisions said that consumers “agree not to submit content to the website “‘intended to cause commercial harm’” to Peet’s or to use Peet’s trademarks “‘in any manner … that would disparage’ Peet[’s] products or brands.” These are ill-advised TOS provisions that should be rewritten, but they are also clearly not meant to restrict consumers’ abilities to post reviews.]

The Moss decision rejected similar claims because the court concluded (a)(1) had no private right of action. However, that decision was non-precedential. Now, a week later, a different California Appeals Court panel reaches the same conclusion in a precedential opinion, Arterberry v. Peet’s. The end of the Yelp Law drive-by enforcements is getting closer.

The Arterberry opinion summarizes its question and answer:

May a consumer seek monetary penalties against a company for including a contractual provision made illegal under section 1670.8 as part of the terms and conditions on its website, even if the company never threatened to enforce that provision or take any action against the consumer? We hold section 1670.8 outlaws non-disparagement clauses in consumer contracts, but it unambiguously allows a consumer to bring a suit for monetary penalties only when a seller attempts to enforce such a provision or otherwise seeks to penalize a consumer.

The Arterberry opinion itself doesn’t mention the Moss opinion (which was non-precedential, and the opinions were likely drafted in parallel with each other), and the Arterberry opinion claims it is addressing a matter of “first impression” (with acknowledgements of the Shofet and Anderson federal district court opinions, neither of which bind the court, but no acknowledgement of Moss). Despite the parallel rulings, Arterberry follows the same basic logic as the Moss opinion.

The Arterberry opinion engages in a little more depth with the legislative history. The court concludes:

Section 1670.8 applies to everyone, be it a Fortune 500 company or a small family business. If, as the plaintiffs allege, the use of a nondisparagement clause created a cause of action with respect to each California resident who visited a website, with a civil penalty of up to $2,500 for each such resident, then a relatively small business with 10,000 online California customers would face up to $25,000,000 in penalties for using insufficiently precise content moderation and trademark enforcement language in the terms and conditions of its website. The same business would face no more than $5,000 in penalties for actually threatening or seeking to penalize a consumer for posting a negative review. In the more than 400 pages of legislative history that the plaintiffs submitted for our review, we see nothing to suggest the Legislature intended the statute to work this way.

(To be fair, a $5k financial deterrent against suppressing consumer reviews may be too light, just as a $25M penalty for poor TOS drafting would be way too heavy. But the Yelp Law doesn’t rely solely on a private right of action; the AG’s office can enforce it too).

As I mentioned in my prior post, the mere presence of anti-consumer review clauses in TOSes could potentially chill consumers from posting reviews, even if the business never affirmatively asserts that clause. Other laws may redress that concern. And either way, the current batch of (a)(1) enforcements are not the right solution.

I wonder if the unsuccessful plaintiffs’ lawyers will ask the legislature to “fix” the statutory drafting, claiming that the courts have left consumers vulnerable to businesses’ anti-review efforts. It’s the kind of story that some legislators would be sympathetic to–if they don’t do their homework about the abuses already taking place. Even without a legitimate private right of action, plaintiffs’ lawyers have used (a)(1) to cause chaos in court and extract undeserved concessions. We need less of that, not more.

Case Citation: Arterberry v. Peet’s Coffee, Inc., 2026 WL 2185136 (Cal. App. Ct. July 29, 2026)

BONUS: A Pennsylvania court dismissed a class action lawsuit against Ikea based on the Arterberry precedent. Hinton v. Ikea North American Services LLC, 2026 WL 2984984 (Table) (Pa. Superior Ct. Oct. 5, 2026)

Selected Blog Posts Regarding 1670.8

• Appeals Court Shuts Down Bogus Private Enforcements of the ‘Yelp Law’–Moss v. GoDaddy
• Catching Up on the Bogus “Yelp Law” Litigation Campaign–Tao v. Uniqlo
• Amazon Must Defend “Yelp Law” Claim–Ramos v. Amazon
• Courts Are Rejecting Attempts to Weaponize Laws That Protect Consumer Reviews
• Businesses Cannot Contractually Ban “Abusive” Consumer Reviews
• California Tells Businesses: Stop Trying To Ban Consumer Reviews (Forbes Cross-Post)

The post Another Court Shuts the Door on “Yelp Law” Drive-By Lawsuits–Arterberry v. Peet’s appeared first on Technology & Marketing Law Blog.

Created by ChatGPT May 2026

In a prior post, I surveyed the rates at which consumers do not complete online age authentication processes, what I call the “balk” rate. There is no single canonical balk rate. It varies by destination behind the authentication wall, the method of authentication, demographics, and many other factors.

In my prior post, I mentioned a study from a mostly Carnegie Mellon team. I had seen a summary of the study, but the full study has now been posted. It’s worth digging into the details a little deeper.

Balk Rates by Modality

In the context of trying to complete the academic study, this chart summarizes the study participants’ balk rates by authentication modality:

Note 1: “checkbox” is self-attestation. That’s not credibly considered “authentication.”

Note 2: the email option said the process “analyzes the email’s registration source, associated employer information, and linked financial activities such as mortgages, credit cards, educational records, and consumer behavior patterns.” Though data mining sounds scary, the actual mechanics were vague and required no further effort from the consumer. This rarely will be a realistic option.

If we remove the self-attestation and the incompletely described email review options, consumers balk rates were a minimum of 48%. Study participants were trying to participate in an academic study, not complete a mission-critical life task, but if actual balk rates come anywhere close to 48%, it will completely upend the current Internet.

Efficacy of Balk Rates

The researchers also asked study participants to assess the likely efficacy of the various authentication methods. As you can see, consumers do not regard any of the techniques as particularly effective:

One participant quipped: “Chat gpt provide me an over 18 CA drivers license.”

As a bonus, the researchers said that only 0.86% of the study participants checked the study’s privacy policy. ¯\_(ツ)_/¯

Blog Posts on Segregate-and-Suppress Obligations

• Fifth Circuit Keeps Doing Fifth Circuit Things –SEAT v. Paxton
• How Often Do Consumers Balk at Doing Online Age Authentication?
• Court Enjoins Another Arkansas Segregate-and-Suppress Law–NetChoice v. Griffin
• Too Many Courts Are Letting States Take Wrecking Balls to the Internet (Roundup)
• Texas Judge Enjoins App Store Authentication Law–CCIA and SEAT v. Paxton
• Courts Enjoin Internet Censorship Laws in Louisana and Arkansas
• Challenge to Maryland’s “Kid Code” Survives Motion to Dismiss–NetChoice v. Brown
• My Testimony Against Mandatory Online Age Authentication
• Read the Published Version of My Paper Against Mandatory Online Age Authentication
• Prof. Goldman’s Statement on the Supreme Court’s Demolition of the Internet in Free Speech Coalition v. Paxton
• Court Permanently Enjoins Ohio’s Segregate-and-Suppress/Parental Consent Law–NetChoice v. Yost
• Arkansas’ Social Media Safety Act Permanently Enjoined—NetChoice v. Griffin
• Why I Emphatically Oppose Online Age Verification Mandates
• California’s Age-Appropriate Design Code (AADC) Is Completely Unconstitutional (Multiple Ways)–NetChoice v. Bonta
• Another Conflict Between Privacy Laws and Age Authentication–Murphy v. Confirm ID
• Recapping Three Social Media Addiction Opinions from Fall (Catch-Up Post)
• District Court Blocks More of Texas’ Segregate-and-Suppress Law (HB 18)–SEAT v. Paxton
• Comments on the Free Speech Coalition v. Paxton SCOTUS Oral Arguments on Mandatory Online Age “Verification”
• California’s “Protecting Our Kids from Social Media Addiction Act” Is Partially Unconstitutional…But Other Parts Are Green-Lighted–NetChoice v. Bonta
• Section 230 Defeats Underage User’s Lawsuit Against Grindr–Doll v. Pelphrey
• Five Decisions Illustrate How Section 230 Is Fading Fast
• Internet Law Professors Submit a SCOTUS Amicus Brief on Online Age Authentication–Free Speech Coalition v. Paxton
• Court Enjoins the Utah “Minor Protection in Social Media Act”–NetChoice v. Reyes
• Another Texas Online Censorship Law Partially Enjoined–CCIA v. Paxton
• When It Comes to Section 230, the Ninth Circuit is a Chaos Agent–Estate of Bride v. YOLO
• Court Dismisses School Districts’ Lawsuits Over Social Media “Addiction”–In re Social Media Cases
• Ninth Circuit Strikes Down Key Part of the CA Age-Appropriate Design Code (the Rest is TBD)–NetChoice v. Bonta
• Mississippi’s Age-Authentication Law Declared Unconstitutional–NetChoice v. Fitch
• Indiana’s Anti-Online Porn Law “Is Not Close” to Constitutional–Free Speech Coalition v. Rokita
• Fifth Circuit Once Again Disregards Supreme Court Precedent and Mangles Section 230–Free Speech Coalition v. Paxton
• Snapchat Isn’t Liable for Offline Sexual Abuse–VV v. Meta
• 2023 Quick Links: Censorship
• Court Enjoins Ohio’s Law Requiring Parental Approval for Children’s Social Media Accounts–NetChoice v. Yost
• Many Fifth Circuit Judges Hope to Eviscerate Section 230–Doe v. Snap
• Louisiana’s Age Authentication Mandate Avoids Constitutional Scrutiny Using a Legislative Drafting Trick–Free Speech Coalition v. LeBlanc
• Section 230 Once Again Applies to Claims Over Offline Sexual Abuse–Doe v. Grindr
• Comments on the Ruling Declaring California’s Age-Appropriate Design Code (AADC) Unconstitutional–NetChoice v. Bonta
• Two Separate Courts Reiterate That Online Age Authentication Mandates Are Unconstitutional
• Minnesota’s Attempt to Copy California’s Constitutionally Defective Age Appropriate Design Code is an Utter Fail (Guest Blog Post)
• Do Mandatory Age Verification Laws Conflict with Biometric Privacy Laws?–Kuklinski v. Binance
• Why I Think California’s Age-Appropriate Design Code (AADC) Is Unconstitutional
• An Interview Regarding AB 2273/the California Age-Appropriate Design Code (AADC)
• Op-Ed: The Plan to Blow Up the Internet, Ostensibly to Protect Kids Online (Regarding AB 2273)
• A Short Explainer of Why California’s Social Media Addiction Bill (AB 2408) Is Terrible
• A Short Explainer of How California’s Age-Appropriate Design Code Bill (AB2273) Would Break the Internet
• Is the California Legislature Addicted to Performative Election-Year Stunts That Threaten the Internet? (Comments on AB2408)
• Omegle Denied Section 230 Dismissal–AM v. Omegle
• Snapchat Isn’t Liable for a Teacher’s Sexual Predation–Doe v. Snap
• Will California Eliminate Anonymous Web Browsing? (Comments on CA AB 2273, The Age-Appropriate Design Code Act)
• Minnesota Wants to Ban Under-18s From User-Generated Content Services
• California’s Latest Effort To Keep Some Ads From Reaching Kids Is Misguided And Unconstitutional (Forbes Cross-Post)
• Backpage Gets Important 47 USC 230 Win Against Washington Law Trying to Combat Online Prostitution Ads (Forbes Cross-Post & More)
• Backpage Gets TRO Against Washington Law Attempting to Bypass Section 230–Backpage v. McKenna
• MySpace Wins Another 47 USC 230 Case Over Sexual Assaults of Users–Doe II v. MySpace
• MySpace Gets 230 Win in Fifth Circuit–Doe v. MySpace
• Website Isn’t Liable When Users Lie About Their Ages–Doe v. SexSearch

The post More Data on Online Age Authentication Balk Rates appeared first on Technology & Marketing Law Blog.

Apple’s manuevers confused the public and seemed like an embarrassing unforced error for Apple. It also ensured pressure from governments and plaintiffs, including CSAM victims, who preferred Apple’s more interventionist approaches, which Apple had voluntarily demonstrated it was willing to do.

This lawsuit represents a full-scale attack on Apple and Section 230. “Plaintiffs allege that Apple’s failure to implement any known CSAM detection is a design defect because Apple can safely implement readily available features to prevent the spread of known CSAM but has continuously failed to do so.” Prior blog post. The court dismisses the third amended complaint, which tees this case up for the Ninth Circuit, where (as usual) anything could happen.

* * *

The court reiterates that Section 230 applies to the plaintiffs’ claims:

First, Plaintiffs’ claims treat Apple as a publisher or speaker of the CSAM content that animates Plaintiffs’ injuries. Fundamentally, Plaintiffs contend that Apple has elected to permit users to disseminate and share third-party CSAM content when it could have—and, in their view, should have—used readily available technology to prevent the distribution of child pornography depicting the Plaintiffs in this putative class. The duties Plaintiffs seek to invoke “spring[ ] from the defendant’s status as publisher,” and consequently, “immunity applies.” Second, immunity also applies because “the means to avoid liability requires [Apple] to act as a publisher.” As a result, Apple is entitled to complete immunity under § 230.

Citing Doe 1 v. Meta, the court says:

Plaintiffs’ injuries are the direct result of the actions of third parties who used iCloud to share CSAM, a use Apple neither explicitly condones nor prevents (even assuming—as alleged in the TAC—that Apple was aware of the use of iCloud for this purpose)….though Plaintiffs allege that Apple knew that its tools were likely to be used to distribute child pornography (as confirmed by the internal Apple text messages at the center of this case), under the current state of the law, Apple is still entitled to immunity under § 230—irrespective of that general knowledge….

Plaintiffs cannot avoid the fact that a tool that detects CSAM must review CSAM to make such a determination. And while Apple could have taken steps to do so—as its competitors have done by using PhotoDNA—Grindr confirms that § 230 bars claims arising from the design decisions Apple could have taken where those claims relate to Apple’s role facilitating the communication and content of others

(A reminder that the defendant’s scienter is irrelevant to Section 230).

The plaintiffs tried to fit into the new Section 230 exceptions created in Doe v. Twitter, but the court rebuffs the move:

This case does not concern or even discuss Apple’s content reporting systems; it concerns Apple’s “failure to implement industry-standard safeguards” against the dissemination of CSAM. Though reporting systems and CSAM safeguards may both be described as “defects,” the latter requires the Court to treat Apple as a publisher. Twitter “could fulfill its purported duty to cure reporting infrastructure deficiencies without monitoring, removing, or in any way engaging with third-party content”; Apple cannot fulfill a duty to institute CSAM safeguards without deploying a tool like NeuralHash or PhotoDNA. Both NeuralHash and PhotoDNA were built to monitor and report violative images uploaded to company servers. Yet just the decision regarding whether to deploy either tool is a choice related to content moderation.

Also, Apple didn’t fail to satisfy any duty to report items to NCMEC if it never identified CSAM in the first place.

The Lemmon v. Snap workaround fails: “all of Plaintiffs’ claims here are inexorably linked to third-party content; Plaintiffs do not allege that Apple created content like a Snapchat filter that caused them harm.” The Roommates.com workaround also fails: “Plaintiffs do not allege that Apple modified or augmented the CSAM on its servers in any way.”

* * *

The case reaches its inevitable denouement of a win for Apple. However, Judge Wise remains troubled about its implications. She expresses her uneasiness in stronger-than-normal terms:

As it stands, nothing in the law prevents any company, including Apple, from utilizing available technology or creating new technology to identify and report child pornography stored and distributed on their traditional servers or through their cloud services. Conversely, there is no law that obligates companies to proactively do so. Undoubtedly any such legislation would come at a cost of at least some loss of privacy for millions of people. But if lawmakers expected that companies would take steps to prevent their products from being used for storing and distributing child pornography based on something short of a legal imperative, this case, like many others before it, demonstrates the inadequacy of that approach. If lawmakers want to ensure that Apple and other companies address their role in the dissemination of CSAM, they must require it under the law. In other words, lawmakers can fix this problem that is contributing to the exploitation of children.

She goes through this framing pretty quickly, but we should slow it down. The “loss of privacy for millions of people” she briefly references deserves a little more care. The opinion downplays the encryption angle; it mentions encryption only twice, as if it’s an afterthought. However, encryption is the critical attribute underlying Apple’s moves. Apple was seeking to respect that what’s on people’s hard drives should remain their business, even if they choose to store some of it in the cloud. Forcing Apple to scan private files intended for iCloud storage creates a new and dangerous threat vector for bad actors, including governments seeking to control constituent behavior.

So yes, the “privacy loss” Judge Wise mentions indeed would be a major cost to everyone. Respecting the privacy of people’s files isn’t just some nice-to-have feature; it is one of the core planks of a technology architecture that keeps people safer.

Judge Wise continues:

This Order does not turn on whether Apple’s decisions contributed to Plaintiffs’ injuries. All Plaintiffs’ claims are founded on Apple serving as a publisher of third-party content. It is that role as “publisher” that is dispositive on the issue of immunity. This does not mean that the existence of images and videos of the putative class members being sexually abused—content that they allege is regularly stored and disseminated on iCloud—has not caused Plaintiffs real and lasting harm…

the outcome also adds credence to claims that the Ninth Circuit “has expanded § 230(c)’s scope to provide functional immunity to internet companies, even when they are aware (or should be aware) of unlawful content on their websites.” The practical outcome is that the current state of the law prioritizes privacy—a laudable and critically important value given that in our modern world nearly all our most personal and intimate data (including financial and health records) are stored and transmitted online. But the law should not ignore how those who create, view, and distribute child pornography leverage privacy protections to avoid detection by law enforcement. In the current legal framework, there is no protection for members of the putative class—individuals who as children were photographed and filmed while being abused in the vilest ways imaginable, and who now are repeatedly victimized each time the intimate and tortured images of their trauma are distributed to others. Those children are the collateral damage of our ineffective legal landscape. They deserve better.

Judge Wise isn’t well-situated to compare the relative strengths and limitations of the full range of potential anti-CSAM options, but a leading tool has always been and remains the government’s efforts to find and prosecute the creators, disseminators, and downloaders of CSAM. (Do you recall the federal government’s choices that leave children more vulnerable?) Making sure the government is doing what it can should be the #1 priority.

Case Citation: Amy v. Apple Inc., 2026 WL 2031817 (N.D. Cal. July 13, 2026). The complaint.

The post Apple Defeats Liability for Not Scanning iCloud Items for CSAM, But the Judge Was Not Pleased–Amy v. Apple appeared first on Technology & Marketing Law Blog.

Coomer v. Lindell, 2026 WL 817370 (D. Colo. March 25, 2026)

Related post. This is more fallout from the efforts to deny the 2020 presidential election results. MyPillows huckster Lindell publicly trashed Dominion Voting and and its president, Coomer. A jury held Lindell and Frankspeech liable for defamation and more. The defendants unsuccessfully tried to overturn the jury verdict post-trial.

Frankspeech invoked Section 230 for its liability for Lindell’s speech. The court disagrees:

Mr. Lindell founded Frankspeech. He regularly acted as its corporate representative, including at trial. He hosted his own show on Frankspeech, broadcasted it through Frankspeech, and used the Frankspeech platform to make and publish statements about Dr. Coomer. There is no evidence that anyone other than Mr. Lindell exercised any meaningful degree of control over the Frankspeech entity. By all accounts, Frankspeech was Mr. Lindell’s corporate alter ego in this context….for § 230 purposes, Frankspeech’s defamatory statements through its agent would plainly qualify as participation in the development of those statements.

Frankspeech also claimed Section 230 for Clement’s remarks at a conference. The court responds: “Frankspeech—through Mr. Lindell and others—sponsored, promoted, and broadcasted the event….a reasonable jury could conclude that Frankspeech’s conduct (including its conduct through Mr. Lindell) created actual or apparent authority for Mr. Clements and other presenters at the Cyber Symposium to act as agents of Frankspeech.”

Murphy v. LinkedIn Corp., 2026 WL 881710 (N.D. Cal. March 30, 2026)

Fraudsters approached Murphy via LinkedIn direct messages. The conversation switched over to WhatsApp, where the fraudsters effectuated their fraud. Murphy’s lawsuit against LinkedIn fails due to Section 230:

Plaintiffs’ claims for negligence, gross negligence, and product liability are premised on a purported duty to “monitor” users, “restrict the accounts of fraudulent actors,” and to suppress “fraudulent activities” by users of LinkedIn’s platform. These claims “necessarily implicate” LinkedIn’s role as a publisher of third-party content because “discharging the alleged duty would require [LinkedIn] to monitor third-party content and prevent” communications between fraudsters and legitimate LinkedIn users. Nor can Plaintiffs sue LinkedIn for breaching a “duty to warn.” LinkedIn’s “role as a publisher of third-party content does not give it a duty to warn users of ‘a general possibility of harm’ resulting from” using LinkedIn’s services.

The plaintiffs unsuccessfully tried the defective design workaround:

Plaintiffs argue that their claims are not based on LinkedIn’s role as publisher, but rather its role “as a product manufacturer and developer of defective algorithms” that facilitated communications between fraudsters and Plaintiffs. But the Ninth Circuit has repeatedly upheld dismissal of negligence and product liability claims framed in the same way. [cites to Doe v. Grindr and Dyroff]

A Roommates.com workaround didn’t work either:

Plaintiffs’ claims are premised on LinkedIn’s neutral tools for connecting users, not on content that LinkedIn created or required users to provide as a condition of using its services. Indeed, LinkedIn expressly informs users that they “have choices about the information” on their profiles, and that users “don’t have to post or upload personal data” that may make them targets of fraud.

To put a finer point on it, if the plaintiffs are complaining about LinkedIn direct messages, then those messages may be covered by the ECPA just like email, and LinkedIn may have had limited legal rights to monitor the conversations at all.

Finally, the plaintiffs tried a TOS-based workaround, poured into consumer protection laws. The court acknowledges that some breach of contract claims may not be preempted by Section 230, but

These claims are premised on the same duties discussed above – duties to monitor, to design products in a different manner, and to warn – that fundamentally seek to hold LinkedIn liable for content created by the fraudsters. Styling these claims as different legal theories does not remove them from Section 230’s scope….

Plaintiffs seek to hold LinkedIn liable solely based on its general monitoring policy and aspirations to remove fraudulent users from its platform. Moreover, LinkedIn expressly disclaims liability by notifying users that they “may encounter content or information that might be inaccurate, incomplete, delayed, misleading, illegal, offensive, or otherwise harmful,” and that LinkedIn “generally does not review content provided by [its] Members or others.”

McNeal v. Calvin, 2026 WL 879228 (E.D. Mo. March 31, 2026)

This case relates to the TV show Love & Marriage: Huntsville, shown on OWN (Oprah’s channel). The plaintiff, a lawyer (naturally), is one of the women featured in the show. She is upset about online comments about the show and sued many defendants pro se. The court says “Section 230 of the Communication Decency Act bars Plaintiff’s claims against YouTube, Google, and Tik Tok.” In particular, “The content uploaded by users cannot be attributed to internet service providers based on the theory that users are “agents” of the websites they use.”

Shiva Ayyadurai v. U.S., 2026 WL 879409 (D.C.D.C. March 31, 2026). My prior blog post about a different litigation of his.

This is a jawboning case:

Ayyadurai’s 75-page Complaint alleges that various Massachusetts state officials—none of whom are named as Defendants in this case—federal officials at the Cybersecurity Infrastructure Security Agency (“CISA”), and other government officials unknown to him have coordinated with private companies to regulate and censor his speech by “deplatforming” or “shadowbanning” him—that is, suspending his social media accounts or limiting the reach of his posts. Ayyadurai alleges that the Defendants took these actions in retaliation for posts in which he “articulat[ed] a government employee’s role in destroying the digital ballot images used to tabulate votes” in a prior election.

With respect to the liability of the social media defendants who allegedly got jawboned, the court accepts the 230(c)(2)(A) defense:

Ayyadurai’s Complaint fails to state a claim against the Social Media Defendants based on their content-moderation decisions because he does not plausibly allege that any of those decisions were made in the absence of “good faith” or that they were made for a purpose other than removing content that they “consider[ ] to be … objectionable.”…

conclusory allegations of bad faith are insufficient to state a claim against a platform based on activity within the reach of Section 230(c)(2).

At the same time, the court struggled with applying to Section 230(c)(1) to the removal decisions. Incredibly, it says:

only a few of the decisions restating this broad dictum [from Zeran] have grappled with its implications when the challenged conduct is a platform’s decision to remove objectionable content—such as a plaintiff’s own posts—rather than a decision to leave other objectionable content in place. Extending immunity under Section 230(c)(1) to cover direct challenges to the removal of user content is an uneasy fit with the language of the provision, which says only that “[n]o provider or user of an interactive computer service shall be treated as the publisher or speaker of any information provided by another information content provider.” A broad reading of Section 230(c)(1) that immunizes all content-removal decisions also risks “swallo[wing] the more specific immunity in (c)(2),” which applies only to content-moderation decisions that are made in “good faith.”

Not this shit again. I have repeatedly explained how Section 230(c)(2) can apply to first-party filtering decisions, which leaves room for Section 230(c)(1) to protect against liability for third-party content. There are DOZENS of cases applying Section 230(c)(1) to removal decisions, so for the court to think that it’s spotted something that all of those other courts have missed is laughable…and completely gratuitous…and ultimately inconsequential given that the court still tosses the case.

The court tries to justify its reluctance on Section 230(c)(1):

There is little reason to strain the reach of the immunity in Section 230(c)(1) when, as in this case, the immunity in Section 230(c)(2) leads to the same result.

NOOOO. There are several excellent reasons to apply both 230(c)(1) and 230(c)(2):

(1) 230(c)(1) doesn’t have a good faith prerequisite, which has mucked up 230(c)(2) jurisprudence and made 12(b)(6) dismissals much more difficult to obtain, jacking up the litigation costs for both sides and giving false hope to bogus claims. Indeed, because the court dismissed this case without prejudice, I’m sure an amended complaint will try again to manufacture bad faith sufficient to kick the case into very expensive discovery;

(2) removal and leave-up decisions are two sides of the same decision, i.e., every editorial decision about an item of third-party content is either a leave-up or removal decision, so they cannot be separated; and

(3) the statute and 25+ years of caselaw have established the principle that 230(c)(1) applies to removal decisions.

Sigh. In the end, this case ends up the same as all of the other content removal and account termination cases–dismissed.

Gaughan v. Barounis, 2025 N.Y. Misc. LEXIS 17243 (N.Y. Supreme Ct. December 18, 2025) 

The Complaint alleges that the impersonating profile and pictures of plaintiff were posted by defendants Barounis and Viera. Plaintiff’s contention that the XVideo defendants are liable for refusing or failing to remove offending material prepared by a third party, or that they may be held responsible for allegedly defamatory postings made by third parties does not state a viable basis for liability. Nowhere in the Complaint does plaintiff allege that the XVideo defendants posted or created the impersonating profile themselves, altered or edited its contents, or encouraged, required, or otherwise induced defendants Barounis and/or Viera, or any other user, to create the profile or upload unlawful content. To the contrary, plaintiff even alleges in her Complaint that Barounis and Viera allegedly making this impersonating profile goes against XVideo.com’s Terms and Agreements.

The Court also finds plaintiff’s argument that the XVideo defendants should be responsible for her alleged stolen identity, and that Section 230 does not apply in cases, unavailing.

It has also been held that “Sections 50 and 51 of the New York Civil Right Law sounds in privacy, not intellectual property, and thus does not fall within the intellectual property exceptions in Section 230.”

Equally, plaintiff’s contention that this immunity is lost because the XVideo defendants allowed the dissemination of plaintiff’s personal information and allowed discriminatory content (age, sex, sexual orientation, ethnicity, etc.) is unsuccessful.

Arana v. Molta, 2026 WL 1166348 (D. Mass. March 24, 2026)

Mr. Molta drafted the description of, and provided the photos for, the Dennis Property posted to WNAV’s website. WNAV did not review, revise, edit, or provide feedback on the Dennis Property listing that the Moltas posted to the WNAV website. WNAV is thus immune from liability for any of the statements or representations made by the Moltas in the Dennis Property listing.

Greer v. Moon, 2026 WL 1170015 (D. Utah. Feb. 11, 2026)

Mr. Greer’s only claims against Defendants are for contributory copyright infringement under federal law. Because those claims clearly “pertain[ ] to intellectual property,” they cannot be barred by section 230. Defendants’ argument concerning section 230 immunity fails.

Tufano v. Google LLC, 2026 U.S. Dist. LEXIS 100789 (N.D. Cal. May 6, 2026)

“Plaintiff premises his claims on Google allegedly “filter[ing] out all negative reviews” of Dr. Taban, including Plaintiff’s negative review, which Google allegedly removed.” The court dismisses per Section 230: “First, Google’s review service is an interactive computer service. Second, Google publishes the reviews on which Plaintiff bases his claims. Third, third parties, and not Google itself, provide the reviews published by Google.” The plaintiff said Google didn’t act in good faith, but Google relied on 230(c)(1) where good faith is irrelevant, and the plaintiff didn’t provide any evidence of bad faith.

Starship LLC v. Shein Distribution Co., 2026 WL 1455009 (C.D. Cal. March 20, 2026)

This is a fast fashion enforcement lawsuit that includes both copyright and trademark claims. The direct infringement claims largely fail because Shein operates as a marketplace for online vendors. The contributory infringement claims failed because the plaintiff wanted a staydown in response to takedown notices. The vicarious infringement claims also fail.

Shein defended against the unfair competition claim based on Section 230. The court says:

Plaintiff characterizes Shein as an information content provider because it “regularly markets and sells goods” and “is involved in almost all aspects of the marketplace’s distribution chain.” These conclusory assertions do not plausibly allege that Defendants are content providers. Plaintiff provides no factual basis to infer that Defendants materially contributed to the alleged infringement.

King v. Jilin Province Detiannuo Safety Tech. Co. Ltd., 2026 Fla. Cir. LEXIS 295 (Fla. Cir. Ct. Feb. 17, 2026)

Plaintiff does not allege that eBay participated in the creation or development of Seller’s listing or allege that eBay played some role in handling or transmitting the airbag components. Plaintiff only alleges that eBay should have removed Seller’s listing and/or issued some censure to Seller for its alleged noncompliant listing….

The only way eBay allegedly could have prevented the harm was by reviewing the third-party listing, determining whether it complied with internal policies, and removing it. That conduct, i.e., deciding whether to publish or remove third-party content, is a paradigmatic editorial function protected by the CDA.

In re Apple Inc. App Store Simulated Casino-Style Games Litigation, 2026 WL 1552391 (N.D. Cal. June 1, 2026)

The Court finds Defendants’ argument that Section 230 provides immunity from suit unavailing. Defendants point to the clause in Section 230 that states that “no cause of action may be brought” that is contrary to the statute. 47 U.S.C. § 230(e)(3). But the Tenth Circuit has held that Section 230 “provides immunity only from liability, not suit.” And the Ninth Circuit case Defendants themselves cite clearly states that Section 230 is designed “to protect websites against the evil of liability for failure to remove offensive content”; that case does not mention protection from suit. Thus, the Court concludes that Section 230 does not protect Defendants from suit.

Accardi v. CSC Holdings, LLC, 2024 N.Y. Misc. LEXIS 83186 (N.Y. Supreme Ct. November 26, 2024)

The plaintiffs claim that defendants failing to follow their terms of service makes them liable to the plaintiffs, effectively negating the immunity provided by the Communications Decency Act. After a review of the papers submitted by the defendants and the plaintiffs, the Court finds that the immunity provided by Section 230 does apply to the defendants in this action and the plaintiffs have not proffered any compelling argument or evidence to negate this immunity. As such, the defendants motion to dismiss the third cause of action pertaining to the failure to remove posts on social media is granted.

Life Mastery Network LLC v. Haygarth, 2026 WL 1622887 (D. Haw. May 22, 2026)

Paula indisputably enjoys immunity under the CDA for reposting content. Many courts have included private individuals within the scope of a “user.” Thus, (1) Paula is a “user of an interactive computer service”; (2) the subreddit link is “based on information provided by another information content provider”; and (3) Plaintiffs’ claim would treat Paula “as the publisher or speaker of that information.” As such, and as Plaintiffs have conceded at the Hearing, Paula is immune from lawsuit for what she reposted from Reddit.

But because the CDA does not immunize someone who posts original content, it makes sense that adding comments to something that is re-posted would not trigger CDA immunity. While these cited cases are not directly on point, the Court concludes that Paula’s comments regarding what she reposted are not subject to CDA immunity.

Glazer v. Meta Platforms, Inc., 1:25-cv-01849-GLR (D. Md. June 12, 2026)

The Court agrees with Meta that Section 230 bars Plaintiffs’ claims….All three elements are satisfied here: Meta is an interactive services provider; Plaintiffs’ claims treat Meta as the publisher or speaker of information under Section 230 because they “seek ‘to hold [Meta] liable for . . . deciding whether to publish, withdraw, postpone or alter content’ provided by third parties”; and the content at issue here is that of third parties, and Plaintiffs “seek[] to hold Meta liable, not for providing that content, but for allowing third parties to do so.”

Related ruling.

Sidoli v. YouTube LLC. 2025 U.S. Dist. LEXIS 210953 (N.D. Cal. Sept. 2, 2025)

Plaintiff also seeks to treat YouTube as a publisher because she alleges that YouTube wrongfully demonetized, restricted, and removed her videos. Such conduct falls within a publisher’s traditional functions….

YouTube cited authority that which stand for the proposition that Section 230 immunizes internet service providers from suit for termination of a plaintiff’s entire channel as well as the content that the plaintiff posts on that channel. Such authority is persuasive. Thus, any claim Plaintiff brings which seeks to challenge YouTube’s decision to remove Plaintiff’s YouTube channel is also barred by Section 230.

Also, “Plaintiff’s constitutional claims cannot proceed as YouTube is a private forum, not a state actor.”

See also Sidoli v. YouTube LLC, 2026 WL 1480407 (S.D.N.Y. May 27, 2026), upholding YouTube’s TOS and forum selection clause: “Defendants provide evidence, which Plaintiff does not dispute, showing that she agreed to abide by the terms of service by clicking the “Create Channel” button when she started her YouTube page on June 21, 2021.”

Kennedy v. Vickery, 2025 Me. Super. LEXIS 108 (Me. Superior Ct. Sept. 10, 2025)

RFK Jr. lost a defamation lawsuit. As for Section 230:

Defendant posted on X, without comment, a link to an article, authored by thegrio.com, titled “Anti-vaxxer Robert F. Kennedy Jr. is harming black people—and his family legacy—with his vaccine misinformation campaign.”…

Under the Communications Decency Act, internet service users are not liable for repeating, without embellishment, third party content….

Exhibit A to the Amended Complaint supports Defendant’s assertion that he posted the third-party content without embellishment. Plaintiff denies Defendant posted the link without embellishment, but cites no admissible record evidence to support the denial. Thus, under the Communications Decency Act, Defendant is not liable to Plaintiff for this post.

Awoye v. Jones, 2026 WL 1847088 (D.N.J. June 26, 2026)

In Instagram posts, Jones claims that Awoye scammed her. Awoye sued her and brought Meta along for the ride, claiming it had violated his publicity rights. There isn’t any publicity rights violation here:

The core of Plaintiff’s allegations is that Jones spread allegedly false information about Plaintiff on Instagram. Jones was not selling a product or otherwise soliciting money from her followers. As such, neither was Instagram. Jones’ posts were the “dissemination of news or information” and not made for a commercial purpose.”

Norton v. Meta Platform, Inc., 2026 WL 1963120 (N.D. Cal. July 7, 2026)

In posts on Facebook, several third parties accused Norton of criminal activity and shared intimate images of him….

“Meta is an interactive computer service provider.” Second, Norton alleges that third parties, not Meta, created the Facebook posts at issue; the third parties, not Meta, are the “information content provider[s].” Third, each of Norton’s claims seek to treat Meta as a “publisher” of third-party content. “A claim that obliges the defendant to monitor thirdparty content to avoid liability … treats the defendant as a publisher.”

Norton argued “but the algorithms.” Citing Ligon, the court says the algorithms matter only if the algorithm creates content. Citing Roommates.com, the court adds: “Norton doesn’t allege that Meta required its third-party users to create or post any of the content at issue.”

Moore v. LogSat Software LLC, 2022 WL 23074273 (S.D. Ind. Sept. 29, 2022)

John Moore has never been accused of, arrested for, or convicted of any sex-related offense; yet, his name, picture, address, and other identifying information appear on LogSat Software LLC’s app, called “Sex Offenders Search”….

Mr. Moore was convicted in Indiana of voluntary manslaughter. Thus, he was required to register on a violent crime registry in Indiana. The violent offender and sex offender registries are the same in Indiana—in other words there are not two separate lists. Mr. Moore testified that he believed that there was no national violent offender registry, just a national sex offender registry and that he is on that because the Indiana Registry is reported to the National registry….

the alleged defamatory statement at issue is that Mr. Moore’s name, picture, address, and other identifying information appear on app called “Sex Offenders Search,” because he is not a sex offender and has never been accused of, arrested for, or convicted of any sex-related crimes. Mr. Moore does not allege that he was wrongfully included in the data set that LogSat purchased from FWD, or, for that matter, that he was wrongfully included on Indiana or the National registries.

The post Large Roundup of Section 230 Rulings appeared first on Technology & Marketing Law Blog.