Consumer Consent

LinkedIn’s own disclosures may be sufficient (see LB v. LinkedIn in my prior post), but its partners’ disclosures are not. Covered California’s disclosures expressly say “no personal information is sold or distributed,” and Nevada Health Link’s disclosures do not mention sharing data with third parties.

Furthermore, “Courts have often found a lack of consent when the type of data collected, though conceivably included in the disclosure, falls outside the plaintiffs’ reasonable expectations.” LinkedIn capturing consumers’  “medication and dosage” would be outside such expectaions. The complaint against Covered California was not specific enough about its data captures, but that can be fixed in an amended complaint.

LinkedIn’s Intent to Intercept

Johnson alleges that LinkedIn intentionally intercepted her and class members’ communications regarding their medical care through the Insight Tag, which Johnson alleges LinkedIn designed to collect all interactions with the Nevada Health Link website. Johnson also alleges that the issue of health information being shared via tracking technology is so well known in the technology industry that LinkedIn should have known its Insight Tag was likely collecting personal health information. Finally, Johnson alleges that LinkedIn monetized the intercepted personal health information in the form of targeted advertising, which is most of LinkedIn’s revenue. Though the inference of intent may be relatively weak in light of LinkedIn’s policies to the contrary and the absence of specific facts concerning how LinkedIn uses the data it allegedly receives from the Insight Tag, the Court finds these allegations sufficient to survive a motion to dismiss

So…the court says LinkedIn has sufficient “intent” to intercept sensitive consumer data even if its contract with customers restricted such efforts, because LinkedIn should have known data leakages would occur? That doesn’t sound like “intent” to me. See the Pharmatrak case from 2003…

LinkedIn argued that the Nevada Health Link is a government agency, so it should be entitled to the presumption of regularity, i.e., that it followed its own policies and the LinkedIn agreement. The court says that presumption, if it applies at all, is more of an evidentiary burden, not a legal matter that supports motions to dismiss. Plus, Johnson alleged a wrongful data collection of their data, regardless of the entities’ general policies.

Intrusion Upon Seclusion

LinkedIn fails to provide any support for its argument that the “amount” of information disclosed, the public availability of the website, or the optional nature of some forms are relevant to the degree of intrusion or otherwise cause the context, circumstances, and setting factors to tip in LinkedIn’s favor. For purposes of the motion to dismiss, the Court finds Johnson’s allegations that LinkedIn’s unauthorized interception of information regarding her medication and dosage was “highly offensive” conduct sufficient.

Based on my unscientific review of the Pixel cases, it seems like the lawsuits against healthcare entities frequently survive motions to dismiss. It will be an entirely different matter for plaintiffs to win the cases and defend those rulings on appeal.

Case Citation: Doe v. LinkedIn Corp., 2026 WL 2199526 (N.D. Cal. July 30, 2026)

More Posts on the Pixel Cases and Related Claims

• Third Circuit Rejects a Meta Pixels Case–Cole v. Quest Diagnostics
• The Wrap Taxonomy Vexes the Judge in the LinkedIn Insight Tag Cases
• The Second Circuit Is Done With Meta Pixels VPPA Cases–Hughes v. NFL
• Court Rejects Trespass to Chattels Claim Over Placing Cookies–Doe v. Tenet
• Clickwrap Formed Even When a Consumer Has Limited Time to Act–Washington v. Flixbus
• Meta Pixels Case Dismissed by Second Circuit–Solomon v. Triller
• Leaky TOS Formation = No TOS Formation–Snyder v. G6
• The VPPA May Be a Dinosaur Statute, But It’s Very Much Alive in the Second Circuit–Salazar v. NBA
• Pixel Case Against Google “Jumps the Shark”–Doe I v. Google (Catch Up Post)
• Think You Understand Online Trespass to Chattels Law? Think Again–In re Meta Healthcare Pixels
• More Chaos in the Law of Online Contract Formation
• Privacy Lawsuit Based on Website Tracking by Service Provider Trimmed

The post LinkedIn’s Insight Tag Creates Legal Entanglements–Doe v. LinkedIn appeared first on Technology & Marketing Law Blog.

Created by ChatGPT Dec. 2025

by guest blogger Kieran McCarthy

I recently described the district court’s decision in the case of Amazon v. Perplexity as “a shockingly poor effort to grapple with CFAA applicability to agentic AI technology.”

The Ninth Circuit appears to have agreed.

This week, the Ninth Circuit panel published its opinion vacating the district court’s preliminary injunction and remanding for further proceedings. Amazon.com Services, LLC v. Perplexity AI, Inc., 2026 WL 2237587 (9th Cir. Aug. 4, 2026).

The panel determined that Amazon was not entitled to a preliminary injunction because it was not likely to succeed on the merits of its CFAA claim. The court concluded that Perplexity did not “access” Amazon’s computers within the meaning of the CFAA, but rather it was the user who accessed Amazon’s computers. The panel also concluded that Amazon was equally unlikely to succeed on the merits of its CDAFA claim for the same reasons.

The panel also concluded that the remaining equitable factors favored Perplexity.

The Court kept its opinion narrow and specifically disclaimed the applicability of this opinion to other facts or other laws related to data access and agentic AI. But this was a nonetheless important step in distinguishing the infamous Power Ventures opinion, at least in the context of agentic AI.

—

I described the facts in detail in my prior write up of the district court’s decision, so I won’t rehash them here.

But unlike at the district court, the Ninth Circuit panel did not ignore the key factual pattern that makes this case so interesting. What’s unique and interesting about this case is that it involves a fundamentally new technology, in the form of Agentic AI, acting on the instructions of end users.

The panel wrote:

Agentic AI is an emerging technology. There is thus little to no existing caselaw directly dealing with how to ascribe responsibility for AI agents like the Assistant, let alone caselaw specifically dealing with agentic AI in the CFAA context. And CFAA cases dealing with more established technologies do not provide a perfect analogue to the case at hand.

Id. at 12.

The panel then went on to distinguish the facts of both Power Ventures and BrandTotal (both cases involving Facebook, ironically enough).

And the key distinguishing fact, according to the panel, was that on the facts presented to the Court, it was not Perplexity that was accessing Amazon’s computers, but rather the end users through their computers.

Under the CFAA’s plain language, Perplexity’s Comet Assistant itself cannot “access” Amazon’s servers.

According to the Court:

However advanced the Assistant currently is, it is a tool, not a person for statutory purposes. See 18 U.S.C. § 921(a)(1) (“The term . . . ‘whoever’ include[s] any individual, corporation, company, association, firm, partnership, society, or joint stock company.”); see also Whoever, Cambridge English Dictionary, [https://perma.cc/YY3TVTJF] (last visited July 16, 2026) (“[T]he person who” (emphasis added)).

Id. at 15.

Since it is the user using the Assistant tool, Perplexity’s not accessing Amazon’s servers in the first place. And the entire CFAA case unwinds after it reaches that conclusion.

The Court further reinforced its conclusion with the rule of lenity (which courts that enforce the CFAA always seem to forget). The Court was concerned that under Amazon’s theory of liability, end users could be exposed to criminal liability for using agents. Given the rapid adoption of this new technology, the Court was concerned about that approach.

But with just as much caution, the Court was equally quick to reiterate what the opinion was not.

We do not establish a new legal regime governing agentic AI. We do not address whether in other contexts, including tort claims, Perplexity can avoid liability for the Assistant’s actions. Our holding here is limited to “access” as contemplated by the CFAA and as applied to the Assistant’s interactions with Amazon.com on the record before us, not the broader landscape surrounding agentic AI.

Id. at 17.

—

The Court’s reasoning was largely identical in the context of the CDAFA, even though, as I noted in the prior district court opinion write up, the CDAFA is broader than the CFAA. Even though the CDAFA is broader, the “focus of the inquiry is still on the person accessing or causing the access.” Id. at 18. And since the panel concluded that it was not Perplexity that accessed Amazon’s servers, but rather end users through their own computers, that was that.

—

Once the panel determined that Amazon was unlikely to succeed on the merits, the district court’s thin and largely circular conclusions on the other equitable factors unraveled quickly.

In the end, the Ninth Circuit panel kept its opinion tight and focused on the primary issue in the case: whether Perplexity’s agentic AI tool was a “person” who accessed a site within the meaning of the CFAA. It is not, and the case has been remanded for further proceedings in light of that conclusion.

The case avoiding sweeping pronouncements and it was not the straight-up revocation of Power Ventures that some might have hoped for. Given the other legal issues presented, Perplexity might not be out of the woods just yet, but it’s fair to say that the Ninth Circuit vacated bad legal precedent and replaced it with a better one. And for that we can be thankful.

* * *

Eric’s Comments

In the copyright module of my Internet Law course, I ask students a simple question: is web browsing infringement and, if so, by whom? I use the Cablevision case to review the question. (In that case, the court held that for a DVR-as-a-service business, the users pressed the button to make the storage copies). The whodunit question blows students’ minds because it’s 2026 and they assume these issues have long been resolved. As this case shows, courts are still unsure who takes the legally significant actions online.

The ruling also brought to mind the Ticketmaster v. RMG case (the 2007 Hannah Montana case), which I still teach today. The facts in that case remain murky to this day, but I always interpreted RMG as handing off its software to its ticket broker customers, who then operated the software to snipe scarce event tickets, but with some ongoing facilitation from RMG (like relaying ticket purchase requests through a phalanx of RMG-associated IP addresses to reduce blockage). Ticketmaster successfully prevailed over RMG in that case on several legal theories, but does this court’s reasoning suggest that Ticketmaster’s redress should come solely from RMG’s customers, not RMG? Or does the RMG case suggest Amazon ought to win against Perplexity, just under other legal theories?

In support of that latter prospect, the opinion invites courts to more closely scrutinize exactly what the providers of agentic AI software do to facilitate their users’ activities. If they cross some undefined and currently invisible line, the software provider will transform into the legally relevant actor. That might harmonize this ruling with the RMG and Cablevision cases, but at the cost of inconsistent judicial outcomes and high defense costs.

As with other whodunit cases, if Perplexity is off the hook, where does that leave Perplexity’s users legally? Could Amazon assert CFAA/502 claims against users, or a range of other legal theories? In a footnote, the court says tersely: “This outcome does not impair Amazon’s ability to regulate access to Amazon.com via private terms of service for its users.”

The users’ legal exposure highlights some challenging policy fault lines of this case–and all online trespass to chattels cases. On the one hand, it would be a bad thing if websites more aggressively erect contract-based putative barriers to access. That creates a potential thicket for ordinary daily activities, and it raises greater risks that individuals will unintentionally trigger significant legal exposure if they don’t research and confirm their permission to visit every service they visit.

On the other hand, Amazon clearly expressed its preferences that it didn’t want Perplexity’s users to access its services through agentic AI, and why shouldn’t the law back up these strong and clear desires? We know that server operators need that prerogative to fend off hostile attacks, but we also know server operators will overclaim any legally backed prerogative they have.

As a result, as with most trespass-to-chattels cases, there are not likely to be any easy answers in this case. There are only significant and potentially problematic policy tradeoffs.

The post Ninth Circuit Lifts Restrictions on Agentic AI Accessing Amazon appeared first on Technology & Marketing Law Blog.

In short, California enacted the “Yelp Law” to restrict businesses from trying to stop their consumers from posting online reviews. The statute is divided into two main operative parts. (a)(1) targets TOS provisions that restrict consumer reviews. (a)(2) targets businesses’ efforts to enforce those TOS provisions. A small team of plaintiff lawyers have been cruising the Internet, looking for TOS provisions that they claim are consumer review restrictions, and then asserting (a)(1) violations for those TOS provisions hoping for payoffs. In these enforcements, no consumer has actually been stifled in their remarks (that would support an (a)(2) violation). Worse, the plaintiffs’ lawyers often fail to display basic reading comprehension because their claims target generic and standard TOS provisions that have nothing to do with consumer reviews.

[In this case, the offending TOS provisions said that consumers “agree not to submit content to the website “‘intended to cause commercial harm’” to Peet’s or to use Peet’s trademarks “‘in any manner … that would disparage’ Peet[’s] products or brands.” These are ill-advised TOS provisions that should be rewritten, but they are also clearly not meant to restrict consumers’ abilities to post reviews.]

The Moss decision rejected similar claims because the court concluded (a)(1) had no private right of action. However, that decision was non-precedential. Now, a week later, a different California Appeals Court panel reaches the same conclusion in a precedential opinion, Arterberry v. Peet’s. The end of the Yelp Law drive-by enforcements is getting closer.

The Arterberry opinion summarizes its question and answer:

May a consumer seek monetary penalties against a company for including a contractual provision made illegal under section 1670.8 as part of the terms and conditions on its website, even if the company never threatened to enforce that provision or take any action against the consumer? We hold section 1670.8 outlaws non-disparagement clauses in consumer contracts, but it unambiguously allows a consumer to bring a suit for monetary penalties only when a seller attempts to enforce such a provision or otherwise seeks to penalize a consumer.

The Arterberry opinion itself doesn’t mention the Moss opinion (which was non-precedential, and the opinions were likely drafted in parallel with each other), and the Arterberry opinion claims it is addressing a matter of “first impression” (with acknowledgements of the Shofet and Anderson federal district court opinions, neither of which bind the court, but no acknowledgement of Moss). Despite the parallel rulings, Arterberry follows the same basic logic as the Moss opinion.

The Arterberry opinion engages in a little more depth with the legislative history. The court concludes:

Section 1670.8 applies to everyone, be it a Fortune 500 company or a small family business. If, as the plaintiffs allege, the use of a nondisparagement clause created a cause of action with respect to each California resident who visited a website, with a civil penalty of up to $2,500 for each such resident, then a relatively small business with 10,000 online California customers would face up to $25,000,000 in penalties for using insufficiently precise content moderation and trademark enforcement language in the terms and conditions of its website. The same business would face no more than $5,000 in penalties for actually threatening or seeking to penalize a consumer for posting a negative review. In the more than 400 pages of legislative history that the plaintiffs submitted for our review, we see nothing to suggest the Legislature intended the statute to work this way.

(To be fair, a $5k financial deterrent against suppressing consumer reviews may be too light, just as a $25M penalty for poor TOS drafting would be way too heavy. But the Yelp Law doesn’t rely solely on a private right of action; the AG’s office can enforce it too).

As I mentioned in my prior post, the mere presence of anti-consumer review clauses in TOSes could potentially chill consumers from posting reviews, even if the business never affirmatively asserts that clause. Other laws may redress that concern. And either way, the current batch of (a)(1) enforcements are not the right solution.

I wonder if the unsuccessful plaintiffs’ lawyers will ask the legislature to “fix” the statutory drafting, claiming that the courts have left consumers vulnerable to businesses’ anti-review efforts. It’s the kind of story that some legislators would be sympathetic to–if they don’t do their homework about the abuses already taking place. Even without a legitimate private right of action, plaintiffs’ lawyers have used (a)(1) to cause chaos in court and extract undeserved concessions. We need less of that, not more.

Case Citation: Arterberry v. Peet’s Coffee, Inc., 2026 WL 2185136 (Cal. App. Ct. July 29, 2026)

Selected Blog Posts Regarding 1670.8

• Appeals Court Shuts Down Bogus Private Enforcements of the ‘Yelp Law’–Moss v. GoDaddy
• Catching Up on the Bogus “Yelp Law” Litigation Campaign–Tao v. Uniqlo
• Amazon Must Defend “Yelp Law” Claim–Ramos v. Amazon
• Courts Are Rejecting Attempts to Weaponize Laws That Protect Consumer Reviews
• Businesses Cannot Contractually Ban “Abusive” Consumer Reviews
• California Tells Businesses: Stop Trying To Ban Consumer Reviews (Forbes Cross-Post)

The post Another Court Shuts the Door on “Yelp Law” Drive-By Lawsuits–Arterberry v. Peet’s appeared first on Technology & Marketing Law Blog.

The court accepts Harbor Freight’s claim that the “2024 Cookie Banner was displayed on each page on the Website until the user interacted with it, even if the user had previously visited the Website and interacted with the prior cookie banner.”

In 2025, Harbor Freight added an arbitration clause to the TCU. The TCU also contains a class action waiver.

The named plaintiff, Alba, says he visited the website at least once a year since 2020, including after the arbitration clause was added to the TCU. Alba allegedly selected the “Reject All Cookies” button.

What Terms Apply

The court accepts Harbor Freight’s evidence of its user interface:

Harbor Freight has satisfied its burden of proof and demonstrated that Alba was shown the 2024 Cookie Banner. It is undisputed that Alba visited the Website as recently as October 2025. Harbor Freight’s unrebutted evidence that the 2024 Cookie Banner was shown to all users following October 31, 2024, is therefore sufficient to demonstrate that Alba must have been shown the revised banner during his recent visits to the Website….

Alba did not submit a declaration or any other evidence denying that the Website displayed the 2024 Cookie Banner when he visited it in 2025

Alba pointed to an article that says that normally, in the EU, a website doesn’t redisplay the cookie banner to consumers who have already made a selection. The court says this article doesn’t raise any questions about the activities taking place in the US.

Formation

Turning to formation, the court characterizes the cookie banner as a “sign-in-wrap,” which takes us to the now-familiar Chabolla considerations.

Transaction Context. Favors Alba, because “simply browsing a website is insufficient to put the user on heightened notice to anticipate terms of service.”

Visual Design. The court says the offer notice was reasonably conspicuous:

First, the font size used for the advisory paragraph, hyperlinked Terms and Conditions, and buttons was the same. Second, the advisory paragraph displayed in black text against a white background, whereas the Terms and Conditions and Privacy Policy were each bolded, underlined, and in red font. Thus, the Terms and Conditions “stood out from the surrounding text to indicate it was clickable.” Third, the hyperlink to the Terms and Conditions was directly to the left of the three buttons and contained within the pop-up banner, meaning that a Website user could not click on any of the buttons without also seeing the Terms and Conditions displayed on their screen. Finally, there was nothing else cluttering the cookie banner, and the advisory paragraph expressly notified users that “[b]y clicking ‘Accept All Cookies,’ ‘Reject All Cookies,’ ‘Cookie Settings,’ or continuing to browse our website, you acknowledge and agree to our Terms and Conditions of Use.”

A few things:

• The cookie banner excerpt was presented in isolation, not in the context of the entire page. I find these kinds of excerpts unhelpful and maybe misleading. Is the offer conspicuous when looking at the whole page?
• Even in the excerpt, the font is small. It’s blurry in the screenshot I present above (taken from the court opinion).
• Although there isn’t a ton of text, the consumer would have to wade through the cookie discussions to see that the decision to proceed has implications far beyond cookies.

The court distinguishes Chabolla because, in that case, the offer was below the acceptance button such that someone might not look there (here, the text is to the left of the acceptance button). The court says it doesn’t matter that the offer disclosure was at the end of the paragraph block because the TCU links were “bolded, underlined, and in red font, meaning they stood out even without reading the entire paragraph.” Alba also complained that the links to the TCU and privacy policy were “mashed together,” but the court says consumers would recognize the space between them and, either way, still see the TCU reference.

Assent. Alba didn’t challenge assent separately from the disclosure visbility. But I’m stuck on this. Harbor Freight claimed that taking ANY of the following actions was assent: “clicking ‘Accept All Cookies,’ ‘Reject All Cookies,’ ‘Cookie Settings,’ or continuing to browse our website.” This seems extremely expansive. For example, forming the TCUs by continuing to browse is a browsewrap, not a sign-in-wrap. And if someone clicks “cookie settings,” presumably to investigate the website further, it seems unfair to presume they want to form the contract yet.

Also, I’m willing to bet that a majority of consumers presented with this interface would be shocked to learn that “reject all cookies” meant “accept all terms,” including an arbitration clause in the TCU. Yes, that is technically what the disclosures say, but it requires a lot of mental work to put all of this together. It also raises potentially interesting logic puzzles, like what if the cookie policies’ rules about declined cookies and the TCU terms are in conflict with each other? (Nothing in this case suggested that, but I’m raising the possibilities).

Implications

For another case upholding TOS formation via cookie banners, see LB v. LinkedIn.

While I think jamming Alba with the TCU terms when he declined cookies was a raw deal, I’ll note the plus side: Harbor Freight wisely used the engagement with the cookie banner for more than resolving the cookie policy. If you’re going to force users to click, go for the gusto and get them to agree to the TOS at the same time like Harbor Freight did.

The court orders Alba’s case to arbitration. However, another plaintiff in the case took all relevant actions before the arbitration clause was added to the TCU. That plaintiff’s claims are stayed until the arbitration resolves.

For more on cookie banners, you might be interested in Kate Klonick, Ban Cookie Banners: A Case Study in Tech Regulation. I don’t agree with all of her arguments, but I heartily endorse the article’s bottom line that the EU and other countries should reconsider cookie banner mandates (and, in my opinion, all other government-mandated interstitials that break the web’s “click-and-go” paradigm).

Case Citation: Alba v. Harbor Freight Tools USA, Inc., 2026 WL 2161637 (N.D. Cal. Juy 27, 2026)

The post When You Reject Cookies, You Might Be Agreeing to Arbitration–Alba v. Harbor Freight appeared first on Technology & Marketing Law Blog.

(a)(1) A contract or proposed contract for the sale or lease of consumer goods or services may not include a provision waiving the consumer’s right to make any statement regarding the seller or lessor or its employees or agents, or concerning the goods or services.

(a)(2) It shall be unlawful to threaten or to seek to enforce a provision made unlawful under this section, or to otherwise penalize a consumer for making any statement protected under this section.

These laws seek to foster consumer reviews by stopping businesses from contractually restricting such reviews. The same principle animates the Consumer Review Fairness Act.

While pro-consumer review laws are good policy, California dubiously attached a private right of action to 1670.8. In its wake, a small group of lawyers have initiated a spate of bogus lawsuits. The lawyers overread businesses’ TOSes, twisting ordinary TOS provisions into putative restrictions on consumer reviews. Enforcement then becomes basically point-and-click. The lawyers search for the targeted TOS provision and then sue the associated business without showing any harm to any consumer. At that point, it becomes a numbers game: file enough lawsuits to cash in from quick but undeserved settlements.

The California appeals court ruling rejects this litigation scheme. The court says 1670.8’s private right of action only applies to (a)(2), not (a)(1). This distinction requires the lawyers to have actual gagged consumers to proceed. Virtual drive-by litigation based solely on TOS language, without more, won’t cut it.

The panel reaches this conclusion because only (a)(2) contains the “it shall be unlawful” grammar that seemingly triggers penalties:

The differences between the two subdivisions permit a reasonable inference that the Legislature intended for subdivision (a)(1) to operate as a shield and for subdivision (a)(2) to provide the consumer with a sword when a seller threatens or takes action to enforce a waiver to stifle consumer speech.

On this point, the court sides with the Shofet case and ignores the Anderson case that reached the opposite conclusion.

The “shield” reference is confusing. A shield for whom, and against what? Later, the court says that TOS provisions that violate (a)(1) are unenforceable. However, that seems to render (a)(1) superfluous. If the legislature attaches a penalty to enforcing the TOS provision, doesn’t that penalty also simultaneously render the TOS provision unenforceable, at least implicitly?

This opinion isn’t precedential, so it is definitely not the final word on the matter. However, it’s also clear that this litigation genre is doomed, one way or another. The sooner, the better.

Even if (a)(1) doesn’t have a private right of action, businesses should still scrub their TOSes for any provisions that might be construed as restrictions on consumer reviews. Among other problems, enforcing those provisions could still trigger the private right of action.

Case Citation: Moss v. GoDaddy.com, Inc., 2026 WL 2122990 (Cal. App. Ct. July 23, 2026)

Selected Blog Posts Regarding 1670.8

• Catching Up on the Bogus “Yelp Law” Litigation Campaign–Tao v. Uniqlo
• Amazon Must Defend “Yelp Law” Claim–Ramos v. Amazon
• Courts Are Rejecting Attempts to Weaponize Laws That Protect Consumer Reviews
• Businesses Cannot Contractually Ban “Abusive” Consumer Reviews
• California Tells Businesses: Stop Trying To Ban Consumer Reviews (Forbes Cross-Post)

The post Appeals Court Shuts Down Bogus Private Enforcements of the ‘Yelp Law’–Moss v. GoDaddy appeared first on Technology & Marketing Law Blog.

This account has repeatedly posted false information that was reviewed by independent fact checkers or went against our Community Guidelines. Do you want to @mention this account?

There was a more prominent “cancel” button than the option to proceed, implicitly nudging users to cancel. F4F claims that none of its posts were false and Instagram didn’t rely on fact-checkers before displaying the interstitial warning.

The filings don’t appear to show the interstitial warning (why not?), but I found this example online:

F4F filed in Virginia state court. Instagram removed to federal court and then sought to transfer venue to California per its TOS. The federal district judge agrees.

F4F argued that Instagram’s TOS formation process was a browsewrap. I couldn’t find screenshots in the filings (why not?), but the court credits[FN] Instagram’s declaration that the signup process said “by tapping ‘Sign Up’ you agree to our Terms, Data Policy, and Cookies Policy.” The court says this is a “hybrid clickwrap,” not a “browsewrap.” I say it’s neither; it’s a standard sign-in-wrap, and we don’t have enough information to know if it’s properly formed without seeing screenshots.

[FN: The court says it credits Instagram’s declaration on a motion to transfer “given the declarant’s personal knowledge of the information described therein and given that Feds for Freedom’s allegations are consistent with the declaration.”]

F4F said it didn’t read the terms. (Indeed, literacy appears to be a major challenge in the anti-vax community). Quoting Dhruva, the court replies that “when a website provides clear and reasonably conspicuous notice that there are contract terms available by scrolling down or clicking a hyperlink, the user is on reasonable notice of those terms even if she never reads them.” As a result, F4F bears the consequences of its decision not to read the TOS. That’s enough to ship the case to California.

The court’s TOS formation ruling isn’t surprising, but the real action in this case will start when the court considers the legal implications of the interstitial warning. I have raised concerns before about the legal risks of fact-checking and other explanations. Unsurprisingly, the affected accounts really don’t appreciate being called out.

Case Citation: Feds for Freedom v. Meta Platforms, Inc. 2026 WL 2058962 (W.D. Va. July 16, 2026)

The post Court Upholds Instagram’s TOS–Feds for Freedom v. Meta appeared first on Technology & Marketing Law Blog.

Coomer v. Lindell, 2026 WL 817370 (D. Colo. March 25, 2026)

Related post. This is more fallout from the efforts to deny the 2020 presidential election results. MyPillows huckster Lindell publicly trashed Dominion Voting and and its president, Coomer. A jury held Lindell and Frankspeech liable for defamation and more. The defendants unsuccessfully tried to overturn the jury verdict post-trial.

Frankspeech invoked Section 230 for its liability for Lindell’s speech. The court disagrees:

Mr. Lindell founded Frankspeech. He regularly acted as its corporate representative, including at trial. He hosted his own show on Frankspeech, broadcasted it through Frankspeech, and used the Frankspeech platform to make and publish statements about Dr. Coomer. There is no evidence that anyone other than Mr. Lindell exercised any meaningful degree of control over the Frankspeech entity. By all accounts, Frankspeech was Mr. Lindell’s corporate alter ego in this context….for § 230 purposes, Frankspeech’s defamatory statements through its agent would plainly qualify as participation in the development of those statements.

Frankspeech also claimed Section 230 for Clement’s remarks at a conference. The court responds: “Frankspeech—through Mr. Lindell and others—sponsored, promoted, and broadcasted the event….a reasonable jury could conclude that Frankspeech’s conduct (including its conduct through Mr. Lindell) created actual or apparent authority for Mr. Clements and other presenters at the Cyber Symposium to act as agents of Frankspeech.”

Murphy v. LinkedIn Corp., 2026 WL 881710 (N.D. Cal. March 30, 2026)

Fraudsters approached Murphy via LinkedIn direct messages. The conversation switched over to WhatsApp, where the fraudsters effectuated their fraud. Murphy’s lawsuit against LinkedIn fails due to Section 230:

Plaintiffs’ claims for negligence, gross negligence, and product liability are premised on a purported duty to “monitor” users, “restrict the accounts of fraudulent actors,” and to suppress “fraudulent activities” by users of LinkedIn’s platform. These claims “necessarily implicate” LinkedIn’s role as a publisher of third-party content because “discharging the alleged duty would require [LinkedIn] to monitor third-party content and prevent” communications between fraudsters and legitimate LinkedIn users. Nor can Plaintiffs sue LinkedIn for breaching a “duty to warn.” LinkedIn’s “role as a publisher of third-party content does not give it a duty to warn users of ‘a general possibility of harm’ resulting from” using LinkedIn’s services.

The plaintiffs unsuccessfully tried the defective design workaround:

Plaintiffs argue that their claims are not based on LinkedIn’s role as publisher, but rather its role “as a product manufacturer and developer of defective algorithms” that facilitated communications between fraudsters and Plaintiffs. But the Ninth Circuit has repeatedly upheld dismissal of negligence and product liability claims framed in the same way. [cites to Doe v. Grindr and Dyroff]

A Roommates.com workaround didn’t work either:

Plaintiffs’ claims are premised on LinkedIn’s neutral tools for connecting users, not on content that LinkedIn created or required users to provide as a condition of using its services. Indeed, LinkedIn expressly informs users that they “have choices about the information” on their profiles, and that users “don’t have to post or upload personal data” that may make them targets of fraud.

To put a finer point on it, if the plaintiffs are complaining about LinkedIn direct messages, then those messages may be covered by the ECPA just like email, and LinkedIn may have had limited legal rights to monitor the conversations at all.

Finally, the plaintiffs tried a TOS-based workaround, poured into consumer protection laws. The court acknowledges that some breach of contract claims may not be preempted by Section 230, but

These claims are premised on the same duties discussed above – duties to monitor, to design products in a different manner, and to warn – that fundamentally seek to hold LinkedIn liable for content created by the fraudsters. Styling these claims as different legal theories does not remove them from Section 230’s scope….

Plaintiffs seek to hold LinkedIn liable solely based on its general monitoring policy and aspirations to remove fraudulent users from its platform. Moreover, LinkedIn expressly disclaims liability by notifying users that they “may encounter content or information that might be inaccurate, incomplete, delayed, misleading, illegal, offensive, or otherwise harmful,” and that LinkedIn “generally does not review content provided by [its] Members or others.”

McNeal v. Calvin, 2026 WL 879228 (E.D. Mo. March 31, 2026)

This case relates to the TV show Love & Marriage: Huntsville, shown on OWN (Oprah’s channel). The plaintiff, a lawyer (naturally), is one of the women featured in the show. She is upset about online comments about the show and sued many defendants pro se. The court says “Section 230 of the Communication Decency Act bars Plaintiff’s claims against YouTube, Google, and Tik Tok.” In particular, “The content uploaded by users cannot be attributed to internet service providers based on the theory that users are “agents” of the websites they use.”

Shiva Ayyadurai v. U.S., 2026 WL 879409 (D.C.D.C. March 31, 2026). My prior blog post about a different litigation of his.

This is a jawboning case:

Ayyadurai’s 75-page Complaint alleges that various Massachusetts state officials—none of whom are named as Defendants in this case—federal officials at the Cybersecurity Infrastructure Security Agency (“CISA”), and other government officials unknown to him have coordinated with private companies to regulate and censor his speech by “deplatforming” or “shadowbanning” him—that is, suspending his social media accounts or limiting the reach of his posts. Ayyadurai alleges that the Defendants took these actions in retaliation for posts in which he “articulat[ed] a government employee’s role in destroying the digital ballot images used to tabulate votes” in a prior election.

With respect to the liability of the social media defendants who allegedly got jawboned, the court accepts the 230(c)(2)(A) defense:

Ayyadurai’s Complaint fails to state a claim against the Social Media Defendants based on their content-moderation decisions because he does not plausibly allege that any of those decisions were made in the absence of “good faith” or that they were made for a purpose other than removing content that they “consider[ ] to be … objectionable.”…

conclusory allegations of bad faith are insufficient to state a claim against a platform based on activity within the reach of Section 230(c)(2).

At the same time, the court struggled with applying to Section 230(c)(1) to the removal decisions. Incredibly, it says:

only a few of the decisions restating this broad dictum [from Zeran] have grappled with its implications when the challenged conduct is a platform’s decision to remove objectionable content—such as a plaintiff’s own posts—rather than a decision to leave other objectionable content in place. Extending immunity under Section 230(c)(1) to cover direct challenges to the removal of user content is an uneasy fit with the language of the provision, which says only that “[n]o provider or user of an interactive computer service shall be treated as the publisher or speaker of any information provided by another information content provider.” A broad reading of Section 230(c)(1) that immunizes all content-removal decisions also risks “swallo[wing] the more specific immunity in (c)(2),” which applies only to content-moderation decisions that are made in “good faith.”

Not this shit again. I have repeatedly explained how Section 230(c)(2) can apply to first-party filtering decisions, which leaves room for Section 230(c)(1) to protect against liability for third-party content. There are DOZENS of cases applying Section 230(c)(1) to removal decisions, so for the court to think that it’s spotted something that all of those other courts have missed is laughable…and completely gratuitous…and ultimately inconsequential given that the court still tosses the case.

The court tries to justify its reluctance on Section 230(c)(1):

There is little reason to strain the reach of the immunity in Section 230(c)(1) when, as in this case, the immunity in Section 230(c)(2) leads to the same result.

NOOOO. There are several excellent reasons to apply both 230(c)(1) and 230(c)(2):

(1) 230(c)(1) doesn’t have a good faith prerequisite, which has mucked up 230(c)(2) jurisprudence and made 12(b)(6) dismissals much more difficult to obtain, jacking up the litigation costs for both sides and giving false hope to bogus claims. Indeed, because the court dismissed this case without prejudice, I’m sure an amended complaint will try again to manufacture bad faith sufficient to kick the case into very expensive discovery;

(2) removal and leave-up decisions are two sides of the same decision, i.e., every editorial decision about an item of third-party content is either a leave-up or removal decision, so they cannot be separated; and

(3) the statute and 25+ years of caselaw have established the principle that 230(c)(1) applies to removal decisions.

Sigh. In the end, this case ends up the same as all of the other content removal and account termination cases–dismissed.

Gaughan v. Barounis, 2025 N.Y. Misc. LEXIS 17243 (N.Y. Supreme Ct. December 18, 2025) 

The Complaint alleges that the impersonating profile and pictures of plaintiff were posted by defendants Barounis and Viera. Plaintiff’s contention that the XVideo defendants are liable for refusing or failing to remove offending material prepared by a third party, or that they may be held responsible for allegedly defamatory postings made by third parties does not state a viable basis for liability. Nowhere in the Complaint does plaintiff allege that the XVideo defendants posted or created the impersonating profile themselves, altered or edited its contents, or encouraged, required, or otherwise induced defendants Barounis and/or Viera, or any other user, to create the profile or upload unlawful content. To the contrary, plaintiff even alleges in her Complaint that Barounis and Viera allegedly making this impersonating profile goes against XVideo.com’s Terms and Agreements.

The Court also finds plaintiff’s argument that the XVideo defendants should be responsible for her alleged stolen identity, and that Section 230 does not apply in cases, unavailing.

It has also been held that “Sections 50 and 51 of the New York Civil Right Law sounds in privacy, not intellectual property, and thus does not fall within the intellectual property exceptions in Section 230.”

Equally, plaintiff’s contention that this immunity is lost because the XVideo defendants allowed the dissemination of plaintiff’s personal information and allowed discriminatory content (age, sex, sexual orientation, ethnicity, etc.) is unsuccessful.

Arana v. Molta, 2026 WL 1166348 (D. Mass. March 24, 2026)

Mr. Molta drafted the description of, and provided the photos for, the Dennis Property posted to WNAV’s website. WNAV did not review, revise, edit, or provide feedback on the Dennis Property listing that the Moltas posted to the WNAV website. WNAV is thus immune from liability for any of the statements or representations made by the Moltas in the Dennis Property listing.

Greer v. Moon, 2026 WL 1170015 (D. Utah. Feb. 11, 2026)

Mr. Greer’s only claims against Defendants are for contributory copyright infringement under federal law. Because those claims clearly “pertain[ ] to intellectual property,” they cannot be barred by section 230. Defendants’ argument concerning section 230 immunity fails.

Tufano v. Google LLC, 2026 U.S. Dist. LEXIS 100789 (N.D. Cal. May 6, 2026)

“Plaintiff premises his claims on Google allegedly “filter[ing] out all negative reviews” of Dr. Taban, including Plaintiff’s negative review, which Google allegedly removed.” The court dismisses per Section 230: “First, Google’s review service is an interactive computer service. Second, Google publishes the reviews on which Plaintiff bases his claims. Third, third parties, and not Google itself, provide the reviews published by Google.” The plaintiff said Google didn’t act in good faith, but Google relied on 230(c)(1) where good faith is irrelevant, and the plaintiff didn’t provide any evidence of bad faith.

Starship LLC v. Shein Distribution Co., 2026 WL 1455009 (C.D. Cal. March 20, 2026)

This is a fast fashion enforcement lawsuit that includes both copyright and trademark claims. The direct infringement claims largely fail because Shein operates as a marketplace for online vendors. The contributory infringement claims failed because the plaintiff wanted a staydown in response to takedown notices. The vicarious infringement claims also fail.

Shein defended against the unfair competition claim based on Section 230. The court says:

Plaintiff characterizes Shein as an information content provider because it “regularly markets and sells goods” and “is involved in almost all aspects of the marketplace’s distribution chain.” These conclusory assertions do not plausibly allege that Defendants are content providers. Plaintiff provides no factual basis to infer that Defendants materially contributed to the alleged infringement.

King v. Jilin Province Detiannuo Safety Tech. Co. Ltd., 2026 Fla. Cir. LEXIS 295 (Fla. Cir. Ct. Feb. 17, 2026)

Plaintiff does not allege that eBay participated in the creation or development of Seller’s listing or allege that eBay played some role in handling or transmitting the airbag components. Plaintiff only alleges that eBay should have removed Seller’s listing and/or issued some censure to Seller for its alleged noncompliant listing….

The only way eBay allegedly could have prevented the harm was by reviewing the third-party listing, determining whether it complied with internal policies, and removing it. That conduct, i.e., deciding whether to publish or remove third-party content, is a paradigmatic editorial function protected by the CDA.

In re Apple Inc. App Store Simulated Casino-Style Games Litigation, 2026 WL 1552391 (N.D. Cal. June 1, 2026)

The Court finds Defendants’ argument that Section 230 provides immunity from suit unavailing. Defendants point to the clause in Section 230 that states that “no cause of action may be brought” that is contrary to the statute. 47 U.S.C. § 230(e)(3). But the Tenth Circuit has held that Section 230 “provides immunity only from liability, not suit.” And the Ninth Circuit case Defendants themselves cite clearly states that Section 230 is designed “to protect websites against the evil of liability for failure to remove offensive content”; that case does not mention protection from suit. Thus, the Court concludes that Section 230 does not protect Defendants from suit.

Accardi v. CSC Holdings, LLC, 2024 N.Y. Misc. LEXIS 83186 (N.Y. Supreme Ct. November 26, 2024)

The plaintiffs claim that defendants failing to follow their terms of service makes them liable to the plaintiffs, effectively negating the immunity provided by the Communications Decency Act. After a review of the papers submitted by the defendants and the plaintiffs, the Court finds that the immunity provided by Section 230 does apply to the defendants in this action and the plaintiffs have not proffered any compelling argument or evidence to negate this immunity. As such, the defendants motion to dismiss the third cause of action pertaining to the failure to remove posts on social media is granted.

Life Mastery Network LLC v. Haygarth, 2026 WL 1622887 (D. Haw. May 22, 2026)

Paula indisputably enjoys immunity under the CDA for reposting content. Many courts have included private individuals within the scope of a “user.” Thus, (1) Paula is a “user of an interactive computer service”; (2) the subreddit link is “based on information provided by another information content provider”; and (3) Plaintiffs’ claim would treat Paula “as the publisher or speaker of that information.” As such, and as Plaintiffs have conceded at the Hearing, Paula is immune from lawsuit for what she reposted from Reddit.

But because the CDA does not immunize someone who posts original content, it makes sense that adding comments to something that is re-posted would not trigger CDA immunity. While these cited cases are not directly on point, the Court concludes that Paula’s comments regarding what she reposted are not subject to CDA immunity.

Glazer v. Meta Platforms, Inc., 1:25-cv-01849-GLR (D. Md. June 12, 2026)

The Court agrees with Meta that Section 230 bars Plaintiffs’ claims….All three elements are satisfied here: Meta is an interactive services provider; Plaintiffs’ claims treat Meta as the publisher or speaker of information under Section 230 because they “seek ‘to hold [Meta] liable for . . . deciding whether to publish, withdraw, postpone or alter content’ provided by third parties”; and the content at issue here is that of third parties, and Plaintiffs “seek[] to hold Meta liable, not for providing that content, but for allowing third parties to do so.”

Related ruling.

Sidoli v. YouTube LLC. 2025 U.S. Dist. LEXIS 210953 (N.D. Cal. Sept. 2, 2025)

Plaintiff also seeks to treat YouTube as a publisher because she alleges that YouTube wrongfully demonetized, restricted, and removed her videos. Such conduct falls within a publisher’s traditional functions….

YouTube cited authority that which stand for the proposition that Section 230 immunizes internet service providers from suit for termination of a plaintiff’s entire channel as well as the content that the plaintiff posts on that channel. Such authority is persuasive. Thus, any claim Plaintiff brings which seeks to challenge YouTube’s decision to remove Plaintiff’s YouTube channel is also barred by Section 230.

Also, “Plaintiff’s constitutional claims cannot proceed as YouTube is a private forum, not a state actor.”

See also Sidoli v. YouTube LLC, 2026 WL 1480407 (S.D.N.Y. May 27, 2026), upholding YouTube’s TOS and forum selection clause: “Defendants provide evidence, which Plaintiff does not dispute, showing that she agreed to abide by the terms of service by clicking the “Create Channel” button when she started her YouTube page on June 21, 2021.”

Kennedy v. Vickery, 2025 Me. Super. LEXIS 108 (Me. Superior Ct. Sept. 10, 2025)

RFK Jr. lost a defamation lawsuit. As for Section 230:

Defendant posted on X, without comment, a link to an article, authored by thegrio.com, titled “Anti-vaxxer Robert F. Kennedy Jr. is harming black people—and his family legacy—with his vaccine misinformation campaign.”…

Under the Communications Decency Act, internet service users are not liable for repeating, without embellishment, third party content….

Exhibit A to the Amended Complaint supports Defendant’s assertion that he posted the third-party content without embellishment. Plaintiff denies Defendant posted the link without embellishment, but cites no admissible record evidence to support the denial. Thus, under the Communications Decency Act, Defendant is not liable to Plaintiff for this post.

Awoye v. Jones, 2026 WL 1847088 (D.N.J. June 26, 2026)

In Instagram posts, Jones claims that Awoye scammed her. Awoye sued her and brought Meta along for the ride, claiming it had violated his publicity rights. There isn’t any publicity rights violation here:

The core of Plaintiff’s allegations is that Jones spread allegedly false information about Plaintiff on Instagram. Jones was not selling a product or otherwise soliciting money from her followers. As such, neither was Instagram. Jones’ posts were the “dissemination of news or information” and not made for a commercial purpose.”

Norton v. Meta Platform, Inc., 2026 WL 1963120 (N.D. Cal. July 7, 2026)

In posts on Facebook, several third parties accused Norton of criminal activity and shared intimate images of him….

“Meta is an interactive computer service provider.” Second, Norton alleges that third parties, not Meta, created the Facebook posts at issue; the third parties, not Meta, are the “information content provider[s].” Third, each of Norton’s claims seek to treat Meta as a “publisher” of third-party content. “A claim that obliges the defendant to monitor thirdparty content to avoid liability … treats the defendant as a publisher.”

Norton argued “but the algorithms.” Citing Ligon, the court says the algorithms matter only if the algorithm creates content. Citing Roommates.com, the court adds: “Norton doesn’t allege that Meta required its third-party users to create or post any of the content at issue.”

Moore v. LogSat Software LLC, 2022 WL 23074273 (S.D. Ind. Sept. 29, 2022)

John Moore has never been accused of, arrested for, or convicted of any sex-related offense; yet, his name, picture, address, and other identifying information appear on LogSat Software LLC’s app, called “Sex Offenders Search”….

Mr. Moore was convicted in Indiana of voluntary manslaughter. Thus, he was required to register on a violent crime registry in Indiana. The violent offender and sex offender registries are the same in Indiana—in other words there are not two separate lists. Mr. Moore testified that he believed that there was no national violent offender registry, just a national sex offender registry and that he is on that because the Indiana Registry is reported to the National registry….

the alleged defamatory statement at issue is that Mr. Moore’s name, picture, address, and other identifying information appear on app called “Sex Offenders Search,” because he is not a sex offender and has never been accused of, arrested for, or convicted of any sex-related crimes. Mr. Moore does not allege that he was wrongfully included in the data set that LogSat purchased from FWD, or, for that matter, that he was wrongfully included on Indiana or the National registries.

The post Large Roundup of Section 230 Rulings appeared first on Technology & Marketing Law Blog.

The first two rulings came in March. In the Bouck case, the court rejected Facebook’s Section 230 defense because Facebook’s generative AI allegedly contributed to the ad copy. In the Suddeth case, the court accepted Facebook’s Section 230 defense because the plaintiffs focused on algorithmic amplification.

Although the Bouck case initially overcame Section 230, in an under-the-radar ruling this week, the court nevertheless dismissed it as preempted by federal securities law. So the Bouck plaintiffs got a first-hand taste of the infamous Ninth Circuit switcheroo, which occurs when the plaintiffs get false hope that they might actually win because they got around Section 230, only to slam into other brick walls in their prima facie case.

The March Bouck Ruling

Section 230

Meta’s Section 230 defense turns on whether it was a co-creator of the ads sufficient to become an “information content provider.” The court says “What it means to “create” or “develop” content on the internet is not self-evident.” The court says there’s a fact dispute over whether Facebook’s contributions were material:

The alleged illegality stems from the advertisements’ content—i.e., the false statements made to Facebook and Instagram users that induced them to click on the ads. Plaintiffs have averred that Meta participated in the construction of the ads by literally generating, using artificial intelligence, the images and text in the advertisements. That degree of participation is not protected by section 230…. [cite to Forrest v. Meta]

The district court in Forrest accepted that optimizing the appearance of an ad to drive engagement was enough of a contribution to the ads’ illegality to preclude section 230 immunity. Here, in addition to averring facts which, if proven, would establish that Meta altered the ads’ appearance to maximize impressions, Plaintiffs have averred that Meta’s tools allowed the scammers to produce “AI-generated text and images” for use in the ads through its Advantage+ Creative tool.

The court says Carafano doesn’t help Facebook because:

Plaintiffs have averred that Meta created the offending information by generating some of the false statements that tricked them into the investment scheme….

Plaintiffs aver that the scammers used Meta’s Advantage+ Creative tool which, as explained, uses artificial intelligence to enhance whatever message the user inputs. If a user, for example, tells the tool that he is interested in an ad promising astronomical weekly investment returns, Advantage+ Creative will spin up a slew of ads that include the provided language and other language, images, and videos it decides will be effective in promoting the user’s chosen message….

Without question, Advantage+ Creative and the other tools in Meta’s advertising suite would not have come up with that language without the inspiration from the scammers, but that language is still the creation of Meta.

One way of reading this decision is that Section 230 has limited applicability to Generative AI outputs. If the model outputs something new (as opposed to verbatim replicating material in its index or provided by the user), then the newly created material isn’t covered by Section 230.

Aiding and Abetting Fraud

The court says Facebook’s ad review process should have detected that the ad looked scammy (see an example on the right): “Even a cursory look would warrant suspicion that the ad is fraudulent. Meta cannot, with a straight face, claim otherwise.” Facebook responded that the ad review was automated (i.e., no human performed the “cursory look” that the judge was contemplating), a response the judge calls “confounding” because “It was Meta’s decision to use technological review tools to screen ads, and it does not now get to claim it had no idea what was going on because it tasked some software program with doing the first pass.”

The judge is dabbling with some heady topics here in an unsatisfying and superficial way. At core, the judge–whether he intended to or not–is addressing the epistemological question of when a machine “knows” something. This is a crucial topic for the digital age, and it deserves more in-depth and thoughtful treatment than the judge provides here. Alternatively, the judge is accepting an argument that it’s “willful blindness” to turn over ad review to the machines. But nowadays machines do a lot of scanning and screening without humans in the loop, and it deserves some careful and thoughtful judicial review to determine if such delegation deserves to be condemned with a “willful blindness” style punishment. The judge didn’t do that either.

Contract Breach

The plaintiffs tried the oh-so-tired hack of claiming that TOS content policy restrictions should be treated as affirmative representations that the policies won’t be violated. Not this again. Sigh. The judge doesn’t take the bait (cite to Lloyd v. Facebook):

The provision of the ToS on which Plaintiffs rely does not expressly or impliedly impose a binding contractual obligation on Meta to do anything. It is much more naturally read as a creating a duty of its users not to pollute Meta’s platforms with scam investment ads….

To the extent the ToS even mentions Meta doing something to prevent fraud, it speaks only in aspirational terms…Meta, however, never promises to take concrete steps to effectuate that aspiration.

Negligence

“Plaintiffs have averred that Meta did more than just sit idle as fraudsters roamed freely on their platforms. Therefore, no “special relationship” need be pleaded for the case to move forward.”

Unruh Act

“Plaintiffs here aver that they were targeted because of their race or national origin, not that they were excluded from anything. Whatever moral condemnation that merits, it is not a violation of the Unruh Act.”

The court distinguishes Liapes because, in that case, the plaintiff complained she didn’t receive ads based on her protected classifications. Here, the plaintiffs got the ads: “Far from encountering an exclusionary practice, they encountered an inclusionary one—it is just that they wish they were not included.” The court rejects the plaintiffs’ attempt “to spin Liapes into a general prohibition on targeting based on protected characteristics.”

Case Citation: Bouck v. Meta Platforms, Inc., 2026 WL 810036 (N.D. Cal. March 24, 2026)

The March Suddeth Ruling

Because of its implications for Generative AI, the Bouck case has garnered some coverage. That coverage overshadowed a companion case, the Suddeth decision, issued by the same judge, on the same day, involving the same basic claim (Chinese stock pumping-and-dumping). Unlike the Bouck case, the judge dismissed the Suddeth case.

In Bouck, the plaintiffs claimed that Facebook helped the advertiser build and polish up the ads using Generative AI. In Suddeth, the plaintiffs claimed Facebook algorithmically amplified the ads. The court has little difficulty concluding that algorithmic amplification is governed by Section 230, citing Dyroff and Doe v. Grindr:

Their theory of algorithmic amplification is nothing more than an averment of facilitation. The core illegality—the choice to use Plaintiffs’ likeness and falsely represent that they endorsed certain investments—was exclusively undertaken by the scammers. Meta provided those scammers tools to disseminate that fraud that may well have played a role in the success of the ploy. However, as in both Dyroff and Grindr, Meta’s tools were content neutral on their own—it was the scammers who chose to manipulate those tools for illicit ends.

The judge distinguishes his own simultaneous ruling in Bouck:

[in Bouck,] the plaintiffs averred that Meta contributed materially to the development of the ads by offering generative-AI tools that developed the ultimate content of the fraudulent ads. Meta’s role in that scheme, therefore, allegedly went beyond offering neutral tools that promoted content developed exclusively by the scammers—Meta, at least according to the complaint, was a genuine co-conspirator in the creation of the offending content. Plaintiffs have failed to aver a similar level of complicity here.

The court summarizes: “Section 230 thus bars any claim which, at bottom, seeks to hold Meta liable for the damage done by the content of the fraudulent ads.”

Case Citation: Suddeth v. Meta Platforms, Inc., 2026 WL 810252 (N.D. Cal. March 24, 2026)

The June Bouck Ruling

We’re back to the classic Ninth Circuit switcheroo: the arguments that the plaintiffs used to get around Section 230 ensure the failure of the prima facie case. Here, the plaintiffs alleged state law claims to redress what is fundamentally a federal securities law claim. The court summarizes:

Meta…argues that the theory which helped Plaintiffs defeat the first motion to dismiss compels granting the second. If it is true that Meta contributed to the creation of the fraudulent ads, then this suit is necessarily based on the falsity of Meta’s statements. A suit in which a plaintiff claims the defendant made false statements which led the plaintiff to purchase securities when he otherwise would not have is quintessentially one sounding in the securities laws, even if the right of action comes from state law. SLUSA prevents precisely that type of suit from being maintained in any court, state or federal….

At bottom, Plaintiffs are trying to have it both ways. They assert Meta’s misrepresentations aided and abetted the core fraud by pushing them into scam investment groups while simultaneously maintaining that those misrepresentations were not material to their decision to purchase CLEU stock. Both cannot be true—either the misrepresentations mattered (in which case SLUSA applies) or they did not (in which case their claims fail on the merits).

This denouement will surely attract less attention than the March ruling.

The plaintiff could in theory overcome this ruling by bringing a federal securities act claim. However, I suspect the plaintiffs won’t due to the significant pleading challenges. Plus, it will be difficult or impossible to put Facebook on the hook for those claims.

Case Citation: Bouck v. Meta Platforms Inc., 2026 WL 1697630 (N.D. Cal. June 11, 2026)

BONUS: Daigneau v. Meta Platforms, Inc. and Irving v. Meta Platforms, Inc., 2026 WL 2076112 (N.D. Cal. July 17, 2026):

In two related cases, plaintiffs allege that they fell for “pump-and-dump” investment schemes, advertised on Facebook and Instagram and carried out in WhatsApp groups, where criminal networks operating out of China pressured them to purchase “penny stocks”—for Daigneau, Ostin Technology Group Co., Ltd. (“OST”) and for Irving, Jayud Global Logistics Ltd. (“JYD”)—while the scams’ orchestrators sold off their own shares. The plaintiffs all allege that with its advertising tools used to develop and target the fraudulent advertisements, Meta not only enabled and facilitated but also materially contributed to the scheme and is liable for the financial loss they suffered. This same scenario was alleged in Bouck et al. v. Meta Platforms, Inc. (25-cv-5194-RS), a case recently dismissed by Hon. Richard Seeborg. Because plaintiffs seek to hold Meta liable for its role creating, optimizing, and targeting the scam advertisements “in connection with” plaintiffs’ purchase of securities, I agree with Judge Seeborg that their claims are barred under the Securities Litigation Uniform Standards Act of 1998

The post Section 230 Doesn’t Apply to Generative AI Enhancements to Ad Copy (But the Plaintiffs Lose Anyway)–Bouck and Suddeth v. Meta appeared first on Technology & Marketing Law Blog.

On March 9, 2026, Judge Chesney granted a preliminary injunction in the case of Amazon v. Perplexity, concluding Amazon was likely to succeed on its CFAA and California Penal Code section 502 theories.

If you’re familiar with the CFAA, the outcome of the preliminary injunction opinion was what you might expect.

But it is underwhelming in some new and interesting ways. It is, in my opinion, a shockingly poor effort to grapple with CFAA applicability to agentic AI technology after Van Buren.

If you’re unfamiliar, agentic AI is simply the name for AI that actually does work for you instead of answering questions. An agent can take a loose goal, break it into steps, use tools, gather information, make decisions, and come back with the task done. That makes it useful for the work people hate but still need judgment to finish, such as research, product comparisons, customer support, and multi-step coordination.

One valuable use case for agentic AI is shopping. Not only can Agentic AI tell you what the highest rated toaster on Amazon is for under $100, it can actually buy it for you.

You can tell agentic AI:

Buy a toaster on Amazon for under $100. Prioritize name brands, Amazon Prime shipping, and wide slots for bagels. Do not buy based solely on Amazon rating. Consider only models with at least 1,000 reviews, a rating of 4.7 or higher, and no obvious fake-review pattern. Cross-check at least two independent review sources or testing sites for confirmation that the quality is among the best at this price point. Choose a 2-slice toaster unless a 4-slice model is clearly better.

If one option is clearly superior under these criteria, add it to my cart and proceed to purchase. If not, add the best by these measures and I will review and purchase.

The thing about instructions like these is that they totally kill many of the ways online e-commerce sites make money. Amazon doesn’t just make money from selling you stuff and sending it to you. They also make money from product placement, ads, upselling, and a million other ways of nudging you into buying more stuff.

Amazon wants their search bar to be the way that you buy things online. But if the interface for your shopping becomes the AI labs’ platforms, that’s a big deal for e-commerce sites. It’s an existential threat to some e-commerce platforms and a major margins headwind for giants like Amazon and Walmart.

Those are the stakes.

* * *

The injunction in this case arose from Amazon’s challenge to Perplexity’s Comet browser and shopping agent. Perplexity built a tool that allows software to shop for users on Amazon through their logged-in accounts. Amazon sent a cease-and-desist letter. But Comet didn’t stop.

Created by ChatGPT Dec. 2025

The court focused on a familiar question for CFAA folks, which is that Amazon allegedly revoked authorization, Perplexity’s agents continued accessing Amazon’s systems through user accounts, and therefore Amazon was likely to succeed under theories derived from CFAA and California computer-access law.

From a pure CFAA perspective, the allegations were straightforward. Monopolist platform discovers a kind of automation that people who use the Internet enjoy, labels it “unauthorized,” cites to Power Ventures, points to investigative costs, and gets its injunction. It has happened before and it will happen again.

But the genuinely novel issue was totally ignored in the opinion. Perplexity’s Comet is an AI agent. And agentic AI is not merely collecting data. It is acting as the user’s delegated representative in an ongoing workflow.

The opinion makes zero effort to analyze:

• whether an AI agent should be treated like a browser,
• whether it should be treated like a human assistant using delegated credentials,
• whether agency-law concepts matter,
• whether user autonomy creates an independent authorization interest distinct from Power Ventures,
• whether there is a meaningful distinction between scraping data and performing user-directed actions.

Instead, the court seems to jump directly to the conclusion that Amazon retains ultimate authority to exclude the intermediary.

(In partial defense of the court, they hint that they may have discussed this at oral arguments. But there’s no analysis of agentic AI in the opinion itself).

From an agentic-AI perspective, it’s straightforward to ask:

If I can personally log into Amazon and buy a toaster, why can’t I save time and have software do it for me?

Because Power Ventures is dumb and Amazon says so, that’s why.

The Power Ventures framing has always allowed platforms to control their platforms, even when the user wants a certain tool to interact with them, if the integration includes a logged-in component. If there is a password at any part of the flow, most courts find that the CFAA can be used to crush any unwanted integration, no matter how benign or socially useful it is. Log-in plus cease-and-desist has almost always been a CFAA violation.

That’s why Power Ventures matters so much. If Power Ventures controls, Amazon gets to frame Comet as just another unwanted logged-in integration. If it doesn’t, the case becomes about whether users can delegate ordinary account activity to software.

That is also what makes this such an interesting test case for Power Ventures. Amazon wants to put Comet in the Power Ventures box, and legally, that is exactly where a plaintiff wants to be. But the factual analogy is imperfect. Power Ventures was not merely helping users operate Facebook. It built a competing service, collected Facebook users’ information, imported that information into its own platform, and used users’ networks to market itself. Comet’s better factual description is simpler, because the user is still shopping. The user just has delegated parts of the shopping flow to software.

If Power Ventures means that a platform can veto any third-party agent, then the CFAA becomes a platform-control statute for the agentic web. Maybe that is where the Ninth Circuit ultimately lands. But if that’s the case, the CFAA is going to be an increasingly unpopular law.

What’s especially disappointing is that courts continue to pretend that there are not difficult policy questions to consider with these new technologies. It is particularly true in this case, because it was a preliminary injunction proceeding, and the court was required to consider the broader public interest question. Perplexity argued that an injunction would disserve the public interest in consumer choice and innovation.

The court’s response was as thin and fragile as overcooked spaghetti. It said that the public has an interest in preventing unauthorized access to computers, and that was that.

The platform says it’s not allowed, therefore it’s not allowed, and it’s in the public’s interest for it not to be allowed.

See how easily we resolved issues with agentic AI?

Reasoning like this makes the CFAA one giant circle of enforcing platform preferences.

To be clear, there’s an argument for Amazon’s position, too. Platforms have real interests in account security, fraud prevention, bot detection, and knowing whether an automated system is moving through logged-in user accounts. But that’s only a small part of the story.

The anti-competitive implications here are super-obvious. Perplexity’s stated theory of the case is that Amazon does not like a user tool that routes around Amazon’s preferred shopping and advertising experience. AI agents “don’t have eyeballs” for the ads Amazon “bombards” users with. Even if you think that line is a bit cute, the underlying point is real. Intermediaries often threaten incumbents precisely because they reduce friction, reorder presentation, or weaken monetization levers the incumbent would rather preserve. Search engines did that. Price-comparison tools do that. Browser extensions do that. API clients and integrations do that. AI agents will absolutely do that in a way that the platforms are not yet prepared to deal with.

Stated plainly, the public interest section just isn’t serious here. A court need not become an antitrust tribunal every time someone says “innovation” or “consumer choice.” But this fact pattern is different from the fact pattern in Power Ventures. A court has a duty to at least think about that.

—

The other interesting part of this case is it’s another test of the definition of technological harm after Van Buren.

Knowing that the Power Ventures question was always going to be a tough climb, Perplexity also asked some of the other tough CFAA questions that Van Buren didn’t bother to answer. The order recognizes that Van Buren at least raises a question about whether “loss” should be limited to technological harms, and it notes the Ninth Circuit’s comment in hiQ about Van Buren requiring such harms. Then it basically shrugs and says, in substance, “this is going to be resolved in Amazon’s favor,” without any explanation or analysis of whether that’s the correct outcome.

To me, the technological harm question would be the easiest way to separate Power Ventures from benign or socially useful integrations. A few courts have agreed, but many do not.

And whether I like it or not, the Section 502 piece of the opinion is even more “chalk” than the CFAA ruling. California cases have long treated response and investigatory expenses as cognizable losses under Section 502. This also dates back to Power Ventures and beyond. So if defendants already face an uphill fight arguing that CFAA investigative costs must be tethered to technological harm notwithstanding Van Buren’s “technological harms” language, that argument is harder still under Section 502, where Van Buren is not controlling and the California text is friendlier to verification costs.

Regardless, it is hard to imagine that Power Ventures will survive agentic AI forever. Sooner or later, courts will be forced to acknowledge that people should be allowed to delegate to software tasks that they are legally allowed to do themselves, especially as software gets better and better at doing those tasks. But for now, Power Ventures stays intact. Until courts grapple with the power with what agentic AI actually does, the CFAA will remain what large platforms want it to be. Not just a law against hacking, but a legal cudgel against unwanted interoperability or user preferences.

The real task is for courts to acknowledge that platforms don’t need unchecked authority to kill all forms of automation on their platforms, but should instead distinguish malicious automation from disclosed, user-directed software that functions as the user’s chosen interface. I think we’ll get there eventually, but this opinion makes me think it’ll be some time before we do.

The post When Can Amazon Block an Agentic AI Service?–Amazon v. Perplexity (Guest Blog Post) appeared first on Technology & Marketing Law Blog.

In a prior ruling, the court upheld Twitter’s TOS and sent the case from D. Conn. to N.D. Tex. In my prior post, I wrote: “The relocation of the case from Connecticut to N.D. Tex. only delays the inevitable. This case is doomed due to Section 230, among other reasons.” That denouement has now arrived. The court says simply: “§ 230 clearly bars Taddeo-Waite’s claims against X.”

Decision Not to Remove Third-Party Post. “Taddeo-Waite’s claims concerning X’s decision not to remove the anonymous user’s post neatly fall into the scope of § 230 immunity….X’s decision not to remove the anonymous user’s post treat X as the publisher of another’s information.”

Algorithmic Amplification of Third-Party Post (“But the Algorithms”). “§ 230 immunizes X from suit over its decision not to delete another’s post, and whether Taddeo-Waite notified X of the post’s harmful nature is immaterial to X’s § 230 immunity for that conduct.”

Taddeo-Waite highlighted the algorithmic amplification of the third-party post. No matter, same outcome:

Taddeo-Waite contends that X’s application of its algorithm to the anonymous user’s post constitutes the kind of material contribution to that post that can render X a developer and thus an information content provider…these arguments miss that no matter what amplification Taddeo-Waite alleges, this alleged activity has no bearing on the content of the anonymous user’s post…

Taddeo-Waite does not state facts showing how X’s alleged algorithmic amplification of the anonymous user’s post encouraged or contributed to the post’s message. Instead, he only alleges that X broadcast that message once the user had already composed and uploaded it….courts have consistently found that § 230 immunizes web-based defendants from claims that allege harms caused by content recommendation algorithms…

Taddeo-Waite’s claims that derive from X’s algorithmic amplification of a post merely accuse X of exercising the same editorial judgment a publication wields when it decides which writers’ articles to print on the front page and which to print on the back…

X’s algorithm’s role in establishing that reach does not, without more, state a claim against X that can overcome § 230 immunity

As you can see, this judge completely rejects the algorithmic exceptionalism underlying “but the algorithms” arguments. It shouldn’t matter if editorial decision-making is done manually by humans or if humans encode those values into the machines.

X’s Alleged Suppression of His Posts. Taddeo-Waite complained that his posts weren’t getting his desired visibility even though he was a paid X subscriber. Thus, he frames the claim as a contract breach claim. This doesn’t move the court: “it is immaterial that the duty here was contractual in nature. Section 230 does not provide any immunity exception for breach of contract claims.” While I agree with this statement, the Ninth Circuit’s Calise and YOLO cases plainly reach contrary conclusions. This is another example of lower courts deviating from the Ninth Circuit’s 230/promises absolutism.

Having sidestepped the 230-contract interplay, the rest of the case goes quickly:

courts in the Ninth Circuit have routinely held that the plain text of § 230(c)(1) does not foreclose immunity for claims premised on information the plaintiff himself provides…

The approach that courts in the Ninth Circuit have used is persuasive here….the operative question is whether X, the interactive computer service, provided the information at the heart of Taddeo-Waite’s suppression claims. It did not. Until he terminated his account, Taddeo-Waite was an X user and an X poster, and the posts whose suppression he sues over were his own. Because Taddeo-Waite’s claims concerning X’s post suppression concern information provided by “another information content provider,” and because X meets the other two elements of § 230 immunity, X is immune from these claims.

It is mind-blowing to see a Texas court expressly saying it found the Ninth Circuit persuasive. I thought it was a point of immutable Texan independence to knee-jerk reject everything California does, regardless of merit.

In the end, this claim becomes a routine account termination/content removal claim, and it fails like the many dozens preceding it.

Also, I don’t mean to be callous, but I have little sympathy for anyone who subscribed to Twitter’s premium services post-Musk. If you’re paying for greater status in Musk’s petri dish of racism and authoritarianism, I lean towards Team Caveat Emptor. You get what you get and shouldn’t get upset.

(I miss Twitter of old, but I don’t regret not participating in Musk’s X. Find me on Bluesky).

Case Citation: Taddeo-Waite v. X Corp., 2026 WL 1391897 (N.D. Tex. April 23, 2026). This is a report and recommendation by Magistrate Judge Ray, so it’s pending before supervising Judge O’Connor.

Taddeo-Waite is proceeding pro se. He’s a Democratic candidate for Congress, though I wonder about his odds of success.

The post Section 230 Ends Lawsuit by Twitter Premium Subscriber–Taddeo-Waite v. X appeared first on Technology & Marketing Law Blog.