Privacy/Security Archives - Technology & Marketing Law Blog

More Data on Online Age Authentication Balk Rates

Eric Goldman — Sun, 26 Jul 2026 15:11:16 +0000

Created by ChatGPT May 2026

In a prior post, I surveyed the rates at which consumers do not complete online age authentication processes, what I call the “balk” rate. There is no single canonical balk rate. It varies by destination behind the authentication wall, the method of authentication, demographics, and many other factors.

In my prior post, I mentioned a study from a mostly Carnegie Mellon team. I had seen a summary of the study, but the full study has now been posted. It’s worth digging into the details a little deeper.

Balk Rates by Modality

In the context of trying to complete the academic study, this chart summarizes the study participants’ balk rates by authentication modality:

Note 1: “checkbox” is self-attestation. That’s not credibly considered “authentication.”

Note 2: the email option said the process “analyzes the email’s registration source, associated employer information, and linked financial activities such as mortgages, credit cards, educational records, and consumer behavior patterns.” Though data mining sounds scary, the actual mechanics were vague and required no further effort from the consumer. This rarely will be a realistic option.

If we remove the self-attestation and the incompletely described email review options, consumers balk rates were a minimum of 48%. Study participants were trying to participate in an academic study, not complete a mission-critical life task, but if actual balk rates come anywhere close to 48%, it will completely upend the current Internet.

Efficacy of Balk Rates

The researchers also asked study participants to assess the likely efficacy of the various authentication methods. As you can see, consumers do not regard any of the techniques as particularly effective:

One participant quipped: “Chat gpt provide me an over 18 CA drivers license.”

As a bonus, the researchers said that only 0.86% of the study participants checked the study’s privacy policy. ¯\_(ツ)_/¯

Blog Posts on Segregate-and-Suppress Obligations

The post More Data on Online Age Authentication Balk Rates appeared first on Technology & Marketing Law Blog.

Court Greenlights Jehovah’s Witnesses’ Unmasking of Online Critic–In re DMCA Subpoena to Cloudflare

Eric Goldman — Thu, 23 Jul 2026 16:26:50 +0000

The Jehovah’s Witnesses (the Watch Tower Bible and Tract Society of Pennsylvania) sought to unmask a Doe who uploaded an archive of religious texts, along with some associated linguistic parsing tools, to a website (https://jws-library.one). [That URL now says: “This site has been taken offline out of an abundance of caution while we review relevant matters.”] The Jehovah’s Witnesses submitted a 512(h) subpoena to Cloudflare, which provided cybersecurity (proxy) services to the website. Doe (represented by the EFF) and Cloudflare challenged the subpoena. The court is skeptical of Doe’s fair use defense, rejects the challenge to the subpoena, and greenlights the subpoena.

The Court Ruling

The court addresses Doe’s concerns via the “expectation of privacy” factor for considering subpoenas, which is a little tone deaf because there are other major social considerations at play beyond just privacy. In any case, those expectations of privacy depend on the case’s substantive merits, which in turn depends on copyright fair use. The court isn’t very sympathetic to Doe’s fair use arguments. It summarizes: “With the first and third factors clearly favoring Petitioner, the second factor only somewhat favoring Doe, and the fourth factor favoring Doe, the Court cannot find at this stage that Doe’s archive constitutes a fair use of Petitioner’s works.”

Nature of Use. Doe’s website had no hint of commerciality, and its linguistic tools were transformative. However, the archive was not transformative. The court points out how Google Books only displayed snippets, while the archive displayed full texts, so this was more like Internet Archive’s Free Digital Library. “[W]hile the material in the archive is plainly necessary for Doe’s non-infringing uses of the material, it does not follow that Doe’s publication of the entirety of that material online, separate and apart from Doe’s transformative commentary, is also a transformative use—especially because Doe’s analytic tools have continued functioning after the archive was taken down.”

Nature of Work. “Because the work at issue here is published and contains a mix of factual and expressive content, this factor—if it favors any side here—slightly favors Doe.”

Amount Taken. “the archive’s copying is not proportionate to Doe’s goals….Doe’s critical goals could have been achieved with more tailored disclosure of the works….Doe does not explain why the public disclosure of the full copyrighted work was necessary to retain credibility—Doe could have disclosed only parts of the works they directly compared or critiqued, or disclosed the full works only privately to Doe’s critics rather than the Internet writ-large.”

Market Effect. The Jehovah’s Witnesses “license copies of the materials included in the archive for research use…That is not inconsistent with Petitioner publishing the works free of cost: Petitioner may make the works publicly and freely available to read, but not to copy….the archive could, at least for some, supplant Petitioner’s own websites and archives, by becoming available to Internet users writ-large through search results.” But, the Jehovah’s Witnesses didn’t provide evidence that it charges for its licenses, so the archive may not have an economic impact on it. That tips this factor towards Doe.

In total, the court views the fair use factors as a mixed bag. As a result, the court says that Jehovah’s Witnesses is entitled to the unmasking subpoena because it meets the other qualifications for subpoena issuance, and the fair use defense wasn’t strong enough to flip that.

Implications

I imagine this case will be appealed to the Second Circuit. There are several good appealable angles, including how courts should consider the free speech implications of 512(h) subpoenas and whether the district court should have been more charitable to Doe’s fair use arguments.

The court opinion doesn’t acknowledge the greater context of how religious institutions use copyright law to target and suppress online critics. These scuffles are as old as the commercial Internet. For example, the seminal 1995 RTC v. Netcom case–which established the notice-and-takedown model that turned into the DMCA 512(c)–was a Church of Scientology enforcement action against an online critic. Earlier this year, Prof. Cathay Smith covered another case in this genre (“A Religious Organization is Suing its Critics, and the Weapon of Choice is Copyright—RRT v. Cheryl Bawtinheimer“). Also see my paper with Prof. Silbey on copyright as a memory hole.

Religious institutions are entitled to create and enforce copyrights just like everyone else, but their enforcement practices often look and feel different than most other copyright owners. For example, the opinion noted that the Jehovah’s Witnesses claim to have a licensing program for researcher copying of its materials, but there isn’t evidence that those licenses generate revenue. Instead, the copyright licensing scheme most likely advances non-financial interests–such as the suppression of criticism–that aren’t really what copyright law was designed to do. Indeed, even in this era of extraordinary transparency, some religious institutions still effectively prevent “outsiders” from knowing about–and thus potentially critiquing–their inner workings. Archives of religious texts are a crucial counterbalance to that secrecy and any associated avoidance of accountability. It would have been better if the court had engaged with this broader context, rather than essentially treat this as a routine one-off interaction between a religious institution and an unhappy member.

A reminder that 512(h) is a fast lane to unmask online actors, and it was written without adequate privacy safeguards. In this case, the Jehovah’s Witnesses can potentially impose a range of extrajudicial consequences on Doe once unmasked, such as excommunication. This expanded toolkit of extrajudicial remedies is another way that religious institutions’ copyight enforcements are different than other copyright owners. Troubingly, 512(h) hands them a powerful and dangerous tool for misuse and abuse.

Also, I was confused about Cloudflare’s status as the target of the 512(h) subpoena. The court glosses over the services Cloudflare provides to Doe. Courts have repeatedly said that 512(h) doesn’t apply to IAPs because they don’t host anything. Is Cloudflare more like a host or an IAP in this circumstance? Unless the court explains how Cloudflare qualifies as the website’s host, it would have been helpful for the court to consider the implications of applying 512(h) to website vendors.

Case Citation: In re: DMCA Subpoena to Cloudflare, Inc., 2026 WL 2110881 (S.D.N.Y. July 21, 2026). The CourtListener page.

EXTRA: In re DMCA Subpoena To Reddit, Inc., 2026 WL 1847873 (N.D. Cal. June 26, 2026). In March 2025, a Reddit user with the username u/tiktoktruthseeker posted to the r/FavoritedRanksDrama subreddit a 27-second clip from one of Shafiei’s TikTok livestreams, accompanied by a paragraph of critical commentary. The clip depicts Shafiei speaking directly to the camera, using language such as “Your mom was a bitch” and “When you were in school you got fucked in the ass.” The post, titled “PBA: Weaponizing SA, Homophobia, and Moms for his Angry Rant,” received 42 upvotes.

Shafiei sent Reddit a takedown notice and got a 512(h) unmasking subpoena. Reddit dishonored the takedown notice, taking the position that the post was fair use, and resisted the 512(h) subpoena. Thank you, Reddit, for standing up for your users!

The court agrees with Reddit’s fair use determination:

“Even though the Reddit user included an unaltered clip from Shafiei’s livestream, what matters is that the poster used it to express criticism of Shafiei’s rhetoric. As such, the Reddit user’s posting of the clip is a transformative fair use rather than infringement….where the post is best understood in the context of the video clip it directly criticizes, such use is justified.”
“even if the post includes personal attacks, disparagement, no matter how rude, may still be transformative.” [See my Memory Hole paper for more on the overlaps between copyright and disparagement.]
“the livestreamed video is primarily factual in that it is an informational presentation of Shafiei’s opinions.”
“the use of a 27-second clip from someone who livestreams up to 16 hours per day is quantitatively insignificant.”
“The Reddit user’s commentary within the post directly references statements made by Shafiei in the 27-second clip. Omitting this clip and instead referencing Shafiei’s livestream or providing a link to Shafiei’s account would be insufficient because it would not provide the full context for the user’s commentary.”
“Shafiei’s arguments that the post’s criticism may suppress demand by making TikTok users aware of his behavior is not a cognizable copyright harm.”
“It is also not clear that reproduction of a 27-second clip from a livestream has any value outside of the livestreamed context. The clip does not serve as a substitute for Shafiei’s daily presence on the platform for up to 16 hours at a time.”

Some Other Blog Posts on 512(h)

The post Court Greenlights Jehovah’s Witnesses’ Unmasking of Online Critic–In re DMCA Subpoena to Cloudflare appeared first on Technology & Marketing Law Blog.

Apple Defeats Liability for Not Scanning iCloud Items for CSAM, But the Judge Was Not Pleased–Amy v. Apple

Eric Goldman — Mon, 20 Jul 2026 22:21:19 +0000

This case involves Apple’s handling of user-uploaded files hosted in private iCloud storage. Instead of adopting PhotoDNA to scan hosted files for CSAM, Apple created its own proprietary alternative, NeuralHash, which apparently wasn’t as good. So Apple U-turned on its efforts to scan for CSAM in its cloud storage and encrypts iCloud files.

Apple’s manuevers confused the public and seemed like an embarrassing unforced error for Apple. It also ensured pressure from governments and plaintiffs, including CSAM victims, who preferred Apple’s more interventionist approaches, which Apple had voluntarily demonstrated it was willing to do.

This lawsuit represents a full-scale attack on Apple and Section 230. “Plaintiffs allege that Apple’s failure to implement any known CSAM detection is a design defect because Apple can safely implement readily available features to prevent the spread of known CSAM but has continuously failed to do so.” Prior blog post. The court dismisses the third amended complaint, which tees this case up for the Ninth Circuit, where (as usual) anything could happen.

* * *

The court reiterates that Section 230 applies to the plaintiffs’ claims:

First, Plaintiffs’ claims treat Apple as a publisher or speaker of the CSAM content that animates Plaintiffs’ injuries. Fundamentally, Plaintiffs contend that Apple has elected to permit users to disseminate and share third-party CSAM content when it could have—and, in their view, should have—used readily available technology to prevent the distribution of child pornography depicting the Plaintiffs in this putative class. The duties Plaintiffs seek to invoke “spring[ ] from the defendant’s status as publisher,” and consequently, “immunity applies.” Second, immunity also applies because “the means to avoid liability requires [Apple] to act as a publisher.” As a result, Apple is entitled to complete immunity under § 230.

Citing Doe 1 v. Meta, the court says:

Plaintiffs’ injuries are the direct result of the actions of third parties who used iCloud to share CSAM, a use Apple neither explicitly condones nor prevents (even assuming—as alleged in the TAC—that Apple was aware of the use of iCloud for this purpose)….though Plaintiffs allege that Apple knew that its tools were likely to be used to distribute child pornography (as confirmed by the internal Apple text messages at the center of this case), under the current state of the law, Apple is still entitled to immunity under § 230—irrespective of that general knowledge….

Plaintiffs cannot avoid the fact that a tool that detects CSAM must review CSAM to make such a determination. And while Apple could have taken steps to do so—as its competitors have done by using PhotoDNA—Grindr confirms that § 230 bars claims arising from the design decisions Apple could have taken where those claims relate to Apple’s role facilitating the communication and content of others

(A reminder that the defendant’s scienter is irrelevant to Section 230).

The plaintiffs tried to fit into the new Section 230 exceptions created in Doe v. Twitter, but the court rebuffs the move:

This case does not concern or even discuss Apple’s content reporting systems; it concerns Apple’s “failure to implement industry-standard safeguards” against the dissemination of CSAM. Though reporting systems and CSAM safeguards may both be described as “defects,” the latter requires the Court to treat Apple as a publisher. Twitter “could fulfill its purported duty to cure reporting infrastructure deficiencies without monitoring, removing, or in any way engaging with third-party content”; Apple cannot fulfill a duty to institute CSAM safeguards without deploying a tool like NeuralHash or PhotoDNA. Both NeuralHash and PhotoDNA were built to monitor and report violative images uploaded to company servers. Yet just the decision regarding whether to deploy either tool is a choice related to content moderation.

Also, Apple didn’t fail to satisfy any duty to report items to NCMEC if it never identified CSAM in the first place.

The Lemmon v. Snap workaround fails: “all of Plaintiffs’ claims here are inexorably linked to third-party content; Plaintiffs do not allege that Apple created content like a Snapchat filter that caused them harm.” The Roommates.com workaround also fails: “Plaintiffs do not allege that Apple modified or augmented the CSAM on its servers in any way.”

* * *

The case reaches its inevitable denouement of a win for Apple. However, Judge Wise remains troubled about its implications. She expresses her uneasiness in stronger-than-normal terms:

As it stands, nothing in the law prevents any company, including Apple, from utilizing available technology or creating new technology to identify and report child pornography stored and distributed on their traditional servers or through their cloud services. Conversely, there is no law that obligates companies to proactively do so. Undoubtedly any such legislation would come at a cost of at least some loss of privacy for millions of people. But if lawmakers expected that companies would take steps to prevent their products from being used for storing and distributing child pornography based on something short of a legal imperative, this case, like many others before it, demonstrates the inadequacy of that approach. If lawmakers want to ensure that Apple and other companies address their role in the dissemination of CSAM, they must require it under the law. In other words, lawmakers can fix this problem that is contributing to the exploitation of children.

She goes through this framing pretty quickly, but we should slow it down. The “loss of privacy for millions of people” she briefly references deserves a little more care. The opinion downplays the encryption angle; it mentions encryption only twice, as if it’s an afterthought. However, encryption is the critical attribute underlying Apple’s moves. Apple was seeking to respect that what’s on people’s hard drives should remain their business, even if they choose to store some of it in the cloud. Forcing Apple to scan private files intended for iCloud storage creates a new and dangerous threat vector for bad actors, including governments seeking to control constituent behavior.

So yes, the “privacy loss” Judge Wise mentions indeed would be a major cost to everyone. Respecting the privacy of people’s files isn’t just some nice-to-have feature; it is one of the core planks of a technology architecture that keeps people safer.

Judge Wise continues:

This Order does not turn on whether Apple’s decisions contributed to Plaintiffs’ injuries. All Plaintiffs’ claims are founded on Apple serving as a publisher of third-party content. It is that role as “publisher” that is dispositive on the issue of immunity. This does not mean that the existence of images and videos of the putative class members being sexually abused—content that they allege is regularly stored and disseminated on iCloud—has not caused Plaintiffs real and lasting harm…

the outcome also adds credence to claims that the Ninth Circuit “has expanded § 230(c)’s scope to provide functional immunity to internet companies, even when they are aware (or should be aware) of unlawful content on their websites.” The practical outcome is that the current state of the law prioritizes privacy—a laudable and critically important value given that in our modern world nearly all our most personal and intimate data (including financial and health records) are stored and transmitted online. But the law should not ignore how those who create, view, and distribute child pornography leverage privacy protections to avoid detection by law enforcement. In the current legal framework, there is no protection for members of the putative class—individuals who as children were photographed and filmed while being abused in the vilest ways imaginable, and who now are repeatedly victimized each time the intimate and tortured images of their trauma are distributed to others. Those children are the collateral damage of our ineffective legal landscape. They deserve better.

Judge Wise isn’t well-situated to compare the relative strengths and limitations of the full range of potential anti-CSAM options, but a leading tool has always been and remains the government’s efforts to find and prosecute the creators, disseminators, and downloaders of CSAM. (Do you recall the federal government’s choices that leave children more vulnerable?) Making sure the government is doing what it can should be the #1 priority.

Case Citation: Amy v. Apple Inc., 2026 WL 2031817 (N.D. Cal. July 13, 2026). The complaint.

The post Apple Defeats Liability for Not Scanning iCloud Items for CSAM, But the Judge Was Not Pleased–Amy v. Apple appeared first on Technology & Marketing Law Blog.

How Often Do Consumers Balk at Doing Online Age Authentication?

Eric Goldman — Tue, 26 May 2026 18:00:22 +0000

In search engine parlance, the “bounce” rate is the percent of searchers who click on a search results link and then immediately hit the back button. High bounce rates usually signal that something has gone wrong. Either the destination website didn’t appeal to the user enough to convert them to engage more, or the search result wasn’t what the consumer was looking for (or both).

Created by ChatGPT May 2026

I’m going to analogize bounce rates to the rate that consumers fail to overcome age authentication walls, which I’ll call the “balk rate.” (We could more granularly distinguish between voluntary refusals and technical inability, but the outcome is the same either way). There is no single standard or expected balk rate for age authentication walls. Instead, a service’s balk rate likely varies based on factors such as:

the nature of the destination. How critical is it that the consumer overcome the wall? For example, there will be a lower balk rate for access to an essential government service than a site that consumers consider non-essential. A related issue is how long the consumer anticipates the relationship will run. Consumers who expect a one-off interaction are more likely to balk than a consumer planning to make a long-term commitment.
the availability of competitive alternatives that have less onerous age authentication procedures. For example, pornography consumers can easily find online alternatives that don’t require age authentication (at least for now), so those consumers are more likely to balk when they encounter an age authentication wall.
the nature of the authentication process.
- how many steps are involved in the process? Each additional step in the authentication process will increase the overall balk rate.
- relatedly, how much time does the process take? Consumers are impatient.
- what disclosures must the consumer make to overcome the wall? The more sensitive the disclosure, the higher the balk rate. Most age authentication processes that achieve decent accuracy levels necessarily rely on the disclosure of sensitive consumer information (such as government IDs or face scans) that will produce a lot of balks, but there still may be balk rate differences between them.
- how much trust do consumers have in the authenticator? Trust is also a proxy for consumer concerns about privacy and security.

There are likely other considerations I didn’t capture here. I welcome your suggestions.

In this post, I’ll highlight three data points about balk rates. (If you know of other published data on this topic, please email me).

Pornhub’s Experiences

Pornhub has shared some data about its balk rates. In Louisiana, Pornhub says its traffic dropped 80% in Louisiana when it implemented an age authentication wall. Elsewhere, Porhub has said that “over 99% of users subjected to a verification requirement did not verify their age.”

Going back through the factors I identify above, you can see why these numbers might be so high. Pornography services have competitive alternatives that aren’t age-authenticated, and there are high privacy and security risks to pornography consumers.

The high balk rates also explain why Pornhub opted-out of states that have imposed age authentication mandates. If it’s going to lose 99% of those consumers due to the mandate, it’s already out of the market either way, so officially withdrawing from the market has no real opportunity cost.

An EU Study

In 2022, the EU did a comprehensive study of age authentication balk rates in the “Pilot Execution Report – first large scale euCONSENT pilot“. The study assigned EU consumers three authentication “missions” to complete and then studied consumers’ mission completion rates.

The missions differed depending on the age and status of the user, so it’s pretty hard to draw any definitive conclusions. Most importantly, the study doesn’t reveal the completion rate of the first mission, which was to do the initial age authentication. To me, this seemed like the most essential datapoint, but the report didn’t mention it. The second mission was to navigate to another site without reauthenticating. That had about an 80% completion rate. The third mission was to jump through a more rigorous authentication hoop. Only about 63% of the group who completed the first mission were able to complete that third mission.

There was a follow-on study (“Pilot Execution Report – third euCONSENT“) with more missions. Collectively, some of the data points that stood out to me:

12% of adults and 21% of parents failed to complete the authentication and reauthentication process; and 22% of parents failed to complete the parental authorization process.
85% of consumers said they wouldn’t wait more than 5 minutes to do an authentication process, even if that was a one-time process for a permanent web-wide authentication.
If given the choice, 68% of consumers preferred face scans, 15% preferred document scanning, and only 3% preferred credit card authentication (which, as I mention in my Segregate-and-Suppress paper, isn’t considered to be a credible authentication nethod).
21% of the study participants reported a technical problem trying to do the authentication.
With respect to trying to buy alcohol online, 22% said they would do something other than complete the online age authentication.

I’ve been through these studies a few times, and each time I was confused by the methodology and results. The reports left open obvious questions, may be specific to the EU’s consent process, and may be outdated based on developments in the past 4 years. And yet, these reports make it clear that there will be tens of millions of EU consumers who will fail to navigate (or would prefer not to navigate) the authentication systems the EU is putting in place.

The Carnegie Mellon Study

A Carnegie Mellon research team (plus one Princeton researcher) posted a preview of an experiment on age authentication balk rates. The study is called “Measuring User Responses to Online Age Verification Mechanisms Through A Deceptive Experiment.” The researchers solicited participants to watch R-rated video clips. However, before the survey takers could watch the clips, the researchers said they had to navigate an age authentication barrier to see how they reacted. The survey indicates the following balk rates:

checkbox self-attestation: 1% balk rate (i.e., 99% completion rate). This option is meaningless because I don’t believe any regulators consider self-attestation a permissible method of age authentication.
“Email-based estimation”: 14% balk rate.
“AI facial estimation”: 49% balk rate.
government-ID methods: 73-77% balk rate (the variation depended on assurances about privacy and security).

The researchers conclude: “technically robust verification methods may be ineffective in practice if users systematically decline to comply.”

Two observations of mine:

Consistent with the EU report showing consumers prefer face scans over document ID reviews, the balk rate was noticeably lower for face scans than government-issued IDs (though both balk rates were high). As face scans roll out across the Internet, I wonder if consumers are becoming desensitized to doing face scans and increasingly view them as an inevitable and standard price of admission?
The preview doesn’t mention what motivations participants had to complete the process. For example, were they promised any compensation? If the only motivation for navigating the authentication wall was altruism (i.e., to support the research), then we should expect much higher balk rates than we would find in the field, when users are trying to achieve their self-directed objectives.

Implications

The Carnegie Mellon paper references the constitutional principle of tailoring, i.e., how likely is the law to achieve its desired outcome? Higher balk rates are a sign that an age authentication mandate isn’t appropriately tailored because it’s suppressing constitutionally protected conversations. However, there is no numerical cap on balk rates before an age authentication mandate becomes constitutionally impermissible. Instead, in the Free Speech Coalition v. Paxton decision, the majority opinion said “adults have no First Amendment right to avoid age verification.” That implies that the court may not care about balk rates at all.

Age authentication mandates always shrink the Internet, and balk rates are one way of measuring the shrinkage. Every time an adult fails to navigate an age authentication process (whether by choice or due to technical challenges), that’s another lost customer for the authenticating service. If the Carnegie Mellon study accurately predicts field behavior, face scans or document reviews will cost the authenticating services half of their customers or more. Such high balk rates would collapse the Internet ecosystem, because there won’t be enough authenticating customers for services to operate profitably. Even a 10-20% balk rate will have major consequences for many services that are already operating on razor-thin margins, such as content publishers who have already seen their ad revenues shrink over time. These Internet shrinkages have significantly economic and social consequences for all of us, yet regulators routinely ignore these issues completely when clamoring for more age authentication manates.

To reduce balk rates, governments around the globe are trying to build an infrastructure to reduce the friction of age authentication. Less friction addresses one problem (the balk rate) and creates a host of other problems.

The EU plans to rely on widespread adoption of digital IDs combined with an API wrapper that exposes only age authentication information to services around the Internet. Digital IDs raise a host of privacy and security concerns. They are also the foundational infrastructure for comprehensive government monitoring and control of constituent movements online. I’m also unclear how the EU plans to address the fact that tens of millions of EU residents won’t have digital IDs for the foreseeable future.

Alternatively, some governments are trying to force one-time age authentications when a user acquires a device or first logs into an app store. By moving the age authentication process forward to a central point (the device or the app store), the user avoids doing repetitive authentications downstream. However, that assumes the user can or wants to complete the authentication in the first place; anyone blocked at the beginning is stuck. The high-value authentication data also will act as attractive centralized honeypots for malefactors. Also, this approach normalizes age authentication and will make it seem routine for interactions that today don’t require age authentication. It will likely shift the default about when we need to age-authenticate. Today, we can enter websites or use apps without presenting credentials, just as we do in most physical spaces; in the future, that presumption will be reversed. Finally, whoever is doing the centralized authentication won’t do it for free. A small number of entities are poised to extract monopoly rents by taking a cut of this government mandated process.

* * *

Blog Posts on Segregate-and-Suppress Obligations

The post How Often Do Consumers Balk at Doing Online Age Authentication? appeared first on Technology & Marketing Law Blog.

Court Rejects Lawsuit Over Online Criticisms of a Dater–D’Ambrosio v. Meta

Eric Goldman — Sat, 16 May 2026 16:39:26 +0000

Abbigail Rajala posted a critical review of her dating experience with Nikko D’Ambrosio on the Chicago subboard of Facebook’s Spill the Tea group. According to the district court, D’Ambrosio “sued anyone remotely associated with those posts for all possible, imaginable claims, including the woman who dated him and her parents, women commenting on posts, the operators of the Facebook group, and Facebook itself.” The district court dismissed his case. The Seventh Circuit affirms, says parts of the appeal may be sanctionably “frivolous,” and calls out the plaintiff lawyers’ misuse of Generative AI.

Illinois Right of Publicity Act

“D’Ambrosio’s IRPA claims fail because he has not sufficiently alleged that any defendant used his likeness for a commercial purpose.”

With respect to Facebook:

A free-floating profit motive is not enough…Meta did not have a commercial purpose in terms of the IRPA merely because it displayed advertisements for products or services unrelated to the posts on the same page with them.

Doxing Act

This is the Seventh Circuit’s first review of Illinois’ recently enacted Doxing Act. It says there are six elements to the claim:

(1) intentional publication of personally identifiable information; (2) the published information identifies a person without reliance on extrinsic sources; (3) lack of consent to the publication; (4) intent to harm or harass; (5) knowledge or reckless disregard of a reasonable likelihood of death, bodily injury, or stalking to the person whose information is published; and (6) one or more of the listed harms results.

The panel says D’Ambrosio didn’t sufficiently allege Rajala’s scienter about placing him in reasonable fear of death, bodily injury, or stalking:

D’Ambrosio never alleged that he was actually stalked or subjected to bodily injury, nor that anyone attempted to do so. D’Ambrosio identified no past incidents of physical harm or stalking directed against men discussed in the Group. The Group’s rules prohibit sharing screenshots with other people, and its administrators warn users about the risks of confronting men they personally know whom they see posted on it. The allegation that Ms. Rajala made “100,000 unidentified women” become aware of his conduct does not, without more, support an inference that she recklessly disregarded a reasonable likelihood that one of those women would physically harm D’Ambrosio or stalk him. Recall that the purpose of this online group was to help women identify men to avoid.

With respect to the Spill the Tea group operators:

D’Ambrosio’s allegations reasonably support an inference that the STT defendants recklessly encourage users to post sensational content regardless of its potentially tortious nature and that they take measures to prevent the subjects of such posts from becoming aware of their existence and to assist users in avoiding legal responsibility when they cross the line. Notwithstanding efforts to prevent information posted on the Group (and the others nationwide) from leaving the platform, nothing can really stop allegations of anything from rudeness to serious felonies from spreading elsewhere…We find no allegations in this case, however, from which we could reasonably infer that the STT defendants knew of or recklessly disregarded a risk to D’Ambrosio of death, bodily injury, or stalking.

The panel has several (unfair IMO) criticisms fordater accountability boards like Spill the Tea. I wonder if those criticisms could be correlated with the fact that all three judges on the panel were old white men who never navigated the dating world as millennial women?

Though the court rejects this doxing claim, I continue to be extremely nervous about the chilling effects of anti-doxxing statutes. A “reckless disregard” standard gives plaintiffs a lot of room to manufacture controversy out of standard online chatter. Given that thin-skinned individuals–even the US government–take unjustified views of what constitutes doxxing, anti-doxxing statutes are well-positioned to become SLAPP factories.

Defamation

The allegedly defamatory post referenced someone else, not D’Ambrosio, and there was no reason for anyone to believe the post equated the two people. D’Ambrosio also doesn’t make a sufficient showing of reputational damage. As a result, the court says it doesn’t need to address Section 230 because the claim fails for lack of merit. Sidestepping Section 230 is probably for the best in light of the Seventh Circuit’s penchant for overcomplicating its Section 230 analysis.

Sanctions

The panel says “This is a relatively rare appeal in which sanctions appear to be appropriate [because] This appeal was entirely frivolous at least as to each of the Rajalas.” D’Ambrosio sued Rajala’s parents. “Outside of the statement of the case, the Rajalas were mentioned only once in D’Ambrosio’s opening brief.” As for Rajala, the doxxing claim “is replete with fictitious quotations and misstatements of law, matter that cannot form the basis of a non-frivolous appeal.” (More on the hallucinations in a moment). The defamation and false light claims are also unsupportable. The court orders the plaintiff’s lawyers to show cause regarding sanctions.

Misuse of Generative AI

The court says the plaintiffs’ filings, made by lawyers from Trent Law Firm PC, “bear the hallmarks of the misuse of generative artificial intelligence.” The court even notes the firm’s website “boasts of the firm’s extensive incorporation of artificial intelligence into all areas of its representation.” The court refers the matter (plus the frivolous claims) over the Illinois State Bar, but it doesn’t independently sanction any Generative AI misuse. Instead, it makes a short but grandiose statement against Generative AI misuse.

As I’ve mentioned before, I’m increasingly seeing Generative AI misuse in cases where the lawyers display other violations of attorney professionalism, such as the frivolous claims in this case. Maybe the court decided to address the frivolous claims (which appeals courts routinely overlook, at least in terms of sanctions) more aggressively as a backdoor way of redressing their concerns about the Generative AI misuse.

Parting Thoughts

Nikko D’Ambrosio is a multi-time loser: he didn’t seem to be a very good boyfriend, he’s not a good citizen (he committed tax violations), and he’s not a good plaintiff. On the plus side, he did find one perfect match: he found lawyers just as dedicated as he was to Streisand Effect-ing their way to, um, stardom.

Case Citation: D’Ambrosio v. Meta Platforms, Inc., 2026 WL 1361951 (7th Cir. May 15, 2026).

If you have the stomach for it, try to read Trent’s “David v. Goliath” blog post from 2025 about this case. The post has zingers like: “We have a great team—project managers, everything related to AI now. Even Meta can’t beat us.” In retrospect, about that…

The post Court Rejects Lawsuit Over Online Criticisms of a Dater–D’Ambrosio v. Meta appeared first on Technology & Marketing Law Blog.

Section 230’s Application to Account Terminations, CSAM, and More

Eric Goldman — Thu, 19 Mar 2026 15:22:14 +0000

The Section 230 cases keep coming faster than I can blog them (the first 3 hit my alerts in a single day).

Weiss v. Google LLC, 2026 WL 733788 (Cal. App. Ct. March 16, 2026)

Weiss’ business started running financial services ads on Google in 2015. Google suspended the ads multiple times, until Google issued a final suspension in 2024. The court says Section 230 protects Google’s suspension decisions.

The court starts with standard context-setting: “California’s appellate courts and federal courts have also generally interpreted section 230 to confer broad immunity on interactive computer services.”

The court continues:

Weiss seeks to adjudicate Google’s characterization of his business and its decision to suspend its ads. However, this conduct, i.e., Google’s “refusal to allow certain content on its platform,” is “typical publisher conduct protected by section 230” regardless of the reason for that refusal….

even if Google’s characterization of Weiss’s advertisements does not align with Weiss’s characterization, section 230 still affords Google immunity from liability for its decision to suspend his content…

all the content Weiss claims Google wrongfully suspended was admittedly created by Weiss, not Google…

Google’s determination that Weiss’s ads violated its general policies is not equivalent to contributing to the ads’ content.

In a footnote, the court adds: “Weiss seeks to hold Google liable for its enforcement of its own general policies, rather than a breach of a specific promise.”

When the dust settles, this becomes just another failed lawsuit over account terminations and content removals.

A reminder of the content moderation dilemma Google faces here. A few courts have said that Facebook doesn’t qualify for Section 230 protection for running scammy ads (e.g., Forrest v. Facebook). As a result, Google has good reason to suspend Weiss’ ads to manage its own liability exposure. At the same time, if Weiss succeeded with his claims here, then Google would have been potentially liable for removing ads based on Google’s fears that they are scammy. This would force Google to deploy a Goldilocks version of content moderation: Google would have to get its ad removal policy “just right,” with potential liability for mistakes in either direction. An impossible challenge.

Thompson v. The Meet Group, 2026 WL 730134 (E.D. Pa. March 16, 2026)

Thompson said Tagged deactivated his livestreaming account and stole $10k from him.

For reasons that aren’t obvious to me, Tagged defended on Section 230(c)(2)(A) grounds instead of 230(c)(1). Maybe this has something to do with trying to navigate around the abysmal Anderson v. TikTok case? EDPa courts are bound by that decision.

The court says Tagged can’t establish the 230(c)(2)(A) defense elements on a motion to dismiss: “application of CDA immunity in this case requires assessment of facts that are not in the pleadings—such as the reason why Thompson’s account was disabled and the content of Thompson’s posts.” Also, Thompson’s allegations of theft might defeat 230(c)(2)(A)’s good faith prerequisite. Cites to Smith v. TRUSTe and e-ventures v. Google.

No matter, the case fails anyway. (Another example of Section 230 not being the only reason why lawsuits lose). The court says the plaintiff had no property interest in his social media account that could be converted (cite to Eagle v. Morgan). The plaintiff’s TOS breach claim fails multiple ways, including the TOS’s reservation of termination rights and damages waiver.

So this becomes yet another failed lawsuit over account terminations, just not due to Section 230. You already know this, but if you’re a defendant in these cases, you should be focusing on 230(c)(1), not 230(c)(2)(A).

Gehringer v. Ancestry.com Operations Inc., 2026 WL 734526 (N.D. Cal. March 16, 2026)

Plaintiffs are individuals who have not subscribed to the Ancestry.com service and have not consented to the use of their name or photograph. They allege Ancestry not only includes their yearbook information on a searchable database, but also utilizes their likenesses as part of advertisements for Ancestry.com services…

Plaintiffs contend Ancestry used their likeness in three forms of “advertising”: 1) publication of the yearbook information on a database that contains a paywall for certain features; 2) dissemination of emails to potential Ancestry.com subscribers, noting Ancestry Hints® can expand their family tree, and using the names and images of Plaintiffs as examples; and 3) an Ancestry free trial program that allows potential subscribers to access Plaintiffs’ yearbook information for a limited time.

The court nixes claims over category #1 and #3 ads due to copyright preemption.

As for the category #2 ads:

Plaintiffs allege Ancestry crafted email advertisements that included their likenesses to encourage potential customers to subscribe to Ancestry’s service. The email advertisements were not created by a third-party user of Ancestry.com—Ancestry authored the content, and as such, it is “responsible, in whole or in part, for the creation” of that offending content. To avoid this conclusion, Ancestry attempts to recast the allegations in the First Amended Complaint, asserting Ancestry merely “republish[es] yearbook photos taken and first published by Esperanza High School.” But as the screenshots in the Complaint confirm, the emails sent by Ancestry to prospective users include far more than republished images of Plaintiffs; they incorporate those images into an advertisement for the Ancestry Hints® functionality and Ancestry’s subscription service. Drawing all inferences in Plaintiffs’ favor, Section 230 does not immunize Ancestry against liability for the content of the alleged email advertisements

Notice that Ancestry’s ad creation practices go further than Facebook’s sponsored stories, which also didn’t qualify for Section 230 protection.

State v. Sharak, 2026 WI 4 (Wis. Supreme Ct. Feb. 24, 2026)

Google scanned Sharak’s Google Photo uploads, identified what it thought was CSAM, and submitted a CyberTip. Sharak argued that Google was conducting the search on the state’s behalf. The court disagrees and upholds Sharak’s conviction.

That isn’t unusual. What’s more unusual is the court’s discussion of Section 230. “Rauch Sharak argues that [Section 230(c)(2)’s safe harbor] encourages ESPs to scan for CSAM by granting immunity to ESPs that moderate content and creating civil and criminal liability if ESPs do not scan for CSAM.”

The court responds:

Though § 230(c) may grant immunity to ESPs that choose to scan for CSAM, it does not require, reward, or incentivize scanning for CSAM in the first place. Moreover, § 230(c)(2)(A) grants immunity for “any action voluntarily taken in good faith to restrict access to” obscene material, which sweeps far more broadly than would be required to induce Google’s CSAM scan at issue here….

Even if the statutes encourage Google to scan for CSAM or provide a law-enforcement purpose, Rauch Sharak has not shown that they are enough to turn Google into an instrument or agent of the government.

Alice Rosenblum v. Passes Inc., 2026 WL 711837 (C.D. Cal. Feb. 3, 2026)

[The fact allegations are based on the court’s summary of the complaint.] Passes is a competitor to OnlyFans. Unlike its rivals, Passes allows 15-17 year olds to create accounts with parental consent. Guo is the CEO, and Celestin is a content acquisition specialist. At Guo’s direction, Celestin personally reached out to 17-year-old Alice Rosenblum to create a Passes account. Celestin did a photoshoot of Rosenblum and (with Guo’s help) created a Passes account for her without requiring parental consent.

“Over the next month, while Plaintiff was still 17 years old, Celestin and Ginoza [another Passes employee] allegedly directed Plaintiff to create sexually explicit images and videos of herself….the FAC provides over 14 examples of child sexual abuse material (“CSAM”) involving Plaintiff, being marketed on the Passes platform for $69 to $4,000. Furthermore, Passes agents posing as Plaintiff allegedly communicated via direct message to “big spenders” to continue to market and sell CSAM involving Plaintiff.”

The court rejects Passes’ and Guo’s Section 230 defense:

Section 230 immunity plainly does not apply to Plaintiff’s claims. To be sure, Plaintiff does largely seek to hold Passes Defendants liable as providers of an interactive computer service, and several allegations treat Passes as a publisher, as they involve Passes’ distribution of CSAM involving Plaintiff…Plaintiff alleges that Passes and its agents were directly responsible for the creation and portrayal of the CSAM on the Passes platform: Plaintiff alleges that Celestin, acting as an agent of Passes, personally took at least one photo of Plaintiff which was uploaded to Passes, and further instructed her to create specific photographs and videos and upload them to Passes, which he later marketed under specific captions and sold. Plaintiff further alleges that Passes itself hosted a banner featuring a sexually explicit photo of Plaintiff, which marketed CSAM involving Plaintiff. Plaintiff therefore seeks to hold Passes liable for harm allegedly arising out of its own creation of harmful content.

Passes claimed that Celestin and Ginoza were third parties, but “As alleged, Celestin was
not merely another third-party user of Passes; rather, he acted as an agent and employee of Passes.” Cite to Quinteros.

The court summarizes:

Section 230 immunity does not apply to Passes, a platform which has allegedly, through its agents, deliberately created, marketed, and sold illegal content, acting as an “information content provider” that uses its own “interactive computer service.”

In a footnote, the court adds regarding Guo: “Plaintiff’s allegation that Guo encouraged Plaintiff over the phone to post content, which supports Plaintiff’s claims for IIED and California Civil Code § 52.5, does not hold Guo accountable for Passes’ publishing activity.”

Doe v. X Corp., 2026 WL 772384 (N.D. Tex. Feb. 25, 2026)

“A third party copied commercial pornographic content from Plaintiff’s OnlyFans and studio-based productions and uploaded it to X without his consent, violating the OnlyFans terms and conditions and the studios’ licensing agreements.” He sued pursuant to 15 U.S.C. § 6851(b)(1)(A), a private right of action for nonconsensual production of intimate visual imagery. Doe produced the porn consensually, but he claims the restrictions extended to nonconsensual distribution.

The court says X qualifies for Section 230. Doe responded that he owned the IP in the works, so the IP exception applies. The court says:

The [IP] exception applies only when the claims arise from a law directly implicating intellectual property rights, not merely when intellectual property is involved in the claim. And the statute under which Plaintiff sues—§ 6851—is not an intellectual property law. Rather, it is concerned with “whether the depicted individual consented to a specific disclosure of an intimate visual depiction—regardless who holds the copyright to the image.” Thus, § 6851 creates a privacy-based tort right of action, not an intellectual-property based one.

The boundary between privacy and IP laws remains amorphous–increasingly so with all of the concerns about “deepfakes,” “virtual replicas,” and other AI-related regulations that use privacy framing to create what look like sui generis IP rights. This could be a good student paper topic.

For more discussion of the IP exception to Section 230, see this article.

Teague v. Google, 2026 WL 746996 (D. S.D. March 17, 2026)

Plaintiff claims Google committed defamation based upon the fact that “people think I raped [redacted]. This case (sic) been dismissed in 2021 but it still show (sic) on Google and caused me to (sic) threaten and attacked a few times.” Plaintiff further claims his image is on Google and it is difficult to get a job because the rape charges still appear on Google.”…

Google is not a “publisher or speaker” under the CDA and therefore “cannot be liable under any state-law theory to the persons harmed by the allegedly defamatory material.”

Google is immune from suit for defamation claims arising out of other content providers’ posts on the internet.

The post Section 230’s Application to Account Terminations, CSAM, and More appeared first on Technology & Marketing Law Blog.

Photobucket’s Attempted TOS Amendment Mostly Fails–Pierce v. Photobucket

Eric Goldman — Sat, 14 Mar 2026 16:54:18 +0000

Photobucket is a venerable photo hosting service whose best days are far behind it. In 2017, its management imploded the service by imposing above-market hosting fees. Most users stopped using Photobucket, but Photobucket kept their photos.

In 2024, Photobucket emailed its legacy users, asking if they wanted Photobucket to keep or delete their accounts. Users who clicked on the email’s links–included to delete their accounts–were presented with a new TOS formation process that included a consent to use the photos to derive users’ biometric information for AI purposes. “If users did not opt out of the Biometric Policy within 45 days of July 22, 2024, Photobucket claims the right to sell, lease, trade, or otherwise profit from the users’ biometric information.” (Photobucket claims it hasn’t actually pursued this AI option). The new TOS also contained an arbitration provision that wasn’t in some prior TOS versions. Photobucket invokes the arbitration clause against the plaintiffs’ lawsuit.

Article III Standing. The court says the plaintiffs only have Article III standing for equitable relief, not damages. This narrows the case substantially.

Pierce

Pierce agreed to Photobucket’s 2008 TOS and last logged into Photobucket in 2014. The 2008 TOS informed Pierce that his “continued use” of Photobucket would constitute acceptance to any TOS modifications. Since he didn’t use the site after 2014, he didn’t assent-by-use to the 2024 TOS:

a reasonable person would not understand his failure to take his photos off of Photobucket, after not logging in for nearly ten years, to constitute “continued use” and thus acceptance of any revised terms.

In other words, a user’s maintenance of a legacy account isn’t “continued use” of the service.

Ms. Hughes

Ms. Hughes agreed to Photobucket’s 2006 TOS and last logged into Photobucket no later than 2011. The 2006 TOS said:

By using the Services you agree to the Terms of Service set forth below as they may be updated from time to time by Photobucket.com, Inc. (“Photobucket.com”). Photobucket.com may modify or terminate the Services from time to time, for any reason, and without notice, including the right to terminate with or without notice, without liability to you, any other user or any third party, provided that when Photobucket.com does so, it will update these Terms of Service. You are advised to periodically check the website for changes in the Terms of Service.

The court says this TOS “told Ms. Hughes that she was “advised to periodically check the website for changes in the Terms of Service.” The 2006 Terms “necessarily inform[ ] how a reasonably prudent user would interact” with Photobucket’s website.”

But…the TOS applicable to Pierce said “It is therefore important that you review this Agreement regularly to ensure you are updated as to any changes.” The court disregarded that language for Pierce. Can you find a difference between the disclosures to Pierce and Hughes? Beyond the (seemingly immaterial) language differences, the court’s different conclusions might be explained by (1) Pierce was governed by Colorado law, Hughes by CA law; or (2) Hughes admitted getting emails telling her about the coming changes, though she didn’t pay attention to them. I don’t find those distinctions persuasive, so I can’t meaningfully distinguish Pierce’s situation from Ms. Hughes’.

The court says Hughes is bound to the 2024 TOS:

the 2006 Terms told Ms. Hughes that she had an obligation to periodically check Photobucket’s website for updates to the Terms. The 2024 Terms and arbitration provision constitute an update to the Terms that Ms. Hughes had an obligation to stay apprised of. Ms. Hughes assented to the 2024 Terms because they informed her that failure to opt out within 45 days of the effective date would constitute acceptance, and Ms. Hughes did not opt out

Whoa. The court is saying that even though Hughes functionally abandoned Photobucket in 2011, a “reasonably prudent user” would have kept checking Photobucket’s TOS 13 years later just in case the terms had changed. Wild.

Because Ms. Hughes “agreed” to the 2024 TOS, she also “agreed” to its jury trial waiver.

However, the arbitration clause excludes IP claims. The plaintiffs alleged 1202(b) claims, which the court says are IP claims and thus not covered by the arbitration provision. This claim stays in court.

Cumming

The parties can’t agree when Cumming created her Photobucket account or when she last used it, but everyone agrees that she agreed to the 2013 TOS and didn’t use the site later than 2013. That TOS version said “so long as you’ve used the Site after the change, regardless of any separate notice, you agree to the current posted version of the Terms.” Similar to the court’s discussion of Pierce, the court says “a reasonable person in Ms. Cumming’s position would not understand her failure to take photos off of Photobucket to mean that she “used” Photobucket after 2010 or 2013 and thus assented to the 2024 Terms.”

Mr. Hughes

He didn’t have a Photobucket account, but Ms. Hughes uploaded photos of him. The court says he’s not a third-party beneficiary of any TOS and not bound by the arbitration clause.

Court Stay

The court stays the litigation until after the arbitration, even though the court held that 3 of the 4 named plaintiffs were not bound by the arbitration and the fourth plaintiff had a claim not subject to arbitration. Because the court will not be bound by the arbitrator’s decisions for the non-arbitrated plaintiffs and claims, I didn’t understand why the court held everything else up. A slightly lucky break for Photobucket, because it avoids the cost of defending the litigation and arbitration simultaneously.

Implications

Here’s where things stand when the dust settled:

damages are out of the case
part of one plaintiff’s case is sent to arbitration
when that’s complete, the court will address the remainder of that plaintiff’s case plus the other three plaintiffs’ cases

A messy outcome…perhaps messy enough to motivate the parties to settle? Without the availability of damages, this case became less interesting to the plaintiffs. Alternatively, I could also see the plaintiffs appealing this ruling.

Though Photobucket nominally got the outcome it wanted (the case sent to arbitration), it does not come out of this ruling looking very good. Some of the lowlights:

its inital TOS amendment provisions sucked. It had various versions of “you need to come back to the site to check for possibly amended terms,” which has rarely fared well in court. Frankly, it’s shocking to see the judge find this “keep checking the TOS 13 years later” provision worked against Ms. Hughes. I don’t think that’s what a reasonable consumer would do. (As usual, the court cited no empirical basis for its assessment of what a reasonable consumer would do or think).
the fact that Photobucket’s TOS amendment language kept changing over time. The language differences ensure more litigation work when it’s challenged.
the fact that Photobucket kept changing its governing law clause. Another decision that increased its defense costs and the risk of inconsistent outcomes.
the fact that Photobucket couldn’t definitively establish the dates of the users’ account creation or usage.
its 2017 implosion. How did it misjudge the market so badly?
its 2024 pivot to potentially engage in AI mining. I guess if you’ve already killed your business, why not try to salvage what’s left of the carcass?
the attempt to bind legacy users via a TOS that users had to click through even if they wanted to exit Photobucket. Gauche.
the arbitration provision’s exclusion for IP. Plaintiffs are weaponizing 1202, so IP carveouts have become dangerous. Reminder: every part of the arbitration provision should be carefully vetted for potential plaintiff weaponization.

The result was a messy outcome with different plaintiffs for getting different outcomes. Not what Photobucket was aiming for.

The obvious question: was there a better way for Photobucket to force all legacy users onto its new AI-friendly terms? This judge seemed to believe that the right incantation would let Photobucket put the onus on users to check for TOS amendments, but most judges won’t permit this. Could Photobucket have forced users to the new terms through its emailed notifications? The Ninth Circuit just permitted this, so maybe? The reality is that it’s difficult or impossible to universally bind all legacy users to new terms if they aren’t coming back to the website. I don’t have any clever hacks or tricks to work around this.

Case Citation: Pierce v. Photobucket Inc., 2026 WL 672764 (D. Colo. March 10, 2026). CourtListener page.

Other posts about Photobucket

The post Photobucket’s Attempted TOS Amendment Mostly Fails–Pierce v. Photobucket appeared first on Technology & Marketing Law Blog.

Fair Use Blocks Privacy-Motivated Copyright Lawsuit–MCM v. Perry

Eric Goldman — Mon, 16 Feb 2026 17:14:50 +0000

The case involves a Twitter user, Perry (a/k/a “I, Hypocrite”), who tweet-critiqued a crypto company Celsius Networks. The first tweet in the sequence referenced a business setback for Celsius. The second tweet in the sequence contained a collage of two images with the caption “Same company btw” (i.e., Celsius).

The first collaged image shows Jessica Khater’s, a Celsius executive, listing in Forbes 30 Under 30. The second collaged image is a screenshot from an unnamed video that depicted “Jessica” with the transcription that she studied marketing and business. The juxtaposition implied that Jessica and the Forbes 30 Under 30 executive were the same person.

The court is as baffled by this tweet thread as you are (“This Court makes no finding as to what Defendant subjectively intended to communicate through the Tweet, as the Defendant’s intentions are not alleged within the complaint or obvious from the Tweet itself”). Connecting the dots, perhaps the inference is that the Forbes 30 Under 30 executive studied business and marketing, worked for Celsius, and thus might be responsible for Celsius’ downfall. Or perhaps the inference is that the Forbes 30 Under 30 executive chose to make porn earlier in their life (which, as discussed in a moment, would not be true) and that choice relates to their competence or reputation. If either inferential chain seems illogical or shaky, recall this is a social media tweetstorm about crypto, a notoriously chaotic corner of the information ecosystem. The court never expressly resolves if the video Jessica and the Forbes 30 Under 30 executive are the same person.

The screenshot is included in the court filings, and the similarities of the two faces is directly relevant to the tweet sequence’s meaning. Nevertheless, I’m covering up “Jessica’s” face because she is a sex trafficking victim:

The screenshot was extracted from an unnamed sexually explicit video produced by Girls Do Porn (GDP). As you can see, the screenshot isn’t sexually explicit (Jessica is depicted on a bed fully clothed). In prior proceedings, another court held that GDP was “a criminal sex trafficking enterprise” and awarded restitution by transferring the IP rights in the videos to the victims–presumably to give the victims additional legal tools to suppress further disseminations of the video. (I didn’t work through the 17 USC 201(e) implications of the prior restitution order).

“Jessica” received the copyright to the video from which the screenshot was extracted and assigned the rights to an enforcement agent. Jessica’s enforcement agent sent a 512 takedown notice to Twitter targeting the screenshot. Twitter removed the tweet.

Despite the removal, Jessica’s enforcement agent also sued Perry for copyright infringement for posting the screenshot in the first place. The court dismisses the claim due to fair use–on a motion to dismiss.

Nature of the Use

the Tweet utilized the still frame for a transformative purpose. The Video is a pornographic film with the express purpose of displaying explicit sexual content. Conversely, the Tweet does not contain any nudity or sexually explicit imagery and is framed as a commentary on Celsius….

The Defendant’s reproduction of the still frame in the composite image is in service of this commentary….By arranging the images of two women, both identified as being named Jessica, side by side, the composite image vaguely implies that a Celsius executive appeared in a pornographic film. The still frame’s accompanying text stating that Jane Doe was studying business and marketing further supports this implication.

In short, a reasonable observer would understand the Tweet as a commentary on Celsius with a markedly different purpose from the original pornographic video. Further, as a commentary on a “subject of public interest” (i.e., Celsius’ decision to pause its customer’s transfers and withdrawals), the Tweet’s transformative use of the still frame justifies its copying.

Nature of the Work. The court says this factor is neutral and not important.

Amount Taken

the Tweet reproduced a single frame of a forty-six-minute video….The Tweet does not capture the central expression of the Video and is not a substitute for the original. The heart, or core, of the Video is its sexually explicit imagery. The Tweet is not pornographically explicit and shows a fully clothed woman describing her career interests.

Market Effect

Defendant’s use of a single still frame from the Video was a transformative secondary use intended as a form of commentary on Celsius. Further, the Defendant’s use of a single frame from the video did not include any sexually explicit imagery. In short, a person in the market for a sexually explicit, pornographic film would not turn to the Tweet. Because Defendant’s use of the still frame would not, and could not, usurp the market for the Video…

Plaintiff admits that the Tweet would not harm the market for the Video.

Implications

Do Screenshots Extracted from Videos Infringe? In general, I think that single images extracted from videos should routinely qualify as fair use. This case involved more complicated facts, because the video’s screenshot compared the depicted individual to the Forbes 30 Under 30 segment in service of a larger critique of Celsius. Many extracted screenshots from videos won’t similarly engage in social commentary or need to present the screenshot as visual evidence to support the commentary.

Even so, if the extracted screenshot merely illustrate the video or the person depicted, or provides the foundation for a meme, the republication of a screenshot is a trivial fraction of the source work and poses no threat to the market for the originating video. In other words, the last two fair use factors should always weigh in the defendant’s favor. This case may not be definitive precedent to establish that other screenshot publications should routinely qualify as fair use, but it shows a roadmap to that conclusion.

Copyright and Overremovals. Twitter honored to Jessica’s enforcement agent’s 512 takedown notice by removing the tweet. However, this court opinion confirms that the tweet was never infringing. As a result, Twitter’s response appears to be yet another unwarranted 512-induced overremoval (I have another post about DMCA overremovals coming soon).

When Takedowns Don’t Satisfy the Copyright Owner. We don’t often see copyright owners sue uploaders after a successful 512 takedown. 512 doesn’t eliminate those lawsuits; instead, 512(h) facilitates such lawsuits by helping copyright owners unmask the uploader. Nevertheless, the incremental value of a copyright infringement lawsuit after a successful takedown is typically small. The need for an injunction has essentially evaporated; lawsuits take a long time chronologically and cost more money; the damages at issue might be trivial (especially if the takedown was effectuated quickly); and the copyright owner runs the risk of a Streisand Effect (an especially acute risk here given the privacy motivation of this lawsuit). I’m not sure what the plaintiff hoped to accomplish with this post-takedown lawsuit.

Copyright as a Silencing Mechanism. This lawsuit seemed to be motivated more by privacy concerns than copyright. The plaintiff admitted as much: “Plaintiff wishes to depress the demand for the Video and use the Federal Copyright Law to control further dissemination of the Video, or any portion thereof” (cleaned up).

While copyright law can act as a doctrinal tool for suppressing content, it’s ill-suited as a privacy tool for reasons that Prof. Silbey and I discussed in our Copyright’s Memory Hole paper. As we wrote there, “treating copyright law as a general-purpose privacy and reputation tort harms us all.”

I’ll note that the complaint only alleged copyright infringement–no defamation, false light, or privacy claims. I wonder if any of those alternative claims would have been more appropriate to address the underlying privacy concerns?

* * *

I feel sympathy for Jessica’s sex trafficking victimization. However, especially after Twitter’s takedown of the screenshot, this copyright lawsuit was also problematic. I still believe that any time a court grants fair use on a motion to dismiss, a 505 fee shift to the defense should usually follow because the legal claims weren’t close.

Case Citation: MCM Group 22 v. Perry, 2026 WL 279525 (S.D.N.Y. Feb. 3, 2026). The complaint. Defense counsel’s writeup of the case.

The post Fair Use Blocks Privacy-Motivated Copyright Lawsuit–MCM v. Perry appeared first on Technology & Marketing Law Blog.

California’s Consumer Privacy Act (CCPA) Assists a Private Right of Action–Shah v. MyFitnessPal

Eric Goldman — Sun, 15 Feb 2026 15:56:35 +0000

It’s been years since I blogged about the California Consumer Privacy Act (CCPA). Have you missed the dumpster fire meme?

* * *

This is one of an ever-growing number of cases alleging that a website purported to let users decline cookies but then disregarded those instructions and placed the cookies anyway.

Among other claims, the plaintiffs alleged that the unconsented cookie placements and resulting consumer tracking violated the common law invasion of privacy and intrusion upon seclusion doctrine. The court says that the CCPA’s statutory provisions bolster these common law claims:

The California Consumer Privacy Act (CCPA) further supports the conclusion that plaintiffs Shah and Wiley had a reasonable expectation of privacy in the information that was collected by cookies they had attempted to reject. As the California Attorney general’s website explains, the CCPA requires that companies give users the choice to opt out of any collection of personal information for “cross-context behavioral advertising, which is the targeting of advertising to a consumer based on the consumer’s personal information obtained from the consumer’s online activity across numerous websites.”

Two obvious points. First, CA AG’s website explanations aren’t binding interpretations of the CCPA. As the Dude might say, that’s just like, uh, their opinion, man. (Though this AG quote is just trying to summarize the overwhelmingly complex CPRA).

Second, the CPRA’s cross-context behavioral advertising restriction doesn’t implicate all cookie placements. In other words, there are many reasons why a website might place a cookie that have nothing to do with that awkward statutory construct. In this case, some of the defendants’ activity at issue would not be related to the AG’s guidance.

The court continues:

When evaluating Californians’ reasonable expectations of privacy, the CCPA’s provisions are highly relevant “customs, practices, and circumstances,” because they provide Californians with the reasonable expectation that they will have some control over their data and necessarily shape users’ expectations about their ability to opt out of websites’ collection of data for profit.

Say what? The CCPA expressly precludes private rights of action for violations of its privacy provisions (there’s an unrelated limited private right of action for some data breaches). However, if courts will treat the CCPA’s statutory text as norm-shaping in a way that strengthens common law privacy claims, the CCPA’s text nevertheless facilitates a private right of action workaround despite its clear and contrary statutory intent. Nice.

Some courts have already been mangling the CCPA’s data breach private right of action to apply to any data disclosures, not just those we’d consider to be a result of a “breach.” Now, if the CCPA further turbocharges common law-based private rights of action, plaintiffs are getting an expanding toolkit of options to bypass the CCPA’s clear, express, and very-much-intended prohibition on private rights of action.

To be fair, I don’t think the court needs the CCPA’s norm-setting to establish the problems with asking users for their cookie preferences and then (allegedly) disregarding those instructions. If the website says X and then does not-X, consumers have a pretty reasonable expectation of X–no need for any statutory backup to legitimize that expectation. At the same time, I think of cases, like the old In re JetBlue case, where there’s a “no harm/no foul” realpolitik outcome when a privacy violation is inconsequential. If the plaintiffs don’t like a website’s data collection, but suffer no adverse consequence from it, what are we even doing?

Case Citation: Shah v. MyFitnessPal, Inc., 2026 WL 216334 (N.D. Cal. Jan. 27, 2026)

Because this case involves both the CCPA and CPRA, I might as well include the CPRA meme too:

Prior CCPA/CPRA Posts

The post California’s Consumer Privacy Act (CCPA) Assists a Private Right of Action–Shah v. MyFitnessPal appeared first on Technology & Marketing Law Blog.

The Sixth Circuit Wades Into Online TOS Formation (and Leaves Me More Confused Than Ever)–Dahdah v. LowerMyBills

Eric Goldman — Thu, 12 Feb 2026 23:40:25 +0000

TL;DR: The court provides this overview:

LowerMyBills.com refers internet users who are interested in refinancing their home mortgages to affiliated lending partners, including Rocket Mortgage. The website tells users that they will agree to its hyperlinked “Terms of Use”—including a mandatory arbitration provision—if they click on a particular button. Michael Dahdah visited this website three times, inputted his information, and clicked the critical buttons. LowerMyBills referred him to Rocket. When Dahdah later received calls from Rocket that he did not want, he sued the company in federal court. Rocket responded by invoking LowerMyBills’ arbitration provision. But the district court held that Dahdah’s “click” did not create an enforceable agreement. We disagree. Under the significant body of circuit precedent interpreting California law, LowerMyBills gave Dahdah sufficiently conspicuous notice that he would accept the proposed terms by clicking the button. So his decision to take this action qualified as a valid “acceptance” of LowerMyBills’ “offer” to contract. The district court thus should have granted Rocket’s motion to compel arbitration.

* * *

Let’s dig into the details, starting with the relevant screens. The plaintiff went to LowerMyBills’ site and requested information about mortgages. The court focuses on the following two screens (the fourth and fifth pages in a 5-page sequence). A screenshot of the bottom of the fourth screen:

A screenshot of the bottom of the fifth screen:

[By redacting the screenshots to only show the page bottoms, the court removed the TOS formation process from the full context. This supports the court’s pro-formation bias by making the pages look simpler than they actually were.]

As you can see, these screenshots look like pretty standard “sign-in-wraps.” The court characterizes them as “a hybrid offer (not a clickwrap or browsewrap offer).” The court prefers the hybrid language because the same methodology applies to sign-in-wraps and other formation processes that aren’t clickwrap/scrollwraps or browsewraps. The court rejects the plaintiff’s argument that this was a browsewrap:

Browsewrap offers seek to create contracts when users simply browse a webpage (hence, their name). LowerMyBills did not propose that type of offer. It required users to take a specific step to accept its offer: click the relevant buttons.

The Sixth Circuit applies California law to these screenshots (both parties agreed on that choice), which is a little dicey because the Sixth Circuit isn’t a repeat player with California TOS formation law. As an example, the Sixth Circuit completely ignores the Godun decision even though I think Chabolla and Godun can’t be understood without reference to the other.

[Personnel notes:

The opinion was written by a TAFS judge (TAFS = Trump-Appointed Federalist Society). TAFS judges’ opinions routinely are distinctive compared to non-TAFS opinions (not necessarily in a good way). I thought this opinion was disorganized (my blog post merges related topics that were confusingly addressed in disjointed locations throughout the opinion) and overrelied on cherrypicked precedent (a hallmark of TAFS opinions).
For a court applying California law outside of California, it was conspicuous that none of the lawyers listed on the opinion caption are based in California…]

The Court’s Description of TOS Formation Law

The Wrap Taxonomy

“any reasonable person would conclude that so-called scrollwrap or clickwrap offers objectively convey the website operator’s “manifestation of [a] willingness to enter into a bargain” with website users”
“So-called browsewrap proposals fall on “the other end” of potential offers….courts often hold that these offers cannot create valid agreements because they leave users “unaware” that the operator has even proposed an offer”
“many proposals fall in between these extremes. These “hybrid” offers (what some courts have called “sign-in wrap” offers) present the trickiest cases.”

Sign-In Wrap (“Hybrid”) Requirements

In determining if an offer is reasonably conspicuous, this court asks Four Questions (no, not those questions):

Q1: “Did the website display the offer on an “uncluttered” page, or on a page filled with items that will “draw the user’s attention away from” the proposal?” “Simple streamlined designs” are more likely enforceable than “a page with lots of distractions.”

Q2: “Did the website operator place the proposed offer close to—or away from—the button that a user must click to signal the user’s acceptance of the proposal?” The closer the offer is to the action button, the more conspicuous it is.

Q3: “Did the website operator use a font size or color that would draw attention to the proposal?” The court says that it’s more likely conspicuous when sites use “a larger font or at least colored hyperlinks.” This is not a faithful characterization of Chabolla/Godun, which had exacting requirements for both fonts AND hyperlink presentations. It’s telling that the court favorably cites Selden v. Airbnb, a DC Circuit case (i.e., not a California case) that predates Chabolla/Godun, to support its summary rather than any Ninth Circuit case.

Q4: “Did the website operator and users engage in the kind of interaction that one would expect to include contractual terms?” Users expect terms with continuing relationships and not for one-off interactions.

These Four Questions are similar–but not identical–to the Ninth Circuit standards. Here’s how I summarize those standards in my Internet Law course:

Who Decides

The court says that if the facts about what happened aren’t in dispute, the court can rule on the formation process as a matter of law rather than send the formation question to the jury.

Application to This Case

Reasonably Conspicuous Notice

The court says the conspicuousness of the notice is a “close question.” Here’s why the court concludes that the notice was reasonably conspicuous:

the proposal on the fourth page followed a “simple design” that did not contain much clutter (other than a logo for Quicken Loans as the “Featured Provider”). Selden, 4 F.4th at 156. [Reminder: Selden is a DC Circuit opinion that predates Chabolla/Godun] In this respect, then, this page resembles the simple sign-up pages for Uber or Airbnb. And it differs from Fluent’s webpages in Berman, which contained other eye-catching images and information. Admittedly, the fifth page had far more terms than the fourth page. It also identified Dahdah’s consent to the specific “Terms of Use” in the second of four paragraphs of details. But we view this page as serving a belt-and-suspenders role for the fourth page’s proposal. And we resolve this case based on the notice that consumers would have received across the pages in combination….

LowerMyBills placed the proposal “directly” “below the action button” on each of the pages. And it used a “dynamic scrolling function” in which these pages automatically scrolled down as users inputted information in the boxes. So users would always see the offer on the same screen as the action buttons.

The plaintiff pointed out that the 5-screen formation process was confusing because the prior screens had a similar “calculate” button without terms. The court says that multi-screen processes are OK, noting that Uber’s process had two screens. But I also note (which the court didn’t) that Chabolla said: “three faulty notices do not equal a proper one.” I think the court would say that the fourth and fifth screens are each independently sufficient, but I wanted to see more thoughtful discussion about how the multiple screens reinforce or conflict with each other.

The court notes that LowerMyBills used a “very small font,” which calls it “a legitimate concern.” As I teach my students, the offer language should never be in the smallest font on the page. In Chabolla, a TOS formation failed in part because the offer language’s font was “notably timid in both size and color” (a critique that could apply here). In response, the court cherrypicks the precedent and says that the font size might be comparable to the font sizes used by Uber or LiveNation (both are pre-Chabolla cases, and Uber is a 2nd Circuit case). Also, the hyperlink was in “bright blue” on a white background, so “LowerMyBills did not hide the critical hyperlink using the same font color as the other text.” (The Ninth Circuit would treat a different font color for the links as mandatory, not a plus factor).

The court also struggles with whether the interactions with LowerMyBills was a one-off or ongoing relationship given that they were largely acting as a referral service (the court says this is also a close call). The court makes this empirical claim without a scintilla of empirical support: “reasonable users also would expect that the free referral service comes with some contractual strings attached….given that the site matches users with potential lenders, we cannot say the objective user would fail to anticipate some sort of continuing relationship.” [Insert goose meme: relationship with WHO?]

The court says that it’s OK the offer language was below the action button rather than above because “Other courts have enforced these offers when placed below rather than above the button that signaled the user’s assent.”

Manifestation of Assent

The court says concluding “that Dahdah took actions showing his assent to LowerMyBills’ offer becomes “straightforward” once we conclude that the offer was reasonably conspicuous.” The plaintiff clicked on the green “calculate” and “calculate your free results” buttons.

The plaintiff weakly attacked the call-to-action language, which lets the court skirt any serious analysis. But look back at the text: it says “by clicking the button above,” which we could assume refers to the green button right above that text. But there are surely other “buttons” on the screen above the text (remember, the court clipped the screenshot, improperly IMO), which would make the cross-reference ambiguous. If there are more “buttons” “above,” what should have happened?

Also, the Chabolla opinion rejected a TOS formation when the offer language said “by signing up” and the action button said “continue.” Would it matter to Chabolla that the offer language didn’t precisely describe the action button?

Arbitration Terms

The court acknowledges that LowerMyBills’ TOS was silent on many key provisions about the arbitration, such as selecting an arbitration service. However, the provision says that the Federal Arbitration Act applies, and the court says that’s good enough to gap-fill all missing arbitration terms.

Implications

Would this case have turned out differently if it had actually been in a California court? I believe Chabolla and Godun changed a lot about TOS formation, and this court mostly disregarded those cases to rely on pre-Chabolla cases, some of them from courts outside California. So, I believe this ruling is not consistent with California courts. But really, who knows? TOS formation remains another Calvinball area of Internet law.

To be fair, LowerMyBills’ TOS formation process might not be condemnable despite their sloppiness. Obviously it could be easily improved (2 clicks, please), but it’s pretty consistent with the old standards for TOS formation. However, I think it’s disingenuous to treat this opinion as consistent with California law without wrestling more thoughtfully with the effects of Chabolla and Godun.

Case Citation: Dahdah v. Rocket Mortgage, LLC, 2026 WL 194455 (6th Cir. Jan. 26, 2026)

The post The Sixth Circuit Wades Into Online TOS Formation (and Leaves Me More Confused Than Ever)–Dahdah v. LowerMyBills appeared first on Technology & Marketing Law Blog.