What Is Section 230 and Why Does It Matter for AI Liability?
The 1996 law that shields internet platforms from user content is now the central battleground for AI lawsuits—and the outcome will reshape tech liability.
Section 230 of the Communications Decency Act grants internet platforms broad immunity from liability for content posted by users, but courts are now wrestling with whether AI-generated outputs qualify for the same protection.
Recent lawsuits against OpenAI have thrust the 30-year-old statute into the spotlight. A wrongful death case in which ChatGPT allegedly provided drug advice that contributed to a teen’s overdose and litigation over a Florida mass shooting where the perpetrator claimed AI radicalization both hinge on whether Section 230’s shield extends to machine-generated text. The Legal framework that enabled the modern internet now faces its most consequential test.
The Core Protection
Section 230, enacted in 1996 as part of the Communications Decency Act, establishes that ‘no provider or user of an interactive computer service shall be treated as the publisher or speaker of any information provided by another information content provider.’ In practice, this means platforms like Facebook, Twitter, and YouTube cannot be sued for defamatory posts, illegal content, or harmful material uploaded by users—responsibility rests with the person who created the content.
The statute includes two key provisions. Section 230(c)(1) provides immunity from liability for third-party content, according to Electronic Frontier Foundation analysis. Section 230(c)(2) protects platforms from liability when they moderate content in good faith, even if those decisions are imperfect or inconsistent. Together, these created the legal environment in which user-generated content platforms could scale without facing crushing liability for every post.
Section 230 emerged from two contradictory 1990s court rulings. In Cubby v. CompuServe (1991), a platform that did not moderate content was found not liable for defamation. In Stratton Oakmont v. Prodigy (1995), a platform that did moderate was held liable, creating a perverse incentive against any content moderation. Congress passed Section 230 to resolve this: platforms could moderate without becoming publishers liable for everything users posted.
The protection is not absolute. Federal criminal law, intellectual property claims, and certain privacy violations fall outside Section 230’s scope. The law also does not shield platforms from their own illegal conduct or content they directly create. Per Cornell Legal Information Institute, platforms must be ‘interactive computer services’ hosting content from ‘another information content provider’ to qualify for immunity.
The AI Challenge
AI systems complicate Section 230’s framework in three fundamental ways. First, when ChatGPT generates a response, is it publishing content from ‘another information content provider’ or creating its own output? The model synthesises patterns from training data but produces novel text that no human wrote. Courts must decide whether this qualifies as platform-mediated third-party content or direct publication by the AI company.
Second, the level of control OpenAI and competitors exercise over AI outputs far exceeds traditional platform moderation. Companies curate training datasets, implement reinforcement learning from human feedback, apply content filters, and continuously update model behaviour. This resembles editorial decision-making more than passive hosting. According to Techdirt, this control may disqualify AI systems from Section 230 protection entirely.
Third, AI companies often charge for access, blurring the line between neutral platforms and commercial content services. When users pay OpenAI $20 per month for ChatGPT Plus, does the transaction create a direct service relationship that undermines platform immunity? Traditional Section 230 cases involved free services hosting unpaid user content—a different economic model from paid AI subscriptions.
| Factor | Traditional Platforms | AI Systems |
|---|---|---|
| Content Origin | Users create and post | Model generates from training data |
| Platform Role | Passive hosting with moderation | Active output control via RLHF |
| Revenue Model | Advertising (typically free to users) | Direct subscription fees |
| Content Predictability | Platform cannot predict user posts | Company controls model behaviour |
| Section 230 Status | Well-established protection | Legally untested |
Case Law Development
No appellate court has yet ruled definitively on whether Section 230 covers AI-generated content, but early district court decisions signal judicial skepticism. In Doe v. Character.AI (2025), a Florida judge allowed product liability claims against an AI chatbot company to proceed, finding that Section 230 immunity did not obviously apply when the defendant designed the product that generated allegedly harmful content. The court distinguished between hosting speech created by others and deploying a system that autonomously produces outputs.
Legal scholars note a critical distinction emerging in case filings. Plaintiffs increasingly frame AI harms under product liability theory rather than defamation or content-based claims. Under this approach, an AI system becomes a defective product that malfunctions by providing dangerous advice or promoting illegal conduct. Product liability falls outside Section 230’s protections, which apply specifically to publisher liability for third-party speech. According to Lawfare, this reframing could bypass the statute entirely.
The wrongful death lawsuit against OpenAI tests these boundaries directly. Plaintiffs argue ChatGPT functioned as a defective product when it provided detailed instructions for drug combinations that allegedly contributed to a teenager’s overdose. OpenAI’s defense invokes Section 230, claiming the model merely facilitated access to information that exists publicly and that imposing liability would make the company the publisher of user-solicited content. The case will likely establish precedent on whether conversational AI outputs constitute protected third-party content or unprotected direct publication.
The Carve-Out Debate
Congressional proposals for AI-specific Section 230 carve-outs have emerged from both parties, though none have advanced to votes. Senator Josh Hawley introduced legislation in February 2026 that would exclude AI-generated content from Section 230 protection, requiring companies to face liability under traditional publisher standards. Representative Anna Eshoo proposed a narrower approach creating exceptions only for demonstrably harmful AI outputs—drug instructions, violence incitement, and child exploitation—while preserving immunity for general conversational responses.
Industry groups argue that removing Section 230 protection would halt AI development in the United States. The Computer & Communications Industry Association testified to Congress in March 2026 that exposure to liability for every generated response would make commercial AI deployment untenable. Companies would face potential lawsuits whenever a user claimed harm from model outputs, regardless of merit. The uncertainty alone would push development offshore to jurisdictions with clearer safe harbors.
Civil liberties organisations split on the question. The American Civil Liberties Union opposes categorical carve-outs, warning they would chill innovation and create precedent for further Section 230 erosion affecting traditional platforms. The Center for Democracy & Technology supports targeted reforms that maintain immunity for general AI assistance while creating accountability for systems designed to produce illegal or dangerous content. The debate mirrors broader tensions between enabling technology development and establishing meaningful liability when systems cause harm.
Implications Beyond Tech
The resolution of Section 230’s applicability to AI will affect sectors far beyond consumer chatbots. Healthcare AI systems that recommend treatments, financial algorithms that provide investment advice, and autonomous vehicles that make split-second decisions all generate outputs that could cause harm. If courts establish that AI companies bear publisher liability for generated content, every deployment becomes a potential lawsuit waiting to happen.
Insurance markets are already responding to the uncertainty. Cyber liability policies increasingly exclude AI-related claims or price them at prohibitive premiums, according to Insurance Journal market analysis. Companies deploying AI face the choice of self-insuring against potentially catastrophic liability or limiting deployments to low-risk applications. The Waymo recall precedent demonstrated how product liability frameworks apply to autonomous systems—a model that could extend to all AI if Section 230 protections do not hold.