Ninth Circuit pokes a few holes in Section 230 immunity

Most people in businesses that operate anywhere near the world of Web 2.0 have a least a vague notion of the protections of section 230 of the Communications Decency Act. The law provides wide-ranging protections to "publishers" of others' content. Thus websites, blogs, listservs, social networks, etc., are not liable for user-generated content that would otherwise create a cause of action.

While there's no doubt that CDA protections are still very strong, a few recent cases are starting to poke holes in the idea that the law provides a Batfink-like shield of steel for any and all sites using user-generated content. Speaking at the Electronic Frontier Foundation's Compliance Bootcamp in San Francisco today, EFF staff attorney Marcia Hofmann explained the basic outlines of the law and the cases filling in the limits.

Most recently, the Ninth Circuit held last week that Section 230 doesn't necessarily protect from a breach of contract claim. In Barnes v Yahoo, No 05-00926 (9th Cir., May 7, 2009), an ex-boyfriend created a Yahoo profile about his former girlfriend that included intimate photos on her. She contacted Yahoo and a customer service rep told her the profile would be taken down -- but it never was. She sued on two theories -- negligence and breach of contract.

The Ninth Circuit held that Section 230 does protect against negligence claims but that the employee's promise to take the page down was an enforceable contract not limited by section 230. According to Hofmann, the Court said, "When you're talking about contract, you have a different situation. Breach of contract departs from the baseline rule of 230." The bottom line is that companies need to control what their employees -- and contractors -- say.

At the conference, I asked if terms of service could limit liability for those kinds of statements. EFF senior staff attorney Fred von Lohmann said it would be tough to argue that the TOS trumped the oral statement, but could set a limit on liability, along the lines of "In no case will liability exceed $500." Even better said Tom Moore of the Moore Law Group: The TOS can specify who has authority to bind the company to such promises.

The Ninth Circuit also held last year, in the Roommates.com case that websites could also destroy their section 230 immunity by effectively creating content. In this case, a roommate-matching website was sued by fair housing councils because it allegedly violated housing discrimination law. The problem was that the site required users to fill out a questionnaire that askeed illegal questions such as sexual orientation and if children would be involved. The Ninth Circuit held that Roommates.com had lost its immunity by requiring users to answer the questionaiire, for requiring users to answer questions by selecting from a pre-populated drop-down menu, and for providing search and email systems that provided content according to discriminatory criteria.

These two cases aside, section 230 means "you're in good shape for the most part if someone sends a complaint," Hoffman said. Most websites are protected from a wide range of lawsuits including defamation, unfair competition, privacy, negligence, breach of contract, federal civil rights claims, state criminal claims and emotional distress.

Best practices, according to Hofmann:

• It's OK to edit typos and make minor changes but be careful not to develop the content.
• If a consumer complains, send a form letter explaining that your company has immunity, which may help avoid suit. But work with an attorney to develop an appropriate form letter.
• Adopt internal policies for addressing complaints.
• Per the Barnes case, don't promise to take down content if you don't intend to do so. And follow any promises you make in privacy policy or TOS.