highbeamSubscribe

Policy brief 06 · Kids + Social Media

Section 230 Reform — Restoring Choice to the American People

Thirty years on, make Section 230 keep its promises.

All policy briefs

Section 230 shields platforms from liability for their users' posts. The same 1996 law promised Americans user control, parental filtering tools, a competitive market, and vigorous enforcement against stalking and harassment, and made none of it enforceable. Congress should let parents bring their own safety tools, let users choose their feeds, require platforms to answer abuse reports, and back those duties with remedies Section 230 cannot block.

The Problem

Section 230 became law on February 8, 1996.1 Its authors, Reps. Chris Cox (R-CA) and Ron Wyden (D-OR), called it the Internet Freedom and Family Empowerment Act.2 Beside its shield, that no platform "shall be treated as the publisher" of users' posts, it declared a national policy: encourage technologies that "maximize user control," clear the way for filtering tools that "empower parents," preserve a "competitive free market," and "ensure vigorous enforcement" of federal criminal law against stalking and harassment.1

The shield is a rule courts apply. The promises are a preamble: subsection (b) creates no duties, and the statute's only affirmative obligation is a sign-up notice that parental-control software is "commercially available."1 The gap shows in three places:

  1. Filters need permission. In 2021, Facebook permanently banned the developer of Unfollow Everything, a free tool that emptied users' News Feeds, and demanded that the developer never build another tool for its services.3 A 2024 suit asking a court to confirm that Section 230 protects such tools was dismissed as premature.4
  2. Complaints hit a wall. In 2019, the Second Circuit held that Section 230 barred a harassment victim's claims against Grindr to the extent they rested on its "allegedly inadequate response" to complaints about fake profiles impersonating the victim.5
  3. The promises lack a remedy. No user, parent, or developer can sue to enforce subsection (b).1 The Supreme Court took up Section 230's reach, then in 2023 declined to address it.6

Why legislation: Only Congress can change Section 230's reach; the statute bars state claims inconsistent with it.1 Congress has written narrow remedies before: in 2018 it lifted the shield for certain sex-trafficking claims,1 and in 2025 the bipartisan TAKE IT DOWN Act required platforms to remove nonconsensual intimate images within 48 hours of a valid request.7 Sammy's Law, which would open platforms to parents' chosen safety software, has 11 Democratic and 11 Republican House cosponsors.8 Yet no federal law gives a family the right to connect the tool it trusts. A law that shields platforms in the name of user control should deliver user control.

The Solution

A four-step staircase: each step stands alone, and each step up turns another of subsection (b)'s promises into a duty. Scope: social and video platforms above 10 million monthly U.S. users. Platforms' own content controls and antitrust rules are addressed separately.

Step 1 — Let parents bring their own tools. Require covered platforms to offer secure, real-time interfaces through which a parent, or a teen 13 or older, can hand management of the teen's account, contacts, and content settings to a registered safety service. Sammy's Law already drafts this.9 Registration should turn only on security and privacy.

Step 2 — Let users choose their feeds and filters. Give every user usable data exports, persistent preferences, and the right to route their feed through an independent ranking or filtering service. Bar platforms from defeating that right with unreasonable fees, degraded interfaces, unannounced redesigns, or retaliatory bans, allowing only proportionate security limits subject to audit. The Foundation for American Innovation urges a right to delegate feed and moderation choices to "third-party software intermediaries."10

Step 3 — Answer the reports. Require accessible reporting, timely responses, and lawful preservation of evidence for defined cyberstalking, harassment, sexual exploitation, and trafficking, with notice and appeal for users whose posts are removed. California already requires platforms to confirm cyberbullying reports within 36 hours and decide them within 30 days.11

Step 4 — Make the promises enforceable. Authorize FTC and state attorney general penalties, corrective court orders, and specified private claims for breaches of Steps 1–3, with causation required for damages. State plainly that Section 230 cannot bar these actions, as the STOP CSAM Act does for its own claims,12 while keeping the shield for hosting and good-faith moderation. No single violation should strip a platform's immunity wholesale. The shield has held for thirty years; the promises should hold too.

Where to start: Step 1 is the floor; its House bill has an evenly bipartisan list of cosponsors. Step 4 is the heart: without a remedy Section 230 cannot block, every other step is one more promise.

Administration and enforcement: The FTC sets interface and response standards within 12 months, then a 12-month build period. The FTC and state attorneys general enforce, with court-supervised access orders and bounded private claims. Coordinate with the companion content-control, feed-choice, and antitrust proposals so platforms build one set of interfaces.

Risks and Mitigations

  • First Amendment: The Supreme Court said in 2024 that curating a feed is "expressive activity of its own."13 These duties never tell a platform what to carry; they let each user choose who curates for them. That line is defensible but untested, and the risk remains.
  • Section 230's own words: Subsection (b)(2) also favors a market "unfettered by Federal or State regulation."1 Fair, which is why the duties reach only the largest platforms and exist to keep the market open to new tools. Some tension remains.
  • Privacy and misuse: Third-party tools could mishandle data. Require registration, security testing, data minimization, revocation, and liability for misuse; one user's consent never unlocks another person's private messages. Breaches remain possible.

Similar Bills

Fit measures similarity to this proposal's mechanisms: High = direct precedent; Partial = useful component with material differences; Related = adjacent approach.

Federal — 119th Congress

Proposal or bill Relevant provisions and fit Fit
H.R. 2657 — Sammy's Law
Wasserman Schultz (D-FL), Carter (R-GA) + 4 bipartisan original cosponsors; Senate companion S. 4159: Husted (R-OH), Britt (R-AL), Warner (D-VA)
Subcommittee advanced · Dec. 11, 2025		 §4 requires real-time interfaces through which a teen or parent can delegate management of the teen's account to FTC-registered safety software. Direct precedent for Step 1; covers platforms above 100 million global users or $1 billion in revenue and does not touch Section 230. High
S. 1634 — ACCESS Act of 2025
Warner (D-VA), Hawley (R-MO), Blumenthal (D-CT)
Referred to committee · May 7, 2025		 §§3–5 require portability, interoperability, and delegation to registered third-party agents; §4 treats interface changes that unreasonably deny access as violations. Precedent for Step 2; limited to communications platforms above 100 million U.S. users. High
S. 146 — TAKE IT DOWN Act
Cruz (R-TX), Klobuchar (D-MN) + 17 bipartisan original cosponsors
Enacted · May 19, 2025 (Pub. L. 119-12)		 §3 requires a notice-and-removal process and removal of nonconsensual intimate images within 48 hours, enforced by the FTC. Enacted precedent for Step 3; covers one category of abuse. Partial
H.R. 6334 — Deepfake Liability Act
Auchincloss (D-MA), Maloy (R-UT)
Referred to committee · Dec. 1, 2025		 §2 conditions Section 230(c)(1) protection on a reasonable process for cyberstalking and intimate-privacy violations, including evidence logging and removal of content a court finds unlawful. Closest link between response duties and immunity (Steps 3–4); conditions the shield instead of creating separate claims. High
S. 1829 — STOP CSAM Act of 2025
Hawley (R-MO), Durbin (D-IL) + 7 bipartisan original cosponsors
Reported to the Senate · June 26, 2025		 Proposed 18 U.S.C. §2255A gives victims of child sexual exploitation civil claims against platforms and app stores; subsection (e) bars Section 230 from impairing those claims. Model for Step 4's claim-specific exception; narrower subject. Partial

State

No state can amend Section 230, which preempts inconsistent state claims, so there is no direct state analogue. Two enacted laws supply components.

Proposal or bill Relevant provisions and fit Fit
California — Bus. & Prof. Code §22589.1
Amended by SB 1504 (2024) · In effect Jan. 1, 2025		 Requires a prominent cyberbullying reporting tool, written confirmation within 36 hours, updates every 14 days, and a final decision within 30 days; §22589.2 lets reporting parents and public attorneys sue. Close model for Step 3; limited to cyberbullying. High
Utah — H.B. 418, Data Sharing Amendments
Signed March 27, 2025 · In effect July 1, 2026		 Requires social media companies to export a user's data, including the social graph, and to run open-protocol interoperability interfaces on nondiscriminatory terms. Enacted component for Step 2; data sharing between services, without delegation to independent feeds or parental tools. Partial

What this adds: Sammy's Law, the ACCESS Act, and the TAKE IT DOWN Act each create one duty, and the Deepfake Liability and STOP CSAM Acts each tie one duty to Section 230. This proposal gathers subsection (b)'s promises into a single set of duties for the largest platforms and pairs them with an express, limited remedy that Section 230 cannot defeat.

Notes

  1. 47 U.S.C. § 230, as added by Pub. L. 104-104, § 509 (Feb. 8, 1996). See § 230(b) (policy), (c)(1) (publisher shield), (d) (notice that parental controls are "commercially available," added 1998), (e)(3) (inconsistent state law), and (e)(5) (sex-trafficking claims, added by Pub. L. 115-164 in 2018). ↩ ↩2 ↩3 ↩4 ↩5 ↩6 ↩7

  2. H.R. 1978, Internet Freedom and Family Empowerment Act, 104th Cong. (introduced June 30, 1995, by Reps. Cox and Wyden). Party affiliations from GovTrack. ↩

  3. Louis Barclay, "Facebook Banned Me for Life Because I Help People Use It Less," Slate, October 7, 2021. The developer's account of Facebook's cease-and-desist letter, which the developer made public. ↩

  4. Zuckerman v. Meta Platforms, Inc., No. 3:24-cv-02596-JSC (N.D. Cal. Nov. 22, 2024), dismissing without prejudice, as unripe, a request for a declaration that § 230(c)(2)(B) protects the proposed Unfollow Everything 2.0 tool. ↩

  5. Herrick v. Grindr LLC, No. 18-396 (2d Cir. Mar. 27, 2019) (summary order). ↩

  6. Gonzalez v. Google LLC, No. 21-1333 (U.S. May 18, 2023) (per curiam), declining "to address the application of §230" and remanding in light of Twitter v. Taamneh. ↩

  7. TAKE IT DOWN Act, Pub. L. 119-12, § 3 (May 19, 2025). ↩

  8. GovTrack, "H.R. 2657: Sammy's Law," accessed September 2026: 22 cosponsors (11 Democrats, 11 Republicans). ↩

  9. H.R. 2657, Sammy's Law, 119th Cong. § 4 (introduced text). ↩

  10. Luke Hogg and Renée DiResta, Foundation for American Innovation, "Digital Regulation Recommendations to the Council of Europe," August 25, 2025. ↩

  11. Cal. Bus. & Prof. Code § 22589.1(b)(2)(D), (F), as amended by SB 1504 (Stats. 2024, ch. 900), effective January 1, 2025. ↩

  12. S. 1829, STOP CSAM Act of 2025, 119th Cong., proposed 18 U.S.C. § 2255A(e) (reported text). ↩

  13. Moody v. NetChoice, LLC, No. 22-277 (U.S. July 1, 2024), stating that deciding which third-party speech to include and how to present it "is expressive activity of its own." ↩