There is a line in Section 230 of the Communications Decency Act that has done more to shape the modern internet than almost any other sentence in American law. It reads: "No provider or user of an interactive computer service shall be treated as the publisher or speaker of any information provided by another information content provider."

Twenty-six words. Written in 1996, when the web was a novelty and the companies it was meant to protect were startups operating out of garages. The intent was reasonable: do not hold a platform legally responsible for what its users say, the way you would hold a newspaper responsible for what it prints. The internet needed room to grow. Holding every message board and early social network liable for every user post would have strangled the medium before it had a chance to become anything.

That was thirty years ago. The companies Section 230 now protects are not scrappy startups. They are among the most profitable corporations in human history. And the law has not kept pace with what they have become.

What the law actually does

Section 230 does two things. First, it immunizes platforms from liability for user-generated content. A platform cannot be sued for defamation because a user posted something defamatory. It cannot be held liable for harassment, for incitement, for the spread of dangerous medical misinformation, for content that facilitates violence. The user who posted it might be liable. The platform is not.

Second, and less discussed, it also immunizes platforms for good-faith content moderation decisions. A platform that removes content it finds objectionable cannot be sued for doing so. This was meant to encourage moderation: take down what you think is harmful without fear of being sued for censorship.

In practice, the first protection has swallowed the second. Platforms have near-total immunity whether they moderate aggressively or not at all. The incentive to moderate meaningfully is not legal. It never was. And the financial incentive runs in exactly the opposite direction.

The algorithm is the product

Here is the thing that gets lost in most Section 230 debates: the harm is not just that platforms host bad content. It is that platforms actively promote it.

The recommendation algorithm is not a neutral tool. It is the core product. It is how platforms retain users, extend session time, and sell advertising. And it has been optimized, with extraordinary precision, to surface content that produces strong emotional reactions: outrage, fear, moral indignation, tribal solidarity. Not because the engineers are malicious, but because those reactions keep people on the platform longer, and longer sessions mean more ad revenue.

The result is that content which is false, inflammatory, or emotionally manipulative is systematically amplified over content that is accurate, nuanced, or measured. A video making a false claim about a public figure will, in many cases, outperform a careful correction of that claim. A post designed to provoke anger will reach more people than a post designed to inform. This is not a bug. It is the output of a system that has been tuned to maximize engagement, and engagement correlates with emotional intensity, not accuracy.

Section 230 does not just protect platforms from liability for hosting this content. It protects them from liability for the algorithmic choices that determine which content reaches millions of people and which disappears into obscurity. The platform is not the publisher of the defamatory post. But it is the entity that decided to show that post to three million people. That decision is not covered by the user who wrote it. It is a choice the platform made. And under current law, it is a choice that carries no legal consequence whatsoever.

The reporting systems are theater

Every major platform has a content reporting system. You can flag a post for harassment, for misinformation, for hate speech, for impersonation. The system will acknowledge your report. It will tell you it is under review. In most cases, it will tell you the content does not violate community standards, and the content will remain up.

This is not an accident of under-resourcing. These companies have the technical capacity to do extraordinary things. They can identify your face in a photograph with high accuracy. They can predict what you will want to buy before you know you want it. They can serve you a targeted advertisement based on a conversation you had near your phone. The idea that they cannot build a content moderation system that accurately identifies defamation or sustained harassment campaigns is not credible.

What they have built instead is a system that meets the legal minimum. It processes reports at scale, applies categorical rules that are easy to automate, and produces outcomes that are defensible in the aggregate. It is not designed to address the actual harm a specific piece of content causes to a specific person. It is designed to demonstrate that moderation is happening, which is a different thing entirely.

Defamation is a particular failure point. A post that makes a false factual claim about a private individual, presented as fact, with the intent or effect of damaging their reputation, is legally defamatory. The person who posted it could, in theory, be sued. But identifying that post, connecting it to the legal standard, and removing it before it has spread to tens of thousands of people requires a level of contextual judgment that automated systems cannot provide and that human review teams, operating at the scale these platforms require, are not staffed to deliver. The platform has no legal incentive to invest in that capacity. So it does not.

Bullying is similarly under-addressed, particularly when it operates through coordinated behavior rather than individual posts. A single post calling someone a name may not meet the threshold for removal. A hundred accounts posting the same thing, or variations of it, at the same target, over the course of a week, is a coordinated harassment campaign. Identifying that pattern requires connecting behavior across accounts and over time. Platforms have the technical capacity to do this. They do it constantly for advertising purposes. They do not do it consistently for safety purposes, because safety does not generate revenue and the legal exposure for failing to do it is minimal.

The case against full repeal

None of this means Section 230 should simply be repealed. The argument for keeping some version of it is not just a tech industry talking point. It reflects a real tension.

If platforms were held liable for every piece of user-generated content the way a publisher is held liable for what it prints, the practical consequence would not be better moderation. It would be either the elimination of user-generated content at scale, or moderation so aggressive that it would suppress enormous amounts of legitimate speech. Small platforms and new entrants would be particularly vulnerable: they lack the legal resources to defend against the volume of litigation that full publisher liability would invite. The result would likely be further consolidation of the internet around a handful of large companies with the legal infrastructure to survive, which is the opposite of what most critics of the current system want.

There is also a genuine free speech concern. A legal regime that makes platforms liable for user speech creates a powerful incentive to err on the side of removal. The platforms most likely to over-moderate are not the ones currently failing to address harm. They are the ones that would rather remove anything borderline than risk a lawsuit. That is a real cost, and it falls disproportionately on speakers with less power.

These are legitimate concerns. They are not reasons to leave the current system intact.

What accountability could actually look like

The problem with Section 230 as it currently operates is not that it protects platforms from liability for user content. It is that it protects platforms from liability for their own choices: their algorithmic amplification decisions, their moderation failures, their design choices that predictably produce harmful outcomes.

A narrower reform would distinguish between passive hosting and active promotion. A platform that hosts a piece of content without amplifying it is in a different position than a platform that feeds that content to millions of people through a recommendation system. The latter is making an editorial choice. It should carry some of the legal exposure that editorial choices carry.

Similarly, platforms could be required to demonstrate that their moderation systems meet a meaningful standard of effectiveness, not just that they exist. The current regime asks only whether a platform acted in good faith. Good faith is easy to claim and difficult to disprove. A standard that required demonstrated outcomes would create an actual incentive to invest in moderation capacity.

None of this is simple. The line between hosting and amplifying is not always clean. Defining what constitutes a meaningful moderation standard is genuinely difficult. These are hard policy problems, and the people working on them seriously deserve credit for engaging with the complexity.

But the complexity of the solution is not an argument for accepting the current situation. The current situation is one in which the most powerful media distribution systems ever built operate with essentially no accountability for the consequences of their distribution choices. The companies that run them are not neutral conduits. They are active participants in determining what information reaches people, in what form, and with what emotional framing. They profit from that participation. They should be accountable for it.

Section 230 was written to protect the internet from liability it could not survive. The internet survived. The companies it now protects are not fragile. They are not in need of protection from accountability. They are in need of accountability itself.

That is a different law than the one we have.