Rules
Section 230 and state speech laws, what US platforms must remove
Section 230 shields platforms from liability for user posts, but state speech laws and federal rules like COPPA still force removals and design changes.
What to take away
- Section 230 at 47 U.S.C. § 230(c)(1) blocks civil publisher liability. It never orders a removal.
- Removal duties come from elsewhereCOPPA, the FTC Act, the DMCA at 17 U.S.C. § 512, state design codes and platform terms.
- The circuits split. NetChoice v. Bonta (9th Cir., August 16, 2024) blocked California's AADC. NetChoice v. Paxton (5th Cir., September 16, 2022) upheld Texas HB 20.
- Penalties are attached. COPPA maximums sit near $50,000 per violation. The AADC allows $2,500 per affected child, or $7,500 for an intentional breach.
Section 230 is immunity, not a takedown order
Section 230 of the Communications Decency Act stops a platform from being treated as the publisher of what users post. The operative wording is one sentence.
No provider or user of an interactive computer service shall be treated as the publisher or speaker of any information provided by another information content provider.
That single sentence, at 47 U.S.C. § 230, does all the defensive work.
Two carve-outs matter. Section 230(e)(1) leaves federal criminal law alone. Section 230(e)(2) leaves intellectual property alone. Privacy statutes and design codes also sit outside the shield.
So the platform's own terms generate most removal obligations. What a single terms dispute proves is narrower than managers hope, as this platform terms case study sets out.
The federal and state rules that still force removal
Removal duties arrive from five sources. Each carries its own clock and its own enforcer.
| Source of duty | Citation | What it forces | Enforcer | Penalty scale |
|---|---|---|---|---|
| COPPA | 15 U.S.C. §§ 6501-6506; 16 C.F.R. Part 312 | Delete data from children under 13 on request | FTC and state attorneys general | Per-violation maximum near $50,000, adjusted yearly |
| California AADC | Cal. Civ. Code §§ 1798.99.28-1798.99.35 | Assessments and high-privacy defaults for minors | California Attorney General | $2,500 per affected child, $7,500 if intentional |
| Texas HB 20 | Tex. Civ. Prac. & Rem. Code ch. 143A | No viewpoint removal by large platforms | Texas Attorney General | Injunctions and damages |
| FTC Act Section 5 | 15 U.S.C. § 45 | Keeps removal promises made in a privacy policy | FTC | Consent orders, audits, reporting |
| DMCA | 17 U.S.C. § 512 | Removes infringing material after notice | Copyright owners, courts | Loss of safe harbour, counter notice |
The deletion requirement itself sits in the rule text published on the FTC COPPA rule page.
The Ninth and Fifth Circuit split, by case name and date
NetChoice v. Bonta, 113 F.4th 1101 (9th Cir. 2024), landed on August 16, 2024. California's design code is one statute with one litigation history, and this California Age-Appropriate Design Code guide tracks it step by step.
The Ninth Circuit affirmed an injunction against the AADC on First Amendment grounds. The statute is not being enforced while the case returns to the district court.
NetChoice v. Paxton, 49 F.4th 439 (5th Cir. 2022), came down on September 16, 2022, and went the other way. The Fifth Circuit upheld Texas HB 20.
The Supreme Court then vacated both in Moody v. NetChoice, 603 U.S. 717 (2024), decided July 1, 2024. The Justices said the lower courts had not assessed the laws as applied. Florida's SB 7072, blocked in NetChoice v. Moody, 34 F.4th 1190 (11th Cir. 2022), was part of the same remand.
The same post can be removed in one state and left up in another. Section 230 does not resolve that conflict, because it limits liability rather than state regulatory power over design.
Example: one complaint, three queues
Moderators do not work from Section 230. They work from queues, and each queue applies a different standard.
One complaint, three queues
- A parent asks for deletion of a video showing their 12-year-old. The item enters child safety. COPPA requires deletion of the data, not just hiding the post.
- A California user reports a default setting. The item enters design review. The fix is usually a settings change for every minor, not one removal.
- A Texas user claims viewpoint discrimination under HB 20. The item enters a viewpoint queue, where the test is consistent application of the platform's own terms.
- Legal signs off on any removal that touches a live consent order.
That path from first report to closure is the same one covered in this guide to app policy regulation from first estimate to closeout.
Consent orders that name a deletion duty
In February 2019 the FTC and New York's attorney general settled with Musical.ly, later TikTok, over COPPA. The order required deletion of data and videos from users under 13, plus a $5.7 million penalty. Google and YouTube paid $170 million in September 2019 and had to purge children's data from their systems.
Every order is public. The FTC cases and proceedings library lists the compliance reports each one demands. Those reports, not the penalty, drive the removal work.
What to check before the next enforcement wave
- Does age assurance feed a deletion rule or only an experience rule?
- Who owns the response clock when a state complaint arrives?
- Which removals need sign-off because of an open order?
- Where is the record showing which rule was applied?
Canadian operators run a separate stack. PIPEDA breach reporting and Quebec's Law 25 create their own notification and deletion duties for Canadian users, and Section 230 never touches them.
A platform bans checklist earns its place before the first complaint, because the order of decisions is what gets tested later.
Common questions
Does Section 230 ever force a platform to delete a post?
No. It removes liability. Deletion duties come from other statutes, court orders and the platform's own terms.
How large is a COPPA penalty now?
The maximum is adjusted each year for inflation and has sat near $50,000 per violation. YouTube's 2019 order reached $170 million.
Is California's AADC in force?
No. The Ninth Circuit affirmed an injunction on August 16, 2024, and the case continues after the July 2024 Supreme Court remand.
Do Canadian rules change anything for a US platform?
They sit outside Section 230. PIPEDA and Quebec's Law 25 impose their own notification and deletion duties for Canadian users.
