Section 230 Is Not a Free Pass on Age Verification

More and more states are passing laws that require websites to check a user’s age before letting them in. Utah, Texas, and at least two dozen other states now require adult websites to verify that visitors are 18 or older. Other states are applying similar rules to social media. And the Supreme Court has made clear that “requiring proof of age is an ordinary and appropriate means of enforcing an age-based limit” on obscene material, just like it is for buying alcohol, buying a firearm, or getting a driver’s license. (Free Speech Coalition, Inc. v. Paxton, 606 U.S. 461 (2025).)

So when a child slips past a flimsy age gate and gets hurt, can the website be held responsible? Tech companies have a favorite answer: Section 230.

Section 230 of the Communications Decency Act says that an online platform can’t be liable for content that someone else posted. (47 U.S.C. § 230(c)(1).) For nearly 30 years, platforms have used it to get lawsuits thrown out before they start. But Section 230 was never meant to be a blanket shield for everything a tech company does. And age verification is a great example of where the shield runs out.

Start With History

The Communications Decency Act was passed in 1996, and its main goal was to protect children from sexually explicit material online. (FTC v. LeadClick Media, LLC, 838 F.3d 158, 173 (2d Cir. 2016).) Section 230 itself sits under the heading “Protection for ‘Good Samaritan’ blocking and screening of offensive material.” It was meant to protect websites that try to screen out harmful content, not websites that throw the doors open to kids. It would be strange, to say the least, if a law written to protect children became the reason a company never has to answer for exposing them to harm.

What Section 230 Actually Covers

It protects a platform from claims that treat it as the publisher of someone else’s content: deciding what to post, what to take down, and how to edit it. (Fair Housing Council v. Roommates.com, LLC, 521 F.3d 1157 (9th Cir. 2008).) It does not protect a company from liability for its own conduct, like the way it designs its product. The Ninth Circuit made that point when it allowed a lawsuit about Snapchat over a dangerous design feature to go forward, because the claim had nothing to do with any particular message on the app. (Lemmon v. Snap, Inc., 995 F.3d 1085 (9th Cir. 2021).)

Whether a website hosts art films or the most graphic material imaginable, the question is the same: did the company take reasonable steps to keep kids out?

An Age Gate Is a Product Feature

It does not care what the content behind it says. Whether a website hosts art films or the most graphic material imaginable, the question is the same: did the company take reasonable steps to keep kids out? A federal court in Utah recognized this when it held that Section 230 does not bar a state law requiring age assurance, explaining that a duty to verify age is an “independent, content-neutral obligation” with “no connection” to the content itself. (NetChoice, LLC v. Reyes, 2024 WL 3510919 (D. Utah July 22, 2024).) And the federal court overseeing the nationwide social media addiction litigation held that claims about defective age verification and parental controls can proceed as product defect claims. (In re Social Media Adolescent Addiction Litigation, 702 F. Supp. 3d 809 (N.D. Cal. 2023).)

That is the key distinction. A website can let anyone post anything they want. What it can’t do is give kids the keys. Holding a company responsible for a one-click “I am over 18”button doesn’t require it to monitor, edit, or remove a single post. It just requires it to build a working lock.

Finally, Section 230 has express limits written into it. It has “no effect” on federal criminal law, including laws against sexually exploiting minors, and it does not block state laws that are consistent with it. (47 U.S.C. § 230(e).) Laws requiring companies to verify age fit comfortably within those limits.

None of this means every lawsuit over a child’s online harm will get past Section 230. Courts still draw lines, and claims that boil down to “the website should have removed this post” often get dismissed. But when the claim is about the company’s own choice to build a door that kids can walk right through, Section 230 shouldn’t be the end of the story.

So how do we get platforms to take age verification seriously? We’re lawyers, so we do what lawyers do. We hold them accountable in court (like we're doing here).

If your child was harmed after getting past a website’s age gate, talk to us. It’s our job to help you.