Sanity Prevails: Second Circuit Rules that Section 230 Doesn’t Protect Technology Company That Created “Defeat Devices” to Enable Clean Air Act Violations

Yesterday, a federal appeals court beat back one of the most egregious recent tech industry attempts at securing overbroad Section 230 interpretations. In United States v. EZ Lynk, the government sued a company that creates “defeat devices,” which overrule automobiles’ on-board computers to help drivers evade the Clean Air Act’s emissions controls. EZ Lynk—supported by an amicus brief from organizations such as the Chamber of Progress, NetChoice, and the Electronic Frontier Foundation—argued that it could not be held liable under Section 230. Luckily, in this case, the court saw through the tactic and ruled that the lawsuit could proceed.

Section 230 is an important law that protects free speech by ensuring that people cannot sue websites and other online platforms for the tortious content that their users post. This is an important protection that distinguishes websites and online platforms from other publishers such as newspapers, magazines, and television studios that can be sued when they publish tortious third-party information. These other publishers exert a lot of editorial control over what they publish, so it’s fair to hold them accountable. But websites usually don’t exert the same control on what their users publish. Moreover, they usually couldn’t even if they tried, given the vast volume of published materials exceed the capacity of websites to exercise editorial control. If they had to fear being sued anytime a user published something tortious or illegal, they might shut down or prevent users from discussing anything controversial. Section 230 prevents these outcomes, both of which would be bad for free speech. EPIC explained the details of Section 230’s important but narrow protections in a recent amicus brief.

While 230’s protections are important, they are not boundless. The law is not supposed to protect companies from accountability for their own bad actions, such as when their own speech is tortious, when they induce users into creating tortious speech, or when they design a website or platform in a way that harms users. Holding companies accountable for harms they could avoid would not harm speech the way that holding companies accountable for harmful speech from users that they generally cannot avoid.

Unfortunately, internet companies have been quite successful in getting judges to turn Section 230’s relatively narrow protections into broad get-out-of-jail-free cards. Taking advantage of some of the law’s less-than-clear language, they argue that facing accountability for anything they do relating to user-generated content would destroy free speech online. Companies have successfully invoked Section 230 to strike down lawsuits that seek to hold them accountable—not for hosting tortious user posts, but for designing their websites in ways they know would harm users.

For instance, Grindr successfully invoked the law to prevent a products liability suit for not implementing features that protect users from cyberstalking, harassment, and impersonation. And Meta invoked Section 230 to dismiss a consumer protection claim seeking to hold it liable for incorporating Intermittent Variable Rewards (IVRs), borrowed from the gambling industry, in their notification delivery systems in a way that allegedly harmed users. Notification delivery systems built on IVRs do not serve notifications such as “likes” to users in real-time, but instead in artificially spaced patterns that trigger larger dopamine responses. IVRs result in more anxiety felt by users, more time spent on-platform, and a greater number of times returning to the platform.

In this case, EZ Lynk argued that it is protected by 230 because it merely provided a “neutral platform” for software that interfaced with an automobile’s computer, and it was users that produced the illegal software, called “delete tunes,” that violate the Clean Air Act. But that bad-faith argument, like many industry Section 230 arguments, ignored the facts that made EZ Lynk culpable. As the court noted, the plaintiffs plausibly allege that EZ Lynk did much more than provide a neutral platform, the company, among other things:

• Specifically mentioned in its patent application the device’s use for defeating emissions controls;
• Consulted with two technicians pre-launch about its platform’s design, both of whom went on to exclusively create Clean-Air-Act-defeating software;
• Allowed other companies (some owned by EZ Lynk’s founders) to market and sell the platform with Clean-Air-Act-defeating software already installed; and
• Co-administered a technical support Facebook group with emissions defeat technicians to help purchasers with questions about evading the Clean Air Act.

The Second Circuit panel noted that, “[a]s alleged, EZ Lynk ‘directly and materially’ contributed to the development of delete tunes disseminated through the EZ Lynk System.” In other words, it wasn’t being sued just for something illegal its users did: it’s being sued because it directly and materially contributed to the illegality.

This outcome doesn’t settle many of the important Section 230 questions, fix the overbroad way in which many courts have interpreted it, or directly involve questions of online privacy and safety. But it avoided another dramatic and unfortunate expansion of Section 230 that tech companies would undoubtedly use to evade accountability when they harm users’ safety and privacy.

EPIC regularly submits amicus briefs and blog posts about Section 230 and platform governance issues.