The Yahoo! Nude Photos Lawsuit and CDA Section 230

The AP reports about a recent suit by a woman who alleges that her ex-boyfriend posted nude photos of her along with her email address and work phone number:

The former boyfriend also engaged in online discussions in Yahoo chat rooms while posing as [the woman] Barnes and directing men to the profiles, the lawsuit claims. . . .

Barnes sent Yahoo a letter in January saying she did not create the profiles and wanted them removed. Additional attempts to get Yahoo to remove them in February and March did not get a response, the lawsuit claims.

Can Yahoo be liable for not removing the profiles after being asked by the plaintiff? 

This is a tough and interesting question.  It is currently an issue of great contention in the courts.  Since the law developed in the context of defamation on the Internet, a brief foray into defamation law is in order.  Suppose a columnist for a newspaper says a falsehood about a person that harms her reputation.  The newspaper can be liable for publishing the columnist’s statement.  In certain circumstances, distributing a defamatory publication can be grounds for liability.  The owner of a bookstore or newsstand, for example, can be liable as a “distributor” if she (or her employees) knew or had reason to know about the defamatory statement in the newspaper.  When a person posts a statement on an ISP’s online forum, is the ISP a “publisher,” “distributor,” or neither? 

As part of the Communications Decency Act (CDA) of 1996, Congress passed § 230, which provides: “No provider or user of an interactive computer service shall be treated as the publisher or speaker of any information provided by another information content provider.” 47 U.S.C. §230(c)(1).  This provision clearly means that ISPs cannot be liable as “publishers” of information posted by a user.  This provision can also be interpreted to apply to the host of a blog for comments posted by others.  Suppose that somebody posts a defamatory comment about somebody on PrawfsBlawg.  We happy folks at PrawfsBlawg would not be deemed to be “publishers” of that comment. 

The tricky issue, however, is whether we could ever be liable as “distributors.”  Suppose the poor defamed person in the comment emailed us and said: “Please take down that comment by Anonymous Reader.  It falsely accuses me of committing a crime.”  Such an email would put is in quite a quandary.  Do we now know or have reason to know that the comment is defamatory?  Is this email enough to give us knowledge?  And if we are determined to have known that the comment was defamatory, does § 230 immunize us? 

For a long time, the leading case on this question was Zeran v. America Online, Inc., 129 F.3d 327 (4th Cir. 1997).  About a week after the Oklahoma City bombing, an anonymous person posted a message on an AOL bulletin board advertising “Naughty Oklahoma T-Shirts” making jokes about the bombing.  The message said interested people should call “Ken” at Kenneth Zeran’s home phone number.  Zeran received tons of calls and death threats.  He couldn’t change his home number because he used it for his home business.  Zeran called AOL and asked for the posting to be removed.  AOL said it would remove the posting but then dilly-dallied.  The anonymous poster continued to post more about Zeran.  Zeran repeatedly called AOL to take down the material and to block the anonymous party from posting – but to no avail.  Finally, after quite a while, AOL removed the posting.  Unable to locate the identity of the anonymous poster, Zeran sued AOL for defamation as a distributor. 

The 4th Circuit threw out Zeran’s claim, holding that AOL was immune from liability even as a distributor under § 230.  Note that § 230 uses the words “publisher or speaker” not “distributor.”  Nevertheless, the court reasoned that distributor liability was covered under § 230 because it was merely a subset of publisher liability.  The court also noted that retaining distributor liability would have a chilling effect on speech.  People could notify ISPs, which would simply take down the material (even if it weren’t tortious) to avoid potential liability.

Recent cases in California, currently under review at the California Supreme Court, reject Zeran’s conclusion.  In one of these cases, Barrett v. Rosenthal, 5 Cal.Rptr.3d 416 (Cal. Ct. App. 2003), the court reasoned:

. . . [W]e also think it debatable whether notice liability would actually have an unduly chilling effect on cyberspeech. Neither the record before us nor any other information brought to our attention provides an answer to that question.  Moreover, the speculative conclusion of the Zeran court that exposing Internet intermediaries to knowledge‑based liability would significantly chill online speech is disputed by the speculations of other authorities. . . .

It is also asserted that by ignoring how difficult it is for a plaintiff to prevail on a defamation claim or receive significant money damages, the Zeran court overstated the danger such claims present to Internet intermediaries, and therefore also exaggerated the danger they would engage in excessive self‑censorship. . . . First of all, it must be shown that an alleged defamation is not an opinion or satire or mere hyperbole but an assertion of actual fact, and even then knowledge and the requisite degree of fault must be shown.  Furthermore, if the defamation relates to a public figure or matter of public concern, as will often be the case, the intermediary would also have to be shown to have acted with actual malice, which is usually extremely difficult. . . . Finally, in California and other jurisdictions that have an anti‑SLAPP statute such as ours, defendants in unmeritorious defamation actions need not even answer the complaint and can obtain quick dismissal and their attorney fees.

Back to the Yahoo! case.  There’s a decent defamation claim against the boyfriend, since through posing as the plaintiff, he created harmful falsehoods about her.  There’s also a good claim for public disclosure of private facts for disclosing the nude photos.  One open issue is whether § 230 applies to the privacy torts or just to defamation.  Section 230 uses defamation law language, but its purpose in protecting ISPs and the operators of online forums might suggest that it applies more broadly. 

The case also raises some very thorny issues.  If Yahoo! or bloggers like us can be liable if, after being informed, we fail to remove a comment that is defamatory or invasive of privacy, then will we become over-cautious in removing comments?  This will have a negative impact on speech, because if a person doesn’t like a comment about herself, even if true and not tortious under the privacy torts, folks like us might be extra careful and remove it in order to avoid a lawsuit.  The result would be a kind of heckler’s veto, where a person could have a comment removed by complaining about it, whether justifiably or not.

On the other hand, if Yahoo! or us bloggers ignore a person’s complaints about harmful comments, then that person might be without much recourse.  Shouldn’t Yahoo! have removed the photos?  This seems like an awful situation for the plaintiff – nude photos of herself are placed on the Internet and she is helpless in removing them.  Is there such a big harm in forcing Yahoo! to remove them?  Shouldn’t people have some ability to halt the distribution of falsehoods or nude pictures or other personal information about themselves on the Internet? 

Tags: privacy