I’ve written about Section 230 of the Communications Decency Act of 1996 many times over the years on this blog, and the arc those posts trace is worth pausing on before turning to where the law stands today.
In Section 230 Supreme Court Argument in Gonzalez v. Google: Keep An Eye on Justice Thomas and Supreme Court Will Decide Whether Google’s Algorithm-Based Recommendations are Protected Under Section 230, both from 2023, I described Section 230 as “an almost insurmountable defensive barrier for Internet publishers, and particularly social media companies.” Courts have read the statute’s twenty-six words expansively for a quarter-century, dismissing case after case at the pleading stage.
Gonzalez v. Google was widely expected to be the Supreme Court’s moment to narrow that immunity, particularly as applied to algorithmic recommendations. Instead, the Court resolved the case on other grounds and left the doctrine essentially intact.
The interesting fault line, as I noted at the time, was Justice Thomas’s increasingly impatient complaint – first in Malwarebytes v. Enigma Software (2020, “statement”), and repeated in Doe v. Snap (2024, dissenting from denial of certiorari) – that courts had given Section 230 a sweep its text does not support.
A year later, in Anderson v. TikTok: A Potential Sea Change for Section 230 Immunity, I covered the Third Circuit’s decision picking up that complaint. Drawing on the Supreme Court’s First Amendment reasoning in Moody v. NetChoice (2024), the Third Circuit held that TikTok’s algorithmic recommendations were the platform’s own first-party speech, and therefore outside Section 230’s protection, which by its terms reaches only “information provided by another information content provider.”
Anderson was, as the post title suggested, potentially a sea change.
We can now see what came through the door Anderson opened. The question is no longer whether Section 230 immunizes everything a social media platform does. It is where, exactly, courts are drawing the line between content-based claims (still barred) and design-based claims (increasingly not). What follows summarizes how that line is being drawn, focusing on the SJC’s unanimous April 10, 2026 decision in Commonwealth v. Meta Platforms, Inc.
Commonwealth v. Meta Platforms
Of the many social media Section 230 cases now moving through state and federal courts, Commonwealth v. Meta Platforms, Inc. makes a particularly useful focal point – not only because it was decided by our own Massachusetts Supreme Judicial Court, but because the case is structurally representative of the broader wave of litigation. It is one of dozens of suits brought by state attorneys general against social media platforms over the past several years, running in parallel with the In re Social Media Adolescent Addiction/Personal Injury Products Liability Litigation MDL pending in the Northern District of California. The legal theories tend to be interchangeable from case to case – state consumer-protection statutes, affirmative deception, public nuisance, and design-based theories of harm – and so is the procedural posture. The platforms move to dismiss on Section 230 grounds, and the court has to decide, at the threshold, whether the plaintiff’s claims target third-party content (immune) or the platform’s own design and conduct (not immune). The SJC’s decision is the first time a state high court has worked through that question on a full appellate record and come out unanimously against the platform.
The Massachusetts Attorney General filed the Commonwealth’s complaint on October 24, 2023, in Suffolk Superior Court against two defendants – Meta Platforms, Inc. and Instagram, LLC – asserting four counts: three under the Massachusetts Consumer Protection Act, G.L. c. 93A, Section 2, and one common-law claim for public nuisance.
Count I alleges unfair business practices: that Meta designed Instagram to induce compulsive use by children through four categories of engineered features – incessant audiovisual and haptic notifications and alerts, infinite scroll and autoplay, ephemeral and FOMO-inducing content, and intermittent variable rewards (which the complaint analogizes to slot-machine reinforcement schedules) – all of which it alleges exploit known developmental vulnerabilities in adolescent users.
Count II alleges deceptive business practices: that Meta knew from its own internal research that Instagram was harmful to teenage users but publicly represented that its platforms were not addictive, that it prioritized young users’ well-being over profits, and that the platforms were safe, while concealing internal data on how frequently young users encountered content Meta itself had classified as harmful.
Count III alleges both unfair and deceptive conduct in connection with age-gating – deceptive because Meta represented that it excluded under-13 users while knowing hundreds of thousands of them were on Instagram and that its age-verification measures were ineffective; unfair because Meta refused to invest in more effective age-assurance measures it knew were available, for reasons tied to growth and revenue.
Count IV alleges public nuisance, predicated on the same unfair and deceptive conduct.
The thread tying these together is the Commonwealth’s central allegation: that the harm flows not from any particular post or video on Instagram, but from how Meta built, deployed, and marketed the platform.
The SJC’s Section 230 Analysis
After the Superior Court denied Meta’s motion to dismiss, the SJC granted direct appellate review on whether Section 230(c)(1) barred any of the Commonwealth’s claims. After oral argument in December 2025, a unanimous court held that it did not.
The court worked through the familiar three-element framework for Section 230(c)(1) immunity: the defendant must show (1) that it is a provider or user of an “interactive computer service”; (2) that the claim would treat it as the “publisher or speaker” of information; and (3) that the information was “provided by another information content provider.” Element one was undisputed. The case turned on elements two and three.
Element two – what it means to be “treated as the publisher” – is where the court did its heaviest analytical work. Meta urged a broad reading: that the phrase reaches any claim implicating a provider’s editorial choices about “whether, how, when, for how long, and to whom to publish information.” The court acknowledged that this construction has “commonsense appeal” and some federal support, but rejected it in favor of common-law construction. Drawing on the plain meaning of the statute, the legislative history, and the canon that Congress is presumed to adopt the common-law meaning of common-law terms, the court held that the phrase reaches a claim only where it satisfies both a “dissemination element” (liability for publishing to a third party) and a “content element” (liability based on the content of what was published). A claim targeting the act or manner of publishing, without seeking to hold the platform liable for the substance of the third-party content, falls outside the immunity.
That framework drove the rest of the analysis. The unfair business practices claim in Count I failed the content element: the challenged design features – “infinite scroll, autoplay, IVR, and ephemeral content” – “concern how, whether, and for how long information is published, but the published information itself is not the source of the harm alleged.” The Commonwealth’s theory is content-agnostic; Meta’s argument that the features cannot work without content was rejected. Critically, the court extended this reasoning to algorithms: “the fact that a claim concerns publishing activities, including the use of algorithms in connection with publishing activities, is not enough to bring the claim within the immunity provided by Section 230(c)(1).” In a footnote, the court added that the notifications feature is likely Meta’s own first-party speech, making it an element-three failure as well.
The deception count and the deception piece of the age-gating count failed element three directly: Meta’s allegedly false statements that Instagram is safe, not addictive, and that Meta excludes underage users are Meta’s own speech, not the speech of any third party, and Section 230(c)(1) on its face does not address a defendant’s liability for its own speech. The unfair piece of the age-gating count failed for the same reason as Count I – content-agnostic harm.
Where Do We Go From Here?
The SJC’s decision means the case will now proceed to discovery and, absent summary judgment, to trial in Suffolk Superior Court. The Commonwealth is seeking to force Meta to make fundamental changes in how Instagram is designed and marketed to minors. But the Commonwealth still has a long way to go. It will have to prove its case on the merits and weather the appeals that Meta is certain to pursue if it loses at trial.
However, the case is one data point in a broader and faster-moving national shift. Three years ago Section 230 looked like the near-impregnable barrier I described in my 2023 posts. Today, plaintiffs have a workable two-pronged framework for getting around it: design-defect claims and deception claims (drawing on the obvious point that a platform’s own statements are not third-party content). Different courts are arriving at compatible results through different doctrinal routes, but the practical effect is the same. Section 230 motions are no longer the reliable case-killers they once were, and plaintiffs are reaching juries.
The twenty-six words that created the Internet still mean something. They just no longer mean nearly as much as social media platforms once assumed they did.