Section 230 and state speech laws, what US platforms must remove

What to take away

• Section 230 gives platforms immunity from most state lawsuits over user content, but it does not stop states from passing their own speech laws.
• Platforms still remove content because of COPPA, the California Age-Appropriate Design Code, FTC Act Section 5, and their own terms.
• Immunity and removal duty are different: Section 230 blocks liability, while other laws create affirmative takedown obligations.
• State laws like California's AADC and Texas's HB 20 test the shield, and federal courts have split on whether they survive.
• Getting removal wrong can trigger FTC enforcement, state attorney general suits, or private litigation.

What Section 230 actually shields and what it does not

Section 230 of the Communications Decency Act is the federal shield that keeps platforms from being treated as the publisher of most user content. It sits inside the Telecommunications Act of 1996, the same law that deregulated much of the communications market.

The core sentence says no provider or user of an interactive computer service shall be treated as the publisher or speaker of information provided by another information content provider.

That means a platform can leave a defamatory post up without facing a defamation suit in most cases. It can also remove a post in good faith without becoming liable for the removal.

The shield covers federal and state civil claims, not criminal ones. It does not cover intellectual property claims, which is why DMCA takedowns run on a separate track.

What Section 230 does not do is create a duty to remove anything. It is immunity, not a mandate. A platform can host lawful but awful speech and still be protected. The law also does not stop states from regulating platform design, transparency, or data practices, as long as those rules do not treat the platform as a publisher.

The distinction matters because many state speech laws are drafted to avoid the word publisher. They regulate how platforms moderate, not what they host. That is the gap where the current fights live. The record of what Section 230 originally protect is useful context for reading the state laws now on the books.

The removal duties platforms carry anyway, from FTC rules to state law

Even with Section 230, platforms face real removal duties from other sources. The FTC enforces a set of statutes that include COPPA and the FTC Act.

The FTC Act Section 5 bans unfair or deceptive acts, which the agency has used to require platforms to delete data and sometimes content. COPPA requires operators of child-directed sites to delete personal information from children under 13 when a parent asks.

The FTC's list of Statutes | Federal Trade Commission shows the full set of laws the agency can use, including COPPA and Section 5. That matters because a platform that promises in its privacy policy to remove certain content can be held to that promise under Section 5.

The removal duty comes from the promise, not from Section 230.

State law adds another layer. California's Age-Appropriate Design Code requires covered platforms to estimate the age of child users and to default to high privacy settings. That can force removal of data, not necessarily posts. The Illinois Biometric Information Privacy Act requires consent before collecting face or voice data, which affects photo and video features.

New York and Washington have their own privacy and health data laws that can require deletion.

The FTC's Press Releases | Federal Trade Commission page tracks recent enforcement actions that turn these rules into actual removal orders. A platform that ignores a COPPA deletion request can face civil penalties per violation. That is a removal duty with teeth, and Section 230 offers no defense.

There is also the FTC's rulemaking power. When the agency writes a rule under a statute it enforces, the rule can carry its own deletion requirements. Platforms that fall under a rule have to build a process for receiving and acting on deletion requests. That process costs money and headcount, and it runs whether or not Section 230 applies.

State speech laws now testing the federal shield

Two named state laws are at the center of the current conflict. California's Age-Appropriate Design Code Act, or AADC, regulates how platforms design for minors and requires data protection assessments. Texas HB 20 bars large platforms from removing content based on viewpoint and requires transparency reports.

Both avoid calling platforms publishers, which is how they try to survive Section 230 preemption.

Courts have not settled the question. The Ninth Circuit blocked parts of the California AADC on First Amendment grounds in a preliminary ruling, while the Fifth Circuit upheld Texas HB 20. That split makes the compliance picture uneven. A platform operating nationwide has to guess which state rule will be enforced next.

Other states have passed similar laws. Florida's SB 7072 regulates deplatforming of political candidates, a rule the Eleventh Circuit largely blocked. New York has proposed bills on algorithmic transparency. Massachusetts and Illinois have active privacy rules that touch content moderation indirectly. The District of Columbia has sued platforms over design features.

The practical effect is that platforms now face a patchwork. They may remove content in one state to comply with a design code and leave it up in another. Section 230 does not resolve the conflict because it shields liability, not state regulatory power over design.

The California Age-Appropriate Design Code comparison with COPPA shows how different the removal triggers can be.

Preemption arguments are the hinge. If a state law conflicts with Section 230, the Supremacy Clause says the federal law wins. But courts have read the conflict narrowly. A law that requires a transparency report is not the same as a law that punishes a platform for a user post.

That narrow reading is why so many of these statutes keep surviving early motions.

COPPA, the California design code and mandatory takedowns

COPPA is the oldest removal driver in this space. The FTC's Children's Online Privacy Protection Rule ("COPPA") | Federal Trade Commission sets the rule text: operators must get verifiable parental consent before collecting personal information from children under 13, and must delete that information on request.

That deletion duty covers user-generated content that contains a child's personal information.

The California AADC goes further. It requires covered platforms to conduct data protection impact assessments and to default minors into the highest privacy settings. It also requires clear privacy information in language a child can understand. Enforcement falls to the California Attorney General, with civil penalties for violations.

Both laws create removal duties that exist independently of Section 230. A platform that hosts a video with a child's face and name may have to remove it under COPPA if a parent asks. Under the AADC, the platform may have to remove it by default because of the design requirement.

Neither duty is blocked by Section 230 because neither treats the platform as a publisher of the child's speech.

The FTC's Cases and Proceedings | Federal Trade Commission page shows how the agency has enforced these rules against platforms and ad tech firms. The pattern is consistent: the FTC orders deletion of data, sometimes deletion of content, and imposes compliance reporting for years.

That is a removal obligation that platform policy staff must plan for.

Where each removal duty comes from

Source of duty	What it covers	Who enforces it	Typical remedy
COPPA	Personal data of children under 13	FTC and state attorneys general	Deletion, civil penalties
California AADC	Minors up to 17, design and defaults	California Attorney General	Penalties, design changes
FTC Act Section 5	Deceptive privacy and removal promises	FTC	Consent orders, audits
State speech laws	Viewpoint, deplatforming, transparency	State attorneys general	Injunctions, damages
Illinois BIPA	Face and voice data	Private plaintiffs, Illinois AG	Statutory damages per scan

How platform terms convert state pressure into removal practice

Platform terms of service are where state pressure becomes actual moderation. A platform that promises to remove hate speech or harassment can be held to that promise under FTC Act Section 5. A platform that promises to protect minors can be held to the AADC or COPPA. The terms are the contract, and the contract creates the removal duty.

Moderators see this as a set of queues. A COPPA report goes to a child safety queue. A state AADC complaint goes to a design review queue. A Texas HB 20 complaint goes to a viewpoint review queue. Each queue has different standards, and the same post can be removed in one and left up in another.

The result is that removal practice is not driven by Section 230. It is driven by the terms, the state laws, and the FTC consent orders that platforms live under. A platform with a long-running consent order has a compliance team that reviews removals before they happen. A smaller platform may not.

This is where critiques of social media often miss the legal layer. The criticism focuses on what platforms remove, but the removal duty comes from a mix of federal rules, state laws, and private contracts. Section 230 only sets the outer boundary of liability.

Terms also travel. A platform that applies one moderation standard worldwide may be violating a state design law at home. A platform that applies strict US standards abroad may face different problems. The contract is global, but the removal duty is local, and that mismatch is where compliance teams spend their time.

Litigation risk and the cost of getting removal wrong

Getting removal wrong cuts both ways. Remove too little and a state attorney general can sue under COPPA or the AADC. Remove too much and a user can sue for breach of contract or, in some states, for violation of a speech law.

Section 230 protects against the second kind of suit only if the removal was done in good faith.

The FTC has brought cases against platforms for misleading privacy promises. The Facebook FTC settlement history shows how a single consent order can create years of removal and reporting duties. The dollar figures are large, but the operational cost is larger: a compliance office, audits, and a removal process that can be reviewed by the agency.

State attorneys general have also become active. California, New York, and Washington have brought suits under their own privacy and design laws. Texas has sued platforms under HB 20. The risk is not just money. It is an injunction that forces a platform to change its removal rules nationwide.

Consent orders tend to outlive the people who signed them. A decree from a decade ago can still require annual assessments, third-party audits, and a named compliance officer. New product features get reviewed against a document written before those features existed. That is how a single enforcement action shapes removal practice for years.

To see how memes and virality platforms measure the platform rather than the harm, look at the FTC's own case data. The number of cases tells you about agency priorities, not about how much harmful content exists. That distinction matters when platform staff report to executives.

What a federal shield means for meme history and archives

Section 230 is why most memes survive. If platforms were liable for every user post, they would remove far more than they do now. The shield lets a platform leave a parody, a remix, or a shitpost up without a lawyer reviewing it first. That is the condition that made meme culture possible on US platforms.

Archives depend on the same shield. The Internet Archive hosts user-uploaded material and relies on Section 230 for much of it. The Library of Congress preserves copyright deposits, but it does not host the open web. Without the shield, archives would face the same liability as platforms and would have to remove first and ask later.

The state laws testing the shield could change that. A design code that requires age estimation could force archives to gate content. A viewpoint neutrality law could force them to keep content they would rather remove. Neither outcome is about memes directly, but both affect what stays online.

The Telecommunications Act of 1996, as described by the Telecommunications Act of 1996 | Federal Communications Commission, created the framework that Section 230 sits in. That framework is now under pressure from state laws that were not imagined in 1996. The meme record is caught in the middle.

For researchers, the practical consequence is that the primary record is unstable in a new way. A post that stays up for years can vanish when a platform changes a default setting to satisfy a state design code.

The removal is not censorship in the classic sense. It is compliance work, and it leaves no public trace unless someone archives the page first.

Reading Section 230 claims against the primary record

When you read a claim about Section 230, check the primary record. The statute text is short. The case law is long. A claim that Section 230 requires removal is wrong on its face. A claim that it blocks all state regulation is also wrong.

A useful test is to ask three questions. Does the law treat the platform as a publisher? Does it regulate design or data instead? Does it create a removal duty that exists outside Section 230? If the answer to the first is yes, the law likely fails.

If the answer to the second or third is yes, the law likely survives.

Worked example

Here is a worked example. A platform hosts a video of a 10-year-old at a protest, with the child's name in the caption. A parent files a COPPA deletion request. The platform must remove the video and the data. Section 230 does not block the removal because the duty comes from COPPA, not from publisher liability.

Now change one fact. The same video shows a 16-year-old, and the family lives in California. COPPA no longer applies because the child is over 13. The California AADC may apply instead, and the removal duty may be triggered by the platform's own design defaults. Same video, different law, different outcome.

Change the fact again. The video shows a 40-year-old official, and the complaint comes from Texas under HB 20. Now the question is viewpoint, not age. The platform may be barred from removing the video at all, which is the opposite of the COPPA result. Three complaints, three different duties, one post.

That test explains the current split. Texas HB 20 regulates viewpoint, which looks like publisher treatment, but the Fifth Circuit upheld it. California's AADC regulates design, which looks safer, but the Ninth Circuit blocked parts of it. The outcomes are not settled, and platform staff should track both.

Checklist for platform policy staff:

• Identify every state where the platform operates and list the speech and design laws in force.
• Map each removal duty to its legal source: COPPA, AADC, FTC Act Section 5, or platform terms.
• Confirm that FTC consent orders are reflected in the removal workflow.
• Track the Ninth Circuit and Fifth Circuit cases for changes in the preemption split.
• Document good-faith removal decisions so Section 230 immunity is preserved.
• Review privacy promises against actual removal practice at least once a year.

Common questions

Does Section 230 require platforms to remove anything? No. Section 230 is an immunity, not a removal mandate. Removal duties come from other laws, like COPPA, the California AADC, and FTC Act Section 5.

Can a state law override Section 230? Only if the state law does not treat the platform as a publisher. Courts have split on whether design and viewpoint laws cross that line, and the Supreme Court has not resolved it.

What is the difference between immunity and removal duty? Immunity blocks lawsuits against the platform for user content. A removal duty is an affirmative obligation to take content down, created by a different law or by the platform's own terms.

Which federal agency enforces removal duties? The FTC enforces COPPA and FTC Act Section 5. State attorneys general enforce state laws like the California AADC. Both can order deletions.

How does the California AADC differ from COPPA? COPPA covers children under 13 and requires parental consent and deletion on request. The AADC covers minors up to 17 and requires design changes and data protection assessments.

What should moderators watch for? Watch for state law complaints, FTC consent order requirements, and platform terms that promise removal. A removal that follows a clear legal duty is safer than one that follows a vague policy.