Section 230 May Not Shield AI Companies From Chatbot Liability

A legal shield may have a critical gap

AI companies have operated under an assumption that Section 230 of the Communications Decency Act—the law that shields online platforms from liability for user-generated content—would protect them from lawsuits over their chatbots' errors and fabrications. That assumption may be wrong.

A recent German court decision held companies liable for their chatbots' mistakes, ruling that AI-generated content constitutes the company's own speech rather than third-party content. If U.S. courts or lawmakers adopt similar reasoning, major AI providers could face significant legal exposure for the hallucinations, defamations, and misinformation their systems regularly produce.

Why it matters

Section 230 has long protected platforms like Facebook and Twitter from liability when users post harmful content. But AI chatbots don't relay third-party speech—they generate their own outputs. If courts treat chatbot responses as direct company statements rather than intermediated content, AI firms would bear full responsibility for fabricated information, false medical advice, and defamatory statements. This distinction could fundamentally reshape AI development incentives, potentially forcing companies to prioritize accuracy over rapid deployment.

The Section 230 debate reaches AI

During May 2023 Senate testimony on AI regulation, Senator Dick Durbin noted the unusual spectacle of corporate representatives asking to be regulated. OpenAI CEO Sam Altman agreed with the proposition that Section 230 doesn't apply to generative AI and that developers should not receive full immunity for harms caused by their products.

Yet Altman's company recently supported Illinois state legislation that would shield AI labs from liability except in cases involving death or serious injury to 100 or more people, or property damage exceeding $1 billion—a threshold so high it would provide near-total immunity in practice.

A bipartisan group of senators who participated in that hearing—Lindsey Graham, Dick Durbin, Josh Hawley, Amy Klobuchar, Richard Blumenthal, and Marsha Blackburn—subsequently introduced legislation to sunset Section 230 protections. The bill faces long odds, with tracking services estimating only a 1 percent chance of enactment.

The third-party speech distinction

Section 230 was designed to protect internet service providers from liability when they host content created by others. If Provider X carries lies posted by Customer Y, Provider X isn't responsible for Y's statements.

But when Google's chatbot fabricates information, that output originates from Google's own software. The same applies to OpenAI, Anthropic, Microsoft, and other AI providers. Their systems don't merely transmit third-party content—they generate novel text that can include false accusations, medical misinformation, and fabricated facts.

One documented case involved a law professor falsely accused of sexual harassment by a large language model—an entirely fabricated allegation with no basis in fact. If companies were held liable for such outputs, they would face strong incentives to develop more reliable systems where hallucinations aren't an inherent feature of the technology.

These details were reported by Gary Marcus on AI Watch, who noted that legal expert Ryan Calo has indicated similar thinking about the distinction between platform liability and AI-generated content.