It started with a cruel prank on a message board. In 1996, the owner of a Seattle real estate magazine, Ken Zeran, sued AOL after anonymous users linked him to T-shirts trivializing the tragic bombing of an Oklahoma City government building. A US federal court ruled for AOL, reasoning that the authors, not the platform, were responsible. 

The US Code Section 230 of the Communications Decency Act, signed into law on February 8, 1996, codified that ruling into law, providing liability protection for publishers of third-party content. Four years later, the European Union followed with the E-Commerce Directive.  

Without these safe harbors, the Internet could not have bloomed into an economic and social powerhouse. Today, as platforms face increasing questions over hate speech, misinformation, data breaches, and online extremism, many are calling for reform.  

Here’s why Section 230 and its European near equivalent were so important. Imagine if YouTube were held responsible for every upload, Instagram for every comment, and TripAdvisor for each restaurant or hotel review? Such user-generated content would have been too dangerous to publish.  

This protection is key for e-commerce marketplaces and gig economy platforms, too. Should eBay, for example, be held responsible for comments about products its merchants sell? What if Airbnb became responsible for the conduct of its hosts and its guests, or Uber for its drivers and riders? Section 230 allowed small platforms to launch, forums to grow, marketplaces to thrive, and social media to metastasize.  

Without protections, Section 230’s authors feared platforms would overcorrect and chill innovation. Senator Ron Wyden, an author of the text, called it the “26 words that created the internet,” not because they solved everything, but because they created legal breathing room and encouraged good-faith content moderation.  

For nearly two decades, Section 230 did exactly what it was meant to do: it gave legal certainty to a chaotic new space. It supported participation without requiring pre-approval from lawyers for every comment, post, or listing.  

But as public trust in platforms has collapsed, accountability has come calling. Data scandals, misinformation, hate speech, and online radicalization spread. The platforms of the internet economy were behemoths, seemingly untethered and free from liability. 

A bipartisan effort swelled to reform Section 230. Critics on the left argued it let platforms profit from harm with no real incentive to act. Critics on the right claimed it enabled censorship and silenced speech. Lawmakers introduced dozens of bills: repeals, carve-outs, conditional protections, and everything in between. Both 2020 Presidential candidates, Biden and Trump, publicly stated that something needed to be done with Section 230.  

Yet legislative efforts to reform Section 230 have come to naught. Reform efforts have shifted to the Courts, and the legal question is whether the design of products like Snap, TikTok, and YouTube is harmful and addictive. Those cases are ongoing.  

In contrast, European policymakers have passed a powerful new regulatory tool to address platform accountability, the Digital Services Act. Crucially, the DSA maintains the E-Commerce Directive’s all-important liability protections. When European parliamentarians pressed to extend the liability of platforms in other pieces of new regulations, ranging from payments to customs, tech companies have placed urgent calls to regulators, and European Commission officials responsible for the DSA swung into action and pushed back. 

But the DSA imposes new responsibilities on platforms for removing illegal content. Companies risk billions in fines if they fail to remove flagged hate speech, terrorist propaganda, and other illegal material. Just this week, French authorities raided the Paris offices of social media platform X over allegations involving the distribution of child sexual images and producing content denying crimes against humanity. 

Transatlantic tensions are rising over platform liability. Washington portrays the DSA as an attack on free speech and has even placed travel restrictions on Europeans campaigning against online misinformation.  

Lost in that noise is Section 230’s original purpose: not to shield platforms from all responsibility, but to make scale possible without assigning strict liability for every third-party listing or post. It didn’t promise that platforms would do the right thing. It just made it possible for them to exist without collapsing under legal risk. It was created when our current internet ecosystem was unimaginable.  

Today, we are staring down an innovative moment with generative AI reminiscent of the early days of the Internet. Except this time, it isn’t platforms just hosting content. Generative AI sites are creating content, synthesizing speech, mimicking people, generating images, and shaping the English language itself. The risks are different. The scale is even greater. 

The governance pattern looks familiar — at least in the US: move fast, prioritize growth, worry about accountability later. In Europe, the instinct is to regulate fast, especially in areas touching fundamental rights. 

On this 30th anniversary, it is time to look at the intention of Section 230 and recognize that it worked for the Internet imagined at the time. It was tailored to a moment in 1996, when the goal was to enable user participation and prevent new services from being crushed under legal risk before they had a chance to grow.  

But Section 230 wasn’t built for what came next: social media platforms operating on a global scale, content amplified by algorithms, and entire markets shaped by user behavior. As AI moves from experimentation to infrastructure, it will need a different structure — not one tied to this moment, but one designed to flex with the future. Rules should be developed that encourage innovation and remain nimble enough to adapt as risks evolve. 

The EU has moved decisively with its AI Act, creating a risk-based framework. In contrast, the United States has taken a more pro-innovation approach based on executive orders and America’s Action AI plan that promotes AI technologies and encourages investment. 

As we celebrate Section 230’s birthday, a middle ground must be found. Section 230 and the E-Commerce directive offered legal clarity at a pivotal moment. They now need to be adapted to a new AI-driven era. 

Hillary Brill is a Senior Fellow with the Tech Policy Program at the Center for European Policy Analysis (CEPA). She founded HTB Strategies, a legislative consulting firm for Fortune 500 companies and other clients, and also teaches Copyright Law and a new Technology Policy Practice.  

Bandwidth is CEPA’s online journal dedicated to advancing transatlantic cooperation on tech policy. All opinions expressed on Bandwidth are those of the author alone and may not represent those of the institutions they represent or the Center for European Policy Analysis. CEPA maintains a strict intellectual independence policy across all its projects and publications.

The post Three Decades of the 26 Words That Built the Internet  appeared first on CEPA.