The AI Liability Gap: Why the Law That Built the Internet Was Never Meant to Protect Machines

NewsOnScale Staff

July 7, 2026

Thirty years ago, Congress inserted 26 words into the Communications Decency Act that would quietly determine the architecture of the internet. Section 230 told courts that online platforms were not publishers in the traditional legal sense — they could host what their users said without bearing responsibility for the consequences. It was a pragmatic call at the dawn of a new medium, and it worked, in the sense that an enormous commercial internet did in fact get built.

Now that framework is straining under the weight of a technology its authors never imagined.

## What 230 Was Actually Designed to Do

The original logic of Section 230 rested on a specific premise: a platform is a conduit, not an author. When a user posts something defamatory or harmful, the platform didn't write it. Holding the host liable for every piece of user content would have made moderation economically impossible and would have chilled the entire project of open online communication before it started.

That premise made sense in 1996. It makes considerably less sense when the "platform" is generating the content itself.

Large language models and AI-driven recommendation engines don't merely transmit user speech — they produce outputs, rank information, and in some cases fabricate claims with no human author anywhere in the chain. Extending Section 230 immunity to that category of activity is not a conservative reading of the statute. It is an expansion that the law's text does not obviously support and that its legislative history does not contemplate.

## The Pressure Points Are Multiplying

The Massachusetts Supreme Judicial Court recently signaled that design-based claims against social media platforms may not be blocked by Section 230 — a ruling that legal observers are watching closely as a potential template. The theory is straightforward: if a company makes deliberate engineering choices that cause foreseeable harm, that is product liability, not publisher liability. The statute shields you for what your users say. It was not written to shield you for what your algorithms decide to do to them.

Applied to AI, the argument sharpens considerably. When a generative model produces a false and damaging statement about a real person, or when an AI agent takes an action in the world that causes financial or physical harm, there is no third-party user to point to. The system is the author. The company that trained, deployed, and profited from that system is the closest available analogue to a publisher under any conventional legal framework.

## Why This Matters for the Agent Economy

The stakes are not abstract. AI agents — systems that browse the web, send communications, execute transactions, and interact with infrastructure on behalf of users — are moving from research demos to commercial deployment at speed. The legal accountability structure governing their behavior is, at present, largely undefined.

If incumbents successfully argue that Section 230 covers AI-generated outputs, the practical effect is a liability-free zone for some of the most consequential software ever deployed. Startups without the lobbying resources to shape that interpretation will face an unlevel playing field. Consumers harmed by AI systems will face courts that have no clear doctrine to apply. And the public interest in knowing who is responsible when an AI system causes harm will go unserved.

## The 30-Year Review Is the Right Moment

Congress is revisiting Section 230 now, in part because the political coalition that once defended it has fractured and in part because the technology landscape has changed beyond recognition. That review should not be treated as an opportunity to weaken legitimate protections for user speech — those protections still matter. But it is precisely the right moment to draw a line between immunity for hosting human expression and immunity for the behavior of autonomous systems that companies build, own, and deploy for profit.

The 26 words that built the internet were written for a world of message boards and comment sections. They were not written for agents. Treating them as if they were is not fidelity to the statute. It is an abdication of the accountability question the law was never asked to answer.