Judge tosses Apple iCloud CSAM suit under Section 230

Judge rules Apple is shielded by Section 230

A US federal judge has thrown out a proposed class action accusing Apple of failing to stop child sexual abuse images from being stored and shared via iCloud, holding that the claims fall within Section 230 of the Communications Decency Act.

Judge Noël Wise issued the dismissal order late on Monday, with prejudice, preventing the plaintiffs from refiling in district court.

The suit was brought in the Northern District of California in December 2024 by two survivors, identified as Amy and Jessica, on behalf of a proposed class of 2,680 people.

How the plaintiffs framed the case

The plaintiffs alleged that images of their childhood abuse continued to circulate on Apple’s cloud storage.

Their claims centered on NeuralHash, a content-detection system Apple announced in 2021 and later scrapped.

Recommended reading

Mira Murati’s lab unveils Inkling, a 975B open model

NeuralHash was designed to match photos against databases of known child sexual abuse material (CSAM) before they were uploaded to iCloud Photos.

Apple delayed rollout within weeks after researchers and privacy groups warned that such scanning infrastructure could be repurposed, and it formally abandoned the plan in December 2022.

The complaint initially sought around $1.2bn in damages; later filings raised compensatory damages to as much as $32.8bn, and asked the court to order Apple to detect, block, and report the material.

Section 230 at the center

Wise concluded that the plaintiffs were, in substance, trying to hold Apple liable for failing to remove or block user-created content.

That, she found, squarely places the claims within Section 230, the 1996 statute that prevents online services being treated as the publisher of user content.

She also held that no federal law requires Apple to build or deploy tools to identify and report CSAM on iCloud.

“Lawmakers can fix this problem that is contributing to the exploitation of children,” she wrote. “This Court cannot.”

Wise had previously dismissed an earlier version of the complaint while allowing the plaintiffs to amend it; Monday’s order ends the case at the district level.

Plaintiffs weigh appeal, push for new laws

Plaintiffs' lawyer Hillary Nappi told CNN by email that they are “reviewing Judge Wise’s ruling and evaluating our options.”

James Marsh, also representing the plaintiffs, said an appeal is under consideration, as well as whether other legal claims remain.

“This decision only adds urgency to the pending legislative efforts to ensure technology companies can be held accountable for the harm caused by their design choices,” Nappi said.

Apple has not commented publicly on the ruling.

In its filings, the company argued it had chosen other measures against abuse material, including Communication Safety, which warns children about sensitive images in Messages, instead of approaches it viewed as risky to user security.

Parallel case in West Virginia

A separate case over similar allegations is still live.

In February, West Virginia Attorney General JB McCuskey sued Apple in Mason County Circuit Court in what his office billed as the first such case by a government agency.

An Apple spokesperson said then that “protecting the safety and privacy of our users, especially children, is central to what we do.”

McCuskey’s complaint highlighted reporting disparities: in 2023, Apple made 267 reports to the National Center for Missing and Exploited Children, while Google filed 1.47 million and Meta made more than 30.6 million.

Apple has asked to move the West Virginia case to federal court, arguing the state’s claims are preempted by federal law.

Section 230 under wider pressure

The ruling lands in a year when courts have tested the outer limits of Section 230 by targeting platform design rather than user content.

Two cases sidestepped the statute, resulting in a $375m verdict against Meta in New Mexico and a smaller combined award against Meta and YouTube in California.

Outside the US, the debate is just as stalled.

The EU’s Child Sexual Abuse Regulation has been stuck in negotiations for four years over whether platforms can be forced to scan private messages at all.

For Apple, Wise’s decision shuts down the larger of its two US cases over iCloud and abuse imagery, arriving two months after a separate $250m settlement over Siri marketing in the same court.

Any appeal of Wise’s ruling would go to the Ninth Circuit.