A. B. v. SalesforceA. B. v. Salesforce
This interlocutory appeal centers around section 230 of the Communications Decency Act. Plaintiffs, a group of sex-trafficking victims, were trafficked through advertisements posted on Backpage.com, an online advertisement forum. They sued Salesforce, a company that provided cloud-
I
Salesforce is a business-software company that provides cloud-based customer-relationship-management (“CRM“) technology. Unlike traditional CRM technology, Salesforce‘s software allows businesses to dispense with rolodexes,1 physical files, CDs, or local databases and instead organize their customer data on Salesforce‘s servers. All types of businesses use this software, and Salesforce is the world‘s largest CRM-software provider.
Backpage was a Craigslist-style online advertisement forum. But it did not just provide a forum for advertising the sale of your couch before a big move—the website also included advertisements for erotic dancers and escort services. In fact, during a 2017 Senate investigation, Backpage did not deny that its site was used for criminal activity, including the sale of children for sex. That investigation eventually found that Backpage knowingly facilitated both prostitution and child sex trafficking, and had concealed evidence of criminal activity on its platform. Ultimately, the Department of Justice seized Backpage, and in 2018, Backpage pled guilty to human trafficking.
While Salesforce was providing its CRM software to Backpage, Plaintiffs A.B. and J.F. were trafficked through advertisements posted on Backpage for the Houston geographic area.2 In or around 2014, A.B. was sold for unlawful sex acts through force, fraud, and coercion. In or around 2018, J.F. was sold for unlawful sex acts by any means.
Plaintiffs sued Salesforce in the Southern District of Texas. Plaintiffs allege that Salesforce violated the Trafficking Victims Protection Act3 and chapter 98 of the Texas Civil Practice and Remedies Code.4 The thrust of the complaint is that by supplying its tools, support, and resources to Backpage, Salesforce knowingly facilitated sex trafficking and directly enabled Backpage to function.
Salesforce first moved to dismiss, arguing, inter alia, that section 230 shielded it from liability. The district court denied the motion with respect to the section-230 question and allowed limited discovery on that issue.
After denying Salesforce‘s motion for summary judgment, the district court sua sponte certified its order for interlocutory appeal. In its certification order, the court identified three controlling questions of law on which there may be substantial grounds for difference of opinion:
- Is Salesforce a provider of an “interactive computer service” such that it qualifies as an entity entitled to the protection of section 230‘s immunity provisions?
- Do Plaintiffs’ claims treat Salesforce as a publisher or speaker such that it can invoke the immunity provisions of section 230?
- If Salesforce is (a) a provider of “interactive computer services,” and (b) is treated as a publisher or speaker by Plaintiffs’ claims, may Plaintiffs nevertheless proceed with their federal and state law claims under the Fight Online Sex Trafficking Act‘s exemption to section-230 immunity?
A panel of our court granted leave to file an interlocutory appeal, and we now review the controlling questions of law de novo. Overdam v. Texas A&M Univ., 43 F.4th 522, 526 (5th Cir. 2022) (per curiam) (first citing Yamaha Motor Corp., U.S.A. v. Calhoun, 516 U.S. 199, 205 (1996); and then citing McMillan v. Amazon.com, Inc., 983 F.3d 194, 198 (5th Cir. 2020)).
II
Our “jurisdiction is not confined to the precise question[s] certified by the lower court[.]” Hernandez v. Results Staffing, Inc., 907 F.3d 354, 363 (5th Cir. 2018) (quoting United States v. Stanley, 483 U.S. 669, 677 (1987)). Because we can resolve this appeal by answering only the second certified
III
“Whenever a man publishes, he publishes at his peril.”5
That axiom no longer rings true in the internet era. In 1996, Congress enacted section 230(c)(1) of the Communications Decency Act: “No provider or user of an interactive computer service shall be treated as the publisher or speaker of any information provided by another information content provider.”
Section 230 provides immunity when the defendant is (1) the provider or user of an interactive computer service and (2) treated as the publisher or speaker of third-party content.6
Salesforce—standing accused of knowingly benefiting from participation in a sex-trafficking venture in violation of
The text of section 230, our precedent, and the precedent of our sister circuits uniformly reject the argument Salesforce advances. Instead, the
A
“As always, we start with the text.” Campos-Chaves v. Garland, 144 S. Ct. 1637, 1647 (2024) (citing Bartenwerfer v. Buckley, 598 U.S. 69, 74 (2023)). Section 230 plainly provides that no interactive computer service “shall be treated as the publisher or speaker” of third-party content.
A “careful exegesis of the statutory language” reveals that the central inquiry is whether a claim treats the defendant as a publisher or speaker. Barnes v. Yahoo!, Inc., 570 F.3d 1096, 1100 (9th Cir. 2009) (citing Fair Hous. Council of San Fernando Valley v. Roommates.Com, LLC, 521 F.3d 1157, 1171 (9th Cir. 2008) (en banc)). By focusing on the phrase “treated as the publisher or speaker,” we maintain fidelity to the statute Congress enacted—extending section-230 immunity no further than the text requires. Estate of Bride ex rel. Bride v. Yolo Techs., Inc., 112 F.4th 1168, 1175–76 (9th Cir. 2024) (citing Doe v. Internet Brands, Inc., 824 F.3d 846, 853 (9th Cir. 2016)).
Our precedent aligns with this common-sense reading of section 230‘s text. In Doe v. MySpace, Inc., we adopted a functional, claims-analysis approach to the question of whether a plaintiff‘s claim treats a defendant as a publisher or speaker of third-party content. 528 F.3d 413 (5th Cir. 2008). There, the plaintiff sued MySpace on a negligence theory of liability, alleging “fail[ure] to implement basic safety measures to prevent sexual predators from communicating with minors on its [web]site.” Id. at 416. We affirmed
Although much has changed in the sixteen years since we decided MySpace, one thing has remained constant: the text of section 230. To the extent that our cases since MySpace have understood the section-230 analysis as focusing on the specific claims and allegations advanced by a plaintiff, those cases have remained faithful to the text of the statute Congress enacted. See, e.g., Free Speech Coal., Inc. v. Paxton, 95 F.4th 263, 284–87 (5th Cir. 2024) (using a claims-analysis approach to distinguish “speaker-liability” from liability under Texas statute regulating the knowing and intentional publication or distribution of sexual material harmful to minors), cert. granted, 144 S. Ct. 2714 (2024); Diez v. Google, Inc., 831 F. App‘x 723, 724 (5th Cir. 2020) (per curiam) (“[Section] 230 creates federal immunity to any cause of action that would make internet service providers liable for [third-party content].” (emphasis added) (internal citations omitted)).
In Paxton, we rejected the plaintiffs’ misguided reading of MySpace that was akin to a but-for analysis of section 230‘s publisher-or-speaker question. 95 F.4th at 286. There, the plaintiffs argued that MySpace stood for the proposition that “Congress provided broad immunity under the [Communications Decency Act] to Web-based service providers for all claims stemming from their publication of information created by third parties.” Id. (quoting MySpace, 528 F.3d at 418) (emphasis added by plaintiffs). We concluded this interpretation—which would impute a but-for test into section 230—missed the point. See id. Instead, “[t]he emphasis, properly placed, would read ‘Congress provided broad immunity under the [Communications Decency Act]to Web-based service providers for all claims stemming from their publication of information created by third parties . . . .‘” Id. (quoting MySpace, 528 F.3d at 418) (emphasis in original). In other words, the emphasis, properly placed, would emphasize whether claims treat a defendant as a publisher or speaker, not whether third-party speech lies somewhere in the chain of causation.
Although we have not explicitly recognized as much, the MySpace analytical framework mirrors that of other federal courts—both sister circuits and district courts within our circuit.7
To determine whether a claim treats a defendant as a publisher or speaker, these courts look to the nature of the claim and the duties the plaintiff seeks to impose on the defendant. “To put it another way, courts must ask whether the duty that the plaintiff alleges the defendant violated derives from the defendant‘s status or conduct as a ‘publisher or speaker.‘” Barnes, 570 F.3d at 1102. For example, if the claim seeks to hold the defendant liable for “deciding whether to publish, withdraw, postpone or alter content[,]” the claim treats the defendant as a publisher or speaker and is barred by section 230. Zeran, 129 F.3d at 330.
In making this determination, a court can hypothesize what would happen if the allegations were true and the defendant were found liable. See Force v. Facebook, Inc., 934 F.3d 54, 82 (2d Cir. 2019) (Katzmann, C.J., concurring in part and dissenting in part); Yolo, 112 F.4th at 1176. A court may “look . . . to what the duty at issue actually requires: specifically, whether the duty would necessarily require an internet company to monitor[, alter, or remove] third-party content.” Force, 934 F.3d at 83 (Katzmann, C.J., concurring in part and dissenting in part) (quoting HomeAway.com, Inc., v. City of Santa Monica, 918 F.3d 676, 682 (9th Cir. 2019)). If it would, then the claim is barred by section 230. Id. This thought experiment serves a limited—
Like we did in MySpace and Paxton, other federal courts have rejected a mechanical approach to the publisher-or-speaker question. In MySpace, we held that a plaintiff cannot artfully plead around section 230 by casting their claims in terms of first-party conduct when they really seek to enforce a duty traditionally associated with publication. 528 F.3d at 420. In other words, it does not matter whether the plaintiff styles the claims in terms of publication. See id. It similarly does not matter whether publication is an explicit element of the plaintiff‘s claim. Force, 934 F.3d at 64 n.18. And critically, like we held in Paxton, the fact that third-party speech is involved somewhere in the chain of causation that led to a plaintiff‘s injuries does not mean that a plaintiff‘s claims necessarily treat a defendant as a publisher or speaker of that third-party speech. Internet Brands, 824 F.3d at 853; Force, 934 F.3d at 82 (Katzmann, C.J., concurring in part and dissenting in part); G.G. v. Salesforce.com, Inc., 76 F.4th 544, 567 (7th Cir. 2023).
This last point warrants some emphasis: the text of section 230 “does not mandate a ‘but-for test that would provide immunity . . . solely because a cause of action would not otherwise have accrued but for the third-party content.‘” Force, 934 F.3d at 82 (Katzmann, C.J., concurring in part and dissenting in part) (quoting HomeAway.com, Inc., 918 F.3d at 682); accord Paxton, 95 F.4th at 286; G.G., 76 F.4th at 567. In other words, section 230 “does not provide a general immunity against all claims derived from third-party content.” Internet Brands, 824 F.3d at 853; see also Calise v. Meta Platforms, Inc., 103 F.4th 732, 742 (9th Cir. 2024) (“[I]t is not enough that a claim, including its underlying facts, stems from third-party content for § 230 immunity to apply.“). Accordingly, providers of interactive computer services may be held liable for speech or conduct “that is properly attributable to them[,]” even if third-party speech exists somewhere upstream. Nemet Chevrolet, Ltd. v. Consumeraffairs.com, Inc., 591 F.3d 250, 254 (5th Cir. 2009); see also Anderson v. TikTok, Inc., 116 F.4th 180, 184 (3d Cir. 2024).
C
The heart of Salesforce‘s argument is that section 230 grants Salesforce broad immunity in all cases arising from the publication of third-party content. According to Salesforce, because the only link between Salesforce and Plaintiffs’ sex-trafficking-related harms is the illicit ads their traffickers posted on Backpage, Plaintiffs necessarily seek to treat Salesforce as the publisher or speaker of those ads.
Although some daylight may peek through between Salesforce‘s theory of section 230—let‘s call it the only-link theory—and a but-for analysis, we close the blinds on its theory for two reasons.
First, like the but-for analysis, the only-link theory would expand the grant of immunity beyond section 230‘s text. Yolo, 112 F.4th at 1176 n.2 (citing Internet Brands, 824 F.3d at 853). Under this theory, any time third-party content is the only link in the chain of causation, section 230 provides immunity—encompassing vastly more than claims that seek to treat a defendant as a publisher or speaker of third-party content. The propriety of such an extension raises interesting questions. The internet—and the world—have changed in numerous ways since 1996. Indeed, “cloud-based” only recently attained any non-meteorological significance. Whether this warrants an expansion (or contraction) in the scope of section-230 immunity
Second, the only-link theory cannot stand on its own two feet. According to Salesforce, if the only link between a plaintiff‘s harm and the defendant is third-party content, then section 230 bars the claims. On that logic, if there were some conduct by a defendant in addition to the third-party content, section 230 would not bar the claims. But what if the defendant‘s conduct fell squarely within section 230‘s text? For example, publishing defamatory third-party content. To say that in such situations section 230 would not provide immunity “taxes the credulity of the credulous.” Maryland v. King, 569 U.S. 435, 466 (2013) (Scalia, J., dissenting). But Salesforce‘s only-link theory, taken to its logical end, would require that anomaly. Avoiding that anomaly requires a focus on the type of conduct involved. In other words, it requires an analysis of whether the duty the defendant allegedly violated derives from their status as a publisher or speaker or requires the exercise of functions traditionally associated with publication. And that puts us right back where we started: the proper standard, derived from the statute Congress enacted.
Because neither the text of section 230 nor our precedent requires such a meandering analytical framework—that in any event leads right back to the proper framework—we decline Salesforce‘s invitation to go down the rabbit hole.8
We have expounded an analytical framework grounded in section 230‘s text and this court‘s precedent, which is also consistent with the precedent of our sister circuits. In line with those authorities, we ask “whether the duty that the plaintiff alleges the defendant violated derives from the defendant‘s status or conduct as a ‘publisher or speaker.‘” Yolo, 112 F.4th at 1177 (quoting Barnes, 570 F.3d at 1102). Answering this question “requires a close examination of the duty underlying each cause of action[.]” Id. at 1176 (quoting Barnes, 570 F.3d at 1107). If the duty “derives from the defendant‘s status or conduct as a ‘publisher or speaker[,]‘” then section 230 precludes liability. Id. at 1177 (quoting Barnes, 570 F.3d at 1102). But if the plaintiff‘s theories would not require the defendant to exercise some kind of publication or editorial function, then section 230 does not preclude liability. Id. Applying that standard here, Plaintiffs’ claims do not treat Salesforce as the publisher or speaker of third-party content.
Plaintiffs sued Salesforce asserting claims for knowingly benefiting from participation in a sex-trafficking venture under
To state the obvious: this duty does not derive from Salesforce‘s status or conduct as a publisher or speaker and would not require Salesforce
The same is true with respect to Salesforce‘s interactions with Backpage data.11 In this context, Salesforce argues that Plaintiffs’ claims would treat Salesforce as a publisher or speaker of data Backpage stored or transmitted using Salesforce‘s software. Such claims, Salesforce argues, would require Salesforce to police the use of its products and withdraw or restrict access from customers that misuse them by uploading or transmitting allegedly illegal content. This argument misses the mark in two respects.
First, the argument does not comport with the plain text of section 230. As the Seventh Circuit aptly explained,
It does not make sense to treat Salesforce as ‘publishing’ to Backpage itself content that came from Backpage. With respect to any content that was provided by Backpage, Salesforce fails
Section 230‘s ‘publisher or speaker’ element. To the extent that Salesforce might have ‘published’ its own data to Backpage‘s employees, Salesforce fails Section 230‘s [other] element, which requires that the published content be ‘provided by [a third party].’
G.G., 76 F.4th at 568 (citing
Second, the claims do not target actions that are “quintessentially related to a publisher‘s role.” MySpace, 528 F.3d at 420 (quoting Green, 318 F.3d at 471). While Salesforce argues it would be required to police the use of its products, that is not quintessentially the function of a publisher. See id. (quoting Green, 318 F.3d at 471) (monitoring, screening, and deletion of content from its network are actions quintessentially related to a publisher‘s role). Of course, a publisher might also need to police the use of its products. But that is not because of the publisher‘s unique functions. Rather, it is because a publisher—like Salesforce and every other entity subject to United States federal law—owes a statutory duty to the public not to knowingly benefit from participation in a sex-trafficking venture. See
To reach this conclusion, we do not accept any of Plaintiffs’ factual allegations as true. Although the section-230 publisher-or-speaker analysis often occurs at the motion-to-dismiss stage, the presumption that the allegations are true does not drive the analysis. Compare G.G., 76 F.4th at 548–49, with id., 76 F.4th at 566–67. Rather, the analysis focuses on the claims and theories of liability advanced by a plaintiff. See, e.g., MySpace, 528 F.3d at 420. “[W]hat matters is whether the cause of action inherently requires the court to treat the defendant as the ‘publisher or speaker’ of content provided by another.” Barnes, 570 F.3d at 1102 (emphasis added). To analyze the inherent nature of Plaintiffs’ causes of action, we must
To be sure, a plaintiff might use
But that is not the case here. Plaintiffs’ claims do not seek to hold Salesforce liable for failing to moderate content or any other functions traditionally associated with a publisher‘s role. See id. at 419–20. Rather, Plaintiffs seek to hold Salesforce liable for allegedly providing back-office business services to a company it knew (or should have known) was engaged in sex trafficking. These claims would not inherently require Salesforce, if found liable, to exercise any functions associated with publication.
The summary judgment evidence confirms this account, demonstrating that Plaintiffs do not seek liability for any publication-related functions. The evidence shows that Salesforce did not have any role in:
- screening, monitoring, or filtering content;
- reviewing or analyzing third-party content;
- transmitting or hosting third-party content;
- editing or altering third-party content;
- developing or enforcing content-moderation policies; or
- deciding how third-party content was organized or displayed.
This evidence also elucidates that Plaintiffs do not artfully plead around section 230 by shrouding an attack on functions associated with publication in terms of
On the topic of summary judgment evidence, one last point: the evidence highlights yet another flaw with Salesforce‘s only-link theory. Even
* * *
To sum things up: Plaintiffs’ claims do not treat Salesforce as a publisher or speaker of third-party content because they do not (1) derive from Salesforce‘s status or conduct as a publisher or speaker or (2) impose on Salesforce any duty traditionally associated with publication. As a result, section 230 imposes no barrier, and Plaintiffs’ claims against Salesforce may proceed. This conclusion follows from section 230‘s text and our precedent interpreting same. As an added benefit, this conclusion also aligns with the precedent of our sister circuits.
In deciding the section-230-immunity question, we say nothing about the underlying merits of this dispute. Although section 230 does not immunize Salesforce, that does not necessarily mean that Salesforce is liable.
V
Plaintiffs’ claims do not treat Salesforce as the publisher or speaker of third-party content, so we AFFIRM the district court‘s denial of summary judgment and REMAND for further proceedings consistent with this opinion.