Products Liability Law Daily Wrap Up, DESIGN AND MANUFACTURING DEFECTS—ELECTRONIC PRODUCTS—N.D. Cal.: Apple is immune from liability for CSAM shared over iCloud, (Jul 15, 2026)

By Molly Platnick

Recognizing a gap in the law, the court found Apple was protected from suits treating it as a publisher.

The federal district court for the Northern District of California granted Apple Inc.’s motion to dismiss in a putative class action brought by victims of CSAM (child sexual abuse material). The victims’ Third Amended Complaint alleged the company was liable for defectively designing its iCloud service because it failed to prevent CSAM possession and distribution. Apple raised the affirmative defense of immunity under § 230 of the Communications Decency Act, which bars suits that treat internet platforms as publishers of third-party content. The court reviewed a line of recent Ninth Circuit rulings on § 230 immunity and concluded Apple was immune because the suit treated the company as a publisher and a favorable ruling would require it to act as a publisher. The court recognized the harm Apple had caused the victims, but held it was bound by law and precedent (Amy v. Apple Inc., No. 24-cv-08832-NW (N.D. Cal. July 13, 2026)).

Factual background—from initial complaint. The named plaintiffs are victims of child sex abuse. When they were young children, in the early 2000s, male relatives “repeatedly raped and exploited” them for the “express purpose” of uploading CSAM on the internet. Child predators continue to trade and distribute that content, and “hundreds” of defendants have been charged or convicted for possessing CSAM depicting these victims through Apple products. The Third Amended Complaint (TAC) identifies “dozens” of putative class members whose sexual abuse was filmed and shared as CSAM.

The victims alleged Apple knew its iCloud service, which automatically updates, syncs, and saves user data, was defectively designed because it did not include CSAM-detection technology. They referenced a series of 2020 text messages the company’s then anti-fraud chief sent, admitting, “When it comes to privacy…the priorities at Apple…suck…which is why Apple is the greatest platform for distributing child porn.” The executive continued, “Apple has chosen not to know about CSAM in enough places.”

As evidence of an alternative available design, the victims pointed to PhotoDNA, a program which Apple’s “peer competitors” use to “affirmatively identify and report CSAM to law enforcement.” In 2021, Apple responded to public pressure by announcing the launch of NeuralHash, a program it claimed would protect user privacy better than PhotoDNA. This boast immediately proved inaccurate, and, less than a month later, Apple delayed rolling out NeuralHash. The following year, the company announced it would not add NeuralHash or any other CSAM detection tool to its products. In 2023, asked to explain why Apple abandoned NeuralHash, the Director of User Privacy and Child Safety said image-scanning technology compromises user privacy and that the company “prioritizes security and privacy of [their] users.”

In the TAC, the victims brought claims for products liability, negligence, and intentional infliction of emotional distress.

Procedural history. The court dismissed the victims’ First Amended Complaint in October 2025 because they had not satisfied their burden under “Masha’s Law” (18 U.S.C. §§ 2252, 2252A, and 2255). Masha’s Law inflicts a civil penalty on anyone who has by any means “knowingly” received, distributed, or possessed “any visual depiction…of a minor engaging in sexually explicit conduct.” Here, the court found the victims did not show Apple knowingly received or distributed CSAM, only that it was “willfully ignorant” there was CSAM on its servers. In Does 1-6 v. Reddit, the Ninth Circuit held a publisher’s willful ignorance on its own does not amount to sex trafficking under Masha’s Law.

Immunity under CDA § 230. The court dismissed the TAC based on § 230 of the Communications Decency Act (CDA) because (a) the victims’ suit was based on Apple’s status as a publisher of CSAM and (b) Apple could only avoid liability by acting as a publisher. Under § 230, a party is immune from liability if (1) it is a provider of an interactive computer service (2) whom a plaintiff seeks to treat…as a publisher (3) of information provided by another content provider. The Ninth Circuit established a two-part analysis to determine whether a defendant is being treated as publisher: (1) does the suit “spring” from the defendant’s duty as a publisher and (2) must the defendant act as a publisher to fulfill that duty. The court here concluded Apple was entitled to immunity based on the Ninth Circuit’s binding decisions in a string of recent cases interpreting § 230.

Earlier this year, in Doe 1 v. Meta Platforms, the Ninth Circuit dismissed plaintiffs’ contention Facebook was liable for anti-Rohingya violence. The court there ruled Facebook was immune because third parties posted the content promoting ethnic violence. In the instant case as well, third parties used iCloud to share the injurious content. There was no evidence Apple was aware of specific users disseminating CSAM, and general knowledge is not enough to defeat § 230 immunity.

Apple relied heavily on Doe v. Grindr. In that case, a minor who misrepresented himself as over 18 was sexually assaulted by a man he met through defendant’s app. The victim sued, arguing the app was defectively designed because it did not prevent minors from matching with abusive adults, even though there was a safer alternative design. The Ninth Circuit rejected this theory, finding that regulating the challenged features of the app would amount to treating Grindr as a publisher of third-party content. The court here called the victims’ claim “nearly identical” because it was based on Apple’s “failure to implement” CSAM-detection technology. Applying Grindr, the court ruled § 230 prohibits claims based on design decisions meant to facilitate third-party content.

The victims supported their case with Doe 1 v. Twitter, which, in their reading, held (1) claims regarding a platform’s reporting and safety systems do not treat the defendant as a publisher and (2) § 230 does not preclude claims based on a platform’s independent statutory duties. The court disagreed. First, the instant case was based on regulation of CSAM, not content-reporting systems. Whereas Twitter could address the “defect” without policing third-party content, Apple could only monitor CSAM through NeuralHash or PhotoDNA. Mandating Apple to use this kind of program would amount to exactly the content moderation § 230 is meant to prevent. Second, Twitter requires platforms to report CSAM only when they have actual knowledge. Apple did not have a statutory duty to inspect its servers for CSAM.

The court was not persuaded by the victims’ reference to Lemmon v. Snap. Plaintiffs in that case challenged a Snapchat filter which they believed encouraged reckless driving by showing a user’s speed while traveling. In that case, Snap was liable because there was evidence its filter incited the car crash at issue. Snap directly designed the injurious content; Apple was only the platform for third parties.

Gap in the law. The court went to great pains to make clear its decision was bound by precedent and shortcomings in § 230. It clarified Apple’s immunity for publishing third-party content did not discount the “real and lasting” harm that having the CSAM stored on iCloud has caused the victims. The court acknowledged that the cumulative effect of the decisions cited above was that “the current state of the law prioritizes privacy,” and “in the current legal framework, there is no protection for…individuals who as children were…filmed while being abused.” The court called for changes in the law, but concluded Apple was immune within § 230.

The case is No. 24-cv-08832-NW.

Judge: Wise, N.

Attorneys: Helene Marie Weiss (Marsh Law Firm PLLC) for Amy. Emily Johnson Henn (Covington & Burling LLP) for Apple Inc.

Companies: Apple Inc.

MainStory: TopStory CourtDecisions DesignManufacturingNews ElectronicProductsNews CaliforniaNews GCNNews