Apple Defeats Liability for Not Scanning iCloud for CSAM, But the Judge Was Not Pleased–Amy v. Apple

2026-07-20 · Source: Technology & Marketing Law Blog · Field: Legal & Regulatory — Compliance & Risk Management, Regulatory Affairs & Government Relations, Litigation & Dispute Resolution · Depth: Advanced, medium

Summary

A federal court has dismissed the "Amy v. Apple" lawsuit, which sought to hold Apple liable for not scanning iCloud for Child Sexual Abuse Material (CSAM). Plaintiffs argued Apple's failure to implement detection tools like PhotoDNA or its own NeuralHash constituted a design defect. The court reaffirmed that Section 230 of the Communications Decency Act grants Apple immunity, treating it as a publisher of third-party content. Judge Wise, while bound by precedent, expressed significant concern about the legal landscape, noting that no law obligates companies to proactively detect CSAM and that current law prioritizes privacy. This outcome highlights the tension between protecting end-to-end encryption, which Apple implemented for iCloud, and preventing the dissemination of illegal content.

Key takeaway

For policymakers considering new legislation on online content, this ruling underscores that Section 230 currently protects platforms like Apple from liability for not proactively scanning user-uploaded content. If you aim to mandate CSAM detection, you must enact specific laws, acknowledging this will likely necessitate breaking end-to-end encryption and incurring significant privacy costs for all users. Focus on strengthening government efforts to prosecute offenders rather than undermining fundamental privacy protections.

Key insights

Section 230 immunity shields platforms from liability for third-party content, even when aware of its misuse.

Principles

• Section 230 immunity applies when claims treat a platform as a publisher.
• Defendant's scienter (knowledge) is irrelevant to Section 230 immunity.
• Design decisions related to content moderation are protected by Section 230.

Topics

• Section 230
• CSAM Detection
• iCloud
• End-to-End Encryption
• Content Moderation
• Internet Law
• Privacy

Best for: CTO, VP of Engineering/Data, Executive, Legal Professional, Policy Maker, AI Ethicist

Related on AIssential

• Section 230 Doesn’t Apply to Generative AI Enhancements to Ad Copy (But the Plaintiffs Lose Anyway)–Bouck and Suddeth v. Meta — Section 230 immunity may not apply when generative AI tools materially contribute to creating illegal content, but other legal challenges persist.
• “World domination” by a coordinated cabal is not supported; the realistic danger needs no cabal. Ambient, profit-driven mass surveillance, plus a handful of opaque choke-point firms... — The core danger to civil liberties stems from profit-driven mass surveillance and opaque platform control, not a coordinated "Big Tech" cabal.
• The Promise and Limits of the TAKE IT DOWN Act — The TAKE IT DOWN Act introduces federal criminalization and a notice-and-takedown system for non-consensual intimate images, but faces significant implementation challenges.
• San Francisco orders Apple, Google to remove nudify apps from app stores — App stores face increasing legal and ethical pressure to remove AI-powered nudification and deepfake content generation apps.
• xAI can’t deny Grok makes CSAM anymore. So it’s suing users. — xAI is suing a user to establish user-only liability for AI-generated illegal content, framing its chatbot as a neutral tool.
• Democrats’ ‘Project 2029’ goes after tech companies with online safety plan — A Democratic policy group proposes comprehensive online child safety regulations, including Section 230 reforms and age restrictions, for the 2028 election.

See Counsel's argued verdicts on the open AI decisions leaders are weighing →

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by Technology & Marketing Law Blog.