The Ninth Circuit just decided Barnes v. Yahoo! (link to PDF opinion). Here are the facts, as summarized by Anita Ramasastry at FindLaw:

The facts begin when plaintiff Cecilia Barnes learned that her ex-boyfriend – pretending to be her – had posted nude photos of her on Yahoo, along with her email address, work address and phone number, and an invitation to men to contact her for sexual purposes. The ex-boyfriend had also gone into Yahoo’s member chat rooms to direct men to her profile. Soon, as the Ninth Circuit summarized it, "men whom Barnes did not know were peppering her office with emails, phone calls, and personal visits, all in the expectation of sex."

Yahoo’s policy provides for the removal of fake profiles if the person making the request provides a copy of her driver’s license, which Barnes says she did. However, Barnes alleges that when she contacted Yahoo on several occasions, in an effort to have the profile removed, the site did not remove them. She says that approximately three months after the first of these contacts, a Yahoo representative contacted her and advised her that Yahoo would now put a stop to this unauthorized profile – yet three more months passed, and Yahoo did nothing. Indeed, according to Barnes, Yahoo took no action to de-post the profile until she sued the company.


The court dismissed Barnes’s negligence claim against Yahoo, based on Section 230 of the federal Communications Decency Act (CDA).

Nothing new about that.

However, it held that Yahoo’s promises to her that it would de-post could give rise to a claim under the doctrine of promissory estoppel.

Interesting! Paul Levy at Consumer Law & Policy filed an amicus and attended the hearing, and fills us in on some context:

The argument also revealed that Barnes’ contention is that Yahoo!’s promise to take down her profiles came on the eve of a television report about her situation, after reporters contacted Yahoo! in an effort to avoid negative press, Yahoo! contacted her “on its own” to promise to take the material down, and that even though she could not have sued Yahoo!, there were other steps that she could have taken to obtain redress.  For example, she claims that, at Yahoo!’s direction, she did not testify before the Oregon Legislature about what had happened to her, because Yahoo! told her it would take the material down.  If Barnes proves such facts, one can see a real case here.

Daniel Solove at Concurring Opinions agrees with the result but looks on the horizon:

One of the potential problems with the court’s holding is that it may deter ISPs and other sites from having an explicit policy for removing tortious material.  Yahoo could be penalized with potential liability and a loss of its immunity by having a removal policy.  An ISP or site that has no such removal policy and that would say “get lost” to people who request takedowns would not be subject to promissory estoppel liability.  Is it fair to penalize those who have such policies?

But, Solove notes, we’re not at that point quite yet, since the Court’s holding was expressly limited, in that "Yahoo is liable not because it had a general removal policy, but because it made specific promises to Barnes." Evan Brown at Internet Cases sees ISPs changing their behavior nonetheless, in advance of the law:

Smart intermediaries (e.g. website operators) are likely to communicate less now with individuals who feel aggrieved, because the intermediary may fear that anything it says could be construed as a breakable promise putting it at risk for liability.

On a more technical issue, but one with big ramifications for the course of these case, Eric Goldman at Technology & Marketing Law Blog worries (much as Levy did) that the opinion on its face holds 230 immunity can not be raised on a motion to dismiss. That implicates the ISP’s First Amendment rights to go about their business and permit online speech without fearing the cost of a long, meritless suit that’s eventually dismissed anyway. Yahoo! has petitioned for rehearing on that issue alone.

In my humble opinion, I agree with everyone above. There is a very good reason not to apply section 230 immunity to an ISP interjecting itself into a private dispute to avoid negative publicity. At the same time, it does indeed create a precedent that makes other ISPs shy to intervene at all.

Yet, under section 230 immunity, the ISP already can choose to completely ignore anyone it wants to, and there is no good reason to "protect" Yahoo! for yanking Ms. Barnes’ chain to avoid negative publicity. If an ISP promises to remove content, it should do so. If the ISP doesn’t want to remove content, it shouldn’t promise it will.

Simple enough.