Apple defeats liability for not scanning iCloud for CSAM

This case involves Apple’s handling of user-uploaded files hosted in private iCloud storage. Instead of adopting PhotoDNA to scan hosted files for CSAM, Apple created its own proprietary alternative, NeuralHash , which apparently wasn’t as good. So Apple U-turned on its efforts to scan for CSAM in its cloud storage. Instead, Apple implemented end-to-end encryption for iCloud files.

Apple’s manuevers confused the public and seemed like an embarrassing unforced error for Apple. It also ensured pressure from governments and plaintiffs, including CSAM victims, who preferred Apple’s more interventionist approaches, which Apple had voluntarily demonstrated it was willing to do.

This lawsuit represents a full-scale attack on Apple and Section 230. “Plaintiffs allege that Apple’s failure to implement any known CSAM detection is a design defect because Apple can safely implement readily available features to prevent the spread of known CSAM but has continuously failed to do so.” Prior blog post . The court dismisses the third amended complaint, which tees this case up for the Ninth Circuit, where (as usual) anything could happen.

The court reiterates that Section 230 applies to the plaintiffs’ claims:

First, Plaintiffs’ claims treat Apple as a publisher or speaker of the CSAM content that animates Plaintiffs’ injuries. Fundamentally, Plaintiffs contend that Apple has elected to permit users to disseminate and share third-party CSAM content when it could have—and, in their view, should have—used readily available technology to prevent the distribution of child pornography depicting the Plaintiffs in this putative class. The duties Plaintiffs seek to invoke “spring[ ] from the defendant’s status as publisher,” and consequently, “immunity applies.” Second, immunity also applies because “the means to avoid liability requires [Apple] to act as a publisher.” As a result, Apple is entitled to complete immunity under § 230.

Plaintiffs’ injuries are the direct result of the actions of third parties who used iCloud to share CSAM, a use Apple neither explicitly condones nor prevents (even assuming—as alleged in the TAC—that Apple was aware of the use of iCloud for this purpose)….though Plaintiffs allege that Apple knew that its tools were likely to be used to distribute child pornography (as confirmed by the internal Apple text messages at the center of this case), under the current state of the law, Apple is still entitled to immunity under § 230—irrespective of that general knowledge….

Plaintiffs cannot avoid the fact that a tool that detects CSAM must review CSAM to make such a determination. And while Apple could have taken steps to do so—as its competitors have done by using PhotoDNA— Grindr confirms that § 230 bars claims arising from the design decisions Apple could have taken where those claims relate to Apple’s role facilitating the communication and content of others

(A reminder that the defendant’s scienter is irrelevant to Section 230).

The plaintiffs tried to fit into the new Section 230 exceptions created in Doe v. Twitter , but the court rebuffs the move:

This case does not concern or even discuss Apple’s content reporting systems; it concerns Apple’s “failure to implement industry-standard safeguards” against the dissemination of CSAM. Though reporting systems and CSAM safeguards may both be described as “defects,” the latter requires the Court to treat Apple as a publisher. Twitter “could fulfill its purported duty to cure reporting infrastructure deficiencies without monitoring, removing, or in any way engaging with third-party content”; Apple cannot fulfill a duty to institute CSAM safeguards without deploying a tool like NeuralHash or PhotoDNA. Both NeuralHash and PhotoDNA were built to monitor and report violative images uploaded to company servers. Yet just the decision regarding whether to deploy either tool is a choice related to content moderation.

Also, Apple didn’t fail to satisfy any duty to report items to NCMEC if it never identified CSAM in the first place.

The Lemmon v. Snap workaround fails: “all of Plaintiffs’ claims here are inexorably linked to third-party content; Plaintiffs do not allege that Apple created content like a Snapchat filter that caused them harm.” The Roommates.com workaround also fails: “Plaintiffs do not allege that Apple modified or augmented the CSAM on its servers in any way.”

The case reaches its inevitable denouement of a win for Apple. However, Judge Wise remains troubled about its implications. She expresses her uneasiness in stronger-than-normal terms:

As it stands, nothing in the law prevents any company, including Apple, from utilizing available technology or creating new technology to identify and report child pornography stored and distributed on their traditional servers or through their cloud services. Conversely, there is no law that obligates companies to proactively do so. Undoubtedly any such legislation would come at a cost of at least some loss of privacy for millions of people. But if lawmakers expected that companies would take steps to prevent their products from being used for storing and distributing child pornography based on something short of a legal imperative, this case, like many others before it, demonstrates the inadequacy of that approach. If lawmakers want to ensure that Apple and other companies address their role in the dissemination of CSAM, they must require it under the law. In other words, lawmakers can fix this problem that is contributing to the exploitation of children.

She goes through this framing pretty quickly, but we should slow it down. The “loss of privacy for millions of people” she briefly references deserves a little more care. The opinion downplays the encryption angle; it mentions encryption only twice, as if it’s an afterthought. However, encryption is the critical attribute underlying Apple’s moves. Forcing Apple to scan for CSAM in iCloud means breaking end-to-end encryption for everyone and all purposes, including: malefactors who would intercept private files for criminal purposes; and government actors who have repeatedly shown that they will break into, distribute, and weaponize privately stored file caches (I was just thinking about the North Korea Sony hack . Remember it?).

So yes, the “privacy loss” Judge Wise mentions indeed would be a major cost to everyone. Worse, it would ensure new victims have their sensitive, private, or abusive images nonconsensually intercepted and disseminated. (Do you recall the Fappening and Snappening ?) End-to-end encryption isn’t just some nice-to-have feature; it is one of the core planks of a technology architecture that keeps people safer.

This Order does not turn on whether Apple’s decisions contributed to Plaintiffs’ injuries. All Plaintiffs’ claims are founded on Apple serving as a publisher of third-party content. It is that role as “publisher” that is dispositive on the issue of immunity. This does not mean that the existence of images and videos of the putative class members being sexually abused—content that they allege is regularly stored and disseminated on iCloud—has not caused Plaintiffs real and lasting harm…

the outcome also adds credence to claims that the Ninth Circuit “has expanded § 230(c)’s scope to provide functional immunity to internet companies, even when they are aware (or should be aware) of unlawful content on their websites.” The practical outcome is that the current state of the law prioritizes privacy—a laudable and critically important value given that in our modern world nearly all our most personal and intimate data (including financial and health records) are stored and transmitted online. But the law should not ignore how those who create, view, and distribute child pornography leverage privacy protections to avoid detection by law enforcement. In the current legal framework, there is no protection for members of the putative class—individuals who as children were photographed and filmed while being abused in the vilest ways imaginable, and who now are repeatedly victimized each time the intimate and tortured images of their trauma are distributed to others. Those children are the collateral damage of our ineffective legal landscape. They deserve better.

Judge Wise isn’t well-situated to compare the relative strengths and limitations of the full range of potential anti-CSAM options, but a leading tool has always been and remains the government’s efforts to find and prosecute the creators, disseminators, and downloaders of CSAM. (Do you recall the federal government’s choices that leave children more vulnerable ?) Making sure the government is doing what it can should be the #1 priority. In contrast, breaking end-to-end encryption shouldn’t be anywhere in the regulatory toolkit.

Case Citation : Amy v. Apple Inc. , 2026 WL 2031817 (N.D. Cal. July 13, 2026). The complaint .

Copyright © 2026 Technology & Marketing Law Blog