How FOSTA-SESTA Rewrote the Rules for Online Platforms
Eight years after Congress carved sex trafficking out of Section 230, the law's biggest effects have landed on speech, not prosecutions.
In the space of five days in April 2018, the legal ground under the American internet shifted. On April 6, federal agents seized Backpage, the largest classified advertising site for commercial sex. On April 11, President Trump signed a bill at a White House ceremony surrounded by members of Congress and trafficking survivors, legislation that most Americans had never heard of until that moment: a package combining the Senate's Stop Enabling Sex Traffickers Act and the House's Fight Online Sex Trafficking Act, known ever since by its merged name, FOSTA-SESTA. The House had passed it 388 to 25, the Senate 97 to 2, and the bill's opponents could fit in a single room. On paper the law did one thing. It carved an exception out of Section 230 of the 1996 Communications Decency Act, the provision that had protected websites from being sued over what their users post. That single amendment was marketed as a narrow strike against sex trafficking. Eight years later, its real legacy is visible almost everywhere except the courtroom.
To understand why one change to one statute caused so much commotion, it helps to remember what Section 230 actually did. Written in 1996 by Senator Ron Wyden and Representative Chris Cox, it made two promises to platforms. You are not treated as the publisher of what your users upload, and you will not be punished for trying to clean up your site. That bargain let the modern internet get built. Review sites, forums, comment sections, marketplaces, and eventually social networks could all exist because the cost of hosting strangers' speech did not include unlimited legal liability for it. Courts read the shield broadly, and for two decades it survived nearly every challenge. Both of its authors opposed FOSTA-SESTA to the end, arguing that the first crack in the shield would not be the last. The timing is a detail worth keeping. In that same week, Mark Zuckerberg was enduring his first marathon congressional hearings over the Cambridge Analytica scandal, and the political class managed to conclude, almost simultaneously, that platforms were dangerously unaccountable and that platforms should be made personally responsible for the speech of billions of strangers.
The pressure that finally cracked the shield came from a single company and a moral campaign that grew around it. Backpage's adult listings had drawn the ire of prosecutors, senators, and advocacy groups for years, and court after court kept concluding that Section 230 protected the site anyway. A 2016 decision from the First Circuit was typical: heartbreaking accounts from trafficking victims did not change the legal analysis. A 2017 Senate subcommittee investigation had concluded that Backpage moderators edited ads to strip out incriminating words before publication, which supporters cited as proof the site was an active participant rather than a passive host. The documentary I Am Jane Doe framed Backpage as a corporate predator, advocacy ads claimed children were being sold online "as easy as ordering a pizza," and the Manhattan district attorney Cy Vance told reporters that prosecutors could not pursue "the websites that profited from the ads placed by these vile operations." The campaign's sequencing helped too. Backpage was seized first, and the bill was signed days later, so public memory fused the two into a single victory. When the votes were counted, the two senators who balked were Ron Wyden and Rand Paul. Even the Justice Department, which rarely comments on pending bills, had warned in a memo that the draft text was written so broadly it could reach a person using a phone to arrange legal adult transactions.
What Congress passed reached three federal statutes at once. It created a new crime, 18 U.S.C. 2421A, making it a federal offense to run an online platform with the intent to promote or facilitate prostitution, punishable by up to ten years in prison, with an aggravated version carrying up to twenty five years when five or more people are involved or the operator acts in reckless disregard of sex trafficking. It amended the federal sex trafficking statute so that "participation in a venture" now includes knowingly assisting, supporting, or facilitating a trafficking violation. And it amended Section 230 itself, stripping immunity for any claim, criminal or civil, state or federal, that rests on those offenses. For the first time since 1996, platforms could be held responsible for what their users did.
The text mattered less than the fear it produced. The key word, "knowingly," sounds precise. In practice, lawyers could not say where awareness of user speech ends and criminal facilitation begins, and the law gave platforms no safe harbor for guessing right. A platform that moderates aggressively generates internal records proving it knew what was on its site. A platform that moderates lightly looks reckless in hindsight. Congress removed the option of testing the boundary cheaply, because a mistake could mean a criminal case, a civil suit from trafficking victims under 18 U.S.C. 1595, or a prosecution launched by any state attorney general. The civil track matters as much as the criminal one. Before 2018, suits against platforms over user postings were dismissed early and often on Section 230 grounds. After FOSTA-SESTA, a victim who can show a platform knowingly assisted or facilitated trafficking can sue for damages in federal court, and state attorneys general gained a criminal tool they had sought for years. For a platform, the rational response to all of this was not careful moderation. It was removal, and plenty of it. The removals came fast, and they went far beyond the sex trade. Craigslist shut its personals section within a day of the bill clearing Congress, saying it could not take the risk without jeopardizing everything else it ran. The furry personals site Pounced.org closed entirely, explaining that a volunteer run project could never monitor every listing to the standard the law seemed to demand. Reddit banned whole communities preemptively. Google reportedly began flagging sexual material even in users' private Drive files. Cloudflare, which provides the plumbing a huge share of the internet depends on, terminated service to Switter, a social network built for sex workers that had launched just weeks earlier, citing the new law. Discord and Patreon quietly rewrote their guidelines to push sexual content away, sometimes without announcing the change at all. Small communities that had nothing to do with trafficking disappeared because their moderators could not afford a lawyer. By December, Tumblr announced a total ban on adult content, an act of corporate self preservation after its app had been pulled from the Apple store, and its clumsy filters became a running joke for flagging everything from classical art to LGBTQ support posts. The joke had a hard edge. Tumblr had been one of the last mainstream homes for sexual speech outside corporate respectability, and it never recovered its cultural role.
The enforcement record
Supporters sold FOSTA-SESTA as a law enforcement tool. The record since 2018 says otherwise. In June 2021, the Government Accountability Office published a report that quietly demolished the law's rationale. Federal prosecutors had brought exactly one criminal case under the new statute, and even that was under the aggravated provision rather than the core offense. No criminal restitution had been sought. No civil damages had been awarded. The single civil suit filed under the law had been dismissed in March 2021. Department of Justice officials told the GAO the statute simply was not needed, because prosecutors were winning with older tools like the Travel Act, racketeering, and money laundering charges. The report counted at least eleven criminal cases from 2014 through 2020 against people who ran platforms in the commercial sex market, and only one rested on the new law. Those older cases had also put at least 85 million dollars in accounts in line for seizure or forfeiture, the GAO's tally shows. The pattern runs backward as well as forward. The ad sites MyRedbook in 2014 and Rentboy in 2015 were shut down and their operators prosecuted using the Travel Act, years before anyone touched Section 230. Each of those successes was cited as proof the shield had to fall, and each proceeded without touching it. Backpage's own operators were convicted in 2023 on charges including money laundering and facilitating prostitution, brought under statutes that required no amendment to Section 230 at all. Parts of those convictions were later trimmed on appeal, but the point stands: the law's centerpiece case was prosecuted without it.
The GAO found something worse than uselessness. By the government's own account, the combined effect of the Backpage seizure and FOSTA-SESTA pushed the online commercial sex market overseas and underground, where platforms use foreign hosting, cryptocurrency payments, and encrypted channels. Buyers and sellers scattered across a fragmented patchwork of smaller sites and social media apps. Law enforcement officials told the agency that gathering tips and evidence had become harder, and some said the law removed one of the best tools police had for finding trafficking cases. The open, searchable, card paying advertising market that investigators used to locate victims and build cases broke into a thousand dark corners. A law sold as a rescue mission made the people it meant to rescue harder to find. The ones who absorbed the shock were not platforms. Sex worker led research told a consistent story in numbers. The Erased report, a participatory study published by the collective Hacking//Hustling about eighteen months after the law passed, found that more than 72 percent of online working respondents reported increased economic instability, and nearly 34 percent reported increased violence from clients. The mechanisms were specific and unglamorous. Client verification services like VerifyHim shut down or retreated, and shared "bad date" lists that workers used to warn each other about violent buyers went offline with them. A separate health survey found workers pushed back to street work and reporting worsening symptoms, with transgender workers facing higher risk of violence. Researchers documented spillover even into New Zealand, where sex work is decriminalized and the law has no direct force. Removing online infrastructure did not remove the work. It removed the safety features people had built on top of it.
That collateral damage is the platform story, not a footnote to it. FOSTA-SESTA never ordered anyone to delete a sex worker's account or a sex education post. It made deletion the cheapest option and let every platform's risk department do the rest. Massage therapists, sex educators, LGBTQ youth groups, and breast cancer awareness pages all found their material caught in filters tuned to avoid any whiff of liability, and Etsy sellers offering handmade lingerie or vintage erotica watched listings vanish without explanation. Legal scholars had spent years arguing that Section 230 needed exceptions for the worst abuses; after 2018, the argument shifted from whether to carve into the shield to how much. Congress had effectively handed a vague legal standard to thousands of companies and told them to invent their own definitions, and each company resolved the ambiguity the same way, in the direction of less speech. The law taught a generation of trust and safety teams that false positives cost nothing and false negatives might cost everything. Overcompliance was not a bug of the system. It was the design.
The template
The First Amendment challenge to the law nearly reached the merits, which is more than most observers expected. The Woodhull Freedom Foundation, joined by a massage therapist, a sex worker, the Internet Archive, and Human Rights Watch, argued that the statute criminalizes speech about entirely legal activity and is unconstitutionally vague. Law professors supporting the challenge pointed out that the statute reaches speech about conduct that is legal in much of the world and fully protected when it happens offline. A federal appeals court dismissed the case in 2020 on standing grounds, deciding the plaintiffs had not shown a concrete enough injury, and the Supreme Court declined to take it up in 2022. Kendra Albert, a Harvard Cyberlaw Clinic instructor who worked on the case, later described the trap: the vagueness that makes the law chilling also makes it hard to prove you have been chilled. When the Supreme Court finally did strike down an internet age verification law in 2025, in Ashcroft v. Free Speech Coalition, it showed real skepticism toward overbroad speech regulation online. FOSTA-SESTA itself remains on the books, its constitutional question untouched by any court that reached the substance.
Its deeper legacy is that the law worked as a proof of concept. For two decades, amending Section 230 was treated as politically radioactive, the third rail of internet policy. FOSTA-SESTA showed Congress the rail could be touched if the cause was framed as protecting children, and it supplied the template: find a category of harm no one will defend, write a carveout into Section 230, and leave platforms to handle the details. Proposals that once would have triggered filibuster threats now arrive with bipartisan sponsorship and friendly hearings. The EARN IT Act has recycled that structure for years, proposing to strip immunity from platforms that refuse government shaped best practices on child exploitation material, and it has cleared the Senate without ever becoming law. The Kids Online Safety Act, which passed the Senate in 2024 with overwhelming support before stalling in the House, presses platforms toward age verification and broad duties of care. At the state level, Texas and a growing list of others now require adult sites to verify the age of every visitor, a regime the Supreme Court upheld in 2025. Each of these fights happens in a world where the first carveout already exists and the overcompliance machinery it built hums along quietly.
The pattern extends past legislatures. Payment networks and app stores never needed a statute to impose their rules, and they tightened adult content policies in the years after 2018. In 2021 Mastercard began requiring adult content sellers to document the age and consent of everyone appearing in their material, a private compliance regime with the practical force of law, since losing card processing is fatal to an online business. OnlyFans learned that same year that a single card network's compliance demand could threaten its entire business overnight, announcing and then partially reversing a ban on adult content within days. The same squeeze concentrated the market. With mainstream platforms closed off, creators and consumers migrated to a handful of subscription platforms, replacing a diffuse, searchable network with a few gatekeepers holding payment levers. FOSTA-SESTA normalized the idea that sexual speech is a liability class rather than a form of expression, and the private enforcement layer has proved even less accountable than the public one. The United Kingdom's Online Safety Act, with its own duties and age checks, shows the model traveling well beyond American shores. The European Union's Digital Services Act takes a different route, built on risk assessments and transparency reports rather than liability carveouts, yet American lawyers advising on it reach for the same reflexes FOSTA-SESTA trained into their industry: document everything, overremove, apologize later.
None of this requires nostalgia for the pre-2018 internet, which had real problems the old Section 230 did nothing to solve. The point is narrower and more uncomfortable. Congress ran an experiment with a control group it never bothered to study. It gave prosecutors a new tool they concluded they did not need, scattered the market it targeted into darker corners, and left the measurable costs with some of the least protected people online. The trafficking survivors who stood behind the president at the signing ceremony deserved a law that worked. What they and everyone else got was a warning label for the open internet, and a case study in how quickly a platform will choose silence over uncertainty. The platforms got the message anyway. Eight years on, the law's most durable achievement is this: every general counsel in the industry now knows exactly which paragraph of the Communications Decency Act Congress will carve into first, and every content moderator works in the shadow of that knowledge.