Social media in the United States is regulated through a layered mix of federal statutes, state laws, and enforcement actions, all operating under limits set by the First Amendment. The single most important rule is Section 230 of the Communications Decency Act, which shields platforms from liability for user-posted content. Around it sit copyright rules under the Digital Millennium Copyright Act, children’s privacy protections under COPPA, state content moderation and privacy statutes, and antitrust oversight of mergers and monopolies. No one agency runs the system; responsibility is spread across the Federal Trade Commission, the Department of Justice, state attorneys general, and the federal courts.
Section 230 and Platform Immunity
The foundation of the system is 47 U.S.C. § 230. It prevents platforms from being treated as the publisher of content posted by their users.1Office of the Law Revision Counsel. 47 USC 230 – Protection for Private Blocking and Screening of Offensive Material Without that shield, a company hosting billions of posts could be sued over any one of them. The statute draws a line between an intermediary that hosts content and a publisher that exercises editorial control, and it puts social media on the intermediary side of that line.
A companion provision, the Good Samaritan clause at § 230(c)(2), protects platforms when they voluntarily remove content they consider objectionable. A company that deletes harassment, violence, or pornography in good faith cannot be sued for that moderation decision.1Office of the Law Revision Counsel. 47 USC 230 – Protection for Private Blocking and Screening of Offensive Material The dual structure lets platforms both host user speech and clean up harmful material.
Immunity is broad but not total. Section 230(e)(1) leaves federal criminal law untouched, so obscenity and child sexual exploitation statutes still apply. Section 230(e)(2) preserves intellectual property law, which is why copyright is handled through a separate framework. And in 2018, Congress added § 230(e)(5), which strips immunity for conduct that violates federal sex trafficking statutes. Victims can bring civil claims under 18 U.S.C. § 1595 against anyone who knowingly benefits from participating in a trafficking venture, including a platform.2Office of the Law Revision Counsel. 18 US Code 1595 – Civil Remedy Federal courts have read this narrowly: a platform faces liability only when its own conduct amounts to knowingly benefiting from trafficking as defined by 18 U.S.C. § 1591, not when a third party simply misuses the service.3Office of the Law Revision Counsel. 18 USC 1591 – Sex Trafficking of Children or by Force, Fraud, or Coercion
One unresolved question is how far § 230 stretches when platforms use algorithms to actively promote content to targeted users. Courts have so far upheld the broad reading of the statute, but the line between passive hosting and active curation is still being tested.
Copyright and the DMCA
Copyright disputes on social media run through a separate safe harbor at 17 U.S.C. § 512. A platform avoids liability for user-uploaded copyrighted material if it lacks actual knowledge of the infringement, acts quickly to remove material once notified, and does not profit directly from infringing activity it can control.4Office of the Law Revision Counsel. 17 USC 512 – Limitations on Liability Relating to Material Online
The engine of the system is notice-and-takedown. A copyright holder sends a written notice identifying the infringing material to the platform’s designated agent, including a description of the copyrighted work, information sufficient to locate the infringement, and a statement under penalty of perjury that the complaint is made in good faith. Once the notice arrives, the platform must remove or disable access to the material promptly to keep its safe harbor.4Office of the Law Revision Counsel. 17 USC 512 – Limitations on Liability Relating to Material Online Platforms also have to register an agent with the U.S. Copyright Office and maintain a policy for terminating repeat infringers. Failing on the repeat-infringer requirement can cost a company its safe harbor across the board.
Children’s Privacy Under COPPA
The Children’s Online Privacy Protection Act targets data collection from users under 13. Codified at 15 U.S.C. §§ 6501–6506, COPPA requires services directed at children, and any service with actual knowledge that it is collecting data from a child, to obtain verifiable parental consent before collecting personal information.5Office of the Law Revision Counsel. 15 USC 6502 – Regulation of Unfair and Deceptive Acts and Practices in Connection With the Collection and Use of Personal Information From and About Children on the Internet Personal information under COPPA is defined broadly. It reaches beyond names and addresses to include online identifiers, geolocation data, photos, and audio recordings of a child’s voice.6Office of the Law Revision Counsel. 15 USC Ch. 91 – Children’s Online Privacy Protection
The Federal Trade Commission enforces COPPA. As of 2024, the maximum civil penalty was $51,744 per violation, adjusted periodically for inflation.7Federal Trade Commission. FTC Publishes Inflation-Adjusted Civil Penalty Amounts for 2024 Because a single breach can involve millions of children, settlements often run into the tens of millions of dollars, with the FTC also requiring deletion of illegally collected data and ongoing compliance monitoring.
Parents have the right to review what has been collected from their children and demand deletion. Companies cannot condition a child’s participation in a game or activity on disclosing more data than the activity actually needs. The FTC finalized updates to the COPPA Rule in 2025 that expanded protections further, adding new definitions and consent requirements reflecting how children use modern platforms.
State Content Moderation Laws
Several states have tried to control how platforms moderate user posts. Florida enacted a law prohibiting platforms from permanently deplatforming political candidates, with fines reaching $250,000 per day for removing a statewide candidate and $25,000 per day for other candidates. Texas barred large platforms with more than 50 million monthly active users from removing content based on the user’s viewpoint and let both the attorney general and private citizens sue over violations.
Both laws leaned on the theory that social media companies function like common carriers. The Supreme Court took up that theory in the consolidated NetChoice cases in 2024 and vacated both lower court rulings, finding that neither the Fifth Circuit nor the Eleventh Circuit had conducted a proper facial analysis of the laws’ constitutionality.8Supreme Court of the United States. Moody v. NetChoice, LLC
Along the way, the majority laid out principles that constrain future attempts at this kind of regulation. The First Amendment protects platforms engaged in compiling and curating others’ speech into an expressive product of their own, and government mandates forcing them to carry speech they would exclude implicate that protection. A platform’s editorial judgment doesn’t vanish just because it includes most content and removes only a small share. And a state cannot override those editorial choices simply by asserting an interest in balancing the marketplace of ideas.8Supreme Court of the United States. Moody v. NetChoice, LLC
These state laws often add procedural requirements too, like transparency reports, user notifications for each moderation action, and appeal mechanisms. A company running one global service ends up navigating conflicting requirements across many jurisdictions at once.
Age Verification and Minor Access
A separate wave of state legislation focuses on restricting minors’ access to social media. At least 20 states enacted new laws in 2025 addressing children’s use of these platforms. Approaches range from parental consent for account creation to mandatory age screening and daily usage caps. Utah, for example, requires app stores to verify ages and obtain parental consent before minors can create accounts. These laws raise privacy and speech questions that courts will eventually evaluate under the same First Amendment framework applied to the content moderation statutes.
State Privacy Laws
A growing number of states have passed comprehensive data privacy laws that reach how social media platforms collect, store, and monetize user information. They generally give consumers the right to know what personal data a company holds, request deletion, and opt out of having their data sold. Common rights across these frameworks include access, correction, deletion, and restrictions on the sale of personal details. Some states add protections for minors, requiring affirmative consent before selling data from users under 16.
Each state law differs in scope, so platforms with national user bases often apply the most protective standards across all users rather than maintain separate tiers. Multiple proposals for a comprehensive federal privacy law have been introduced in Congress but none have passed, leaving the state-by-state patchwork as the main data protection framework for social media users outside the COPPA context.
Antitrust Oversight
Competition law regulates the shape of the industry rather than the content on it. The Sherman Act prohibits agreements that restrain trade and conduct that maintains a monopoly through anti-competitive means.9Office of the Law Revision Counsel. 15 US Code 1 – Trusts, Etc., in Restraint of Trade Illegal; Penalty The Clayton Act lets regulators block mergers whose effect may be to substantially lessen competition or tend to create a monopoly.10Office of the Law Revision Counsel. 15 US Code 18 – Acquisition by One Corporation of Stock of Another
The FTC’s case against Meta shows how these statutes apply. The FTC alleges Meta illegally maintained a monopoly in personal social networking by acquiring its most significant competitive threats, Instagram and WhatsApp, rather than competing on the merits. A district court ruled in Meta’s favor in November 2025, and the FTC filed a notice of appeal in January 2026, arguing that trial evidence demonstrated over a decade of anticompetitive conduct.11Federal Trade Commission. FTC Appeals Ruling in Meta Monopolization Case
Merger review is the other main enforcement lever. Under the Hart-Scott-Rodino Act, companies proposing large transactions must notify both the FTC and the Department of Justice before closing. As of February 2026, any deal valued at $133.9 million or more triggers a mandatory filing, with filing fees ranging from $35,000 for smaller transactions to $2.46 million for deals valued at $5.869 billion or more.12Federal Trade Commission. New HSR Thresholds and Filing Fees for 2026 The waiting period gives regulators time to investigate before an acquisition becomes irreversible.
Traditional antitrust analysis focused on whether a monopoly raised consumer prices, which fits awkwardly when most social media services are free. Enforcement agencies are increasingly looking at other harms, including degraded privacy, reduced service quality, suppressed innovation, and barriers to entry created by concentrated user data. The Meta case will test whether that approach holds up in court.
Constitutional Limits
Every regulatory approach above works inside limits set by the First Amendment. The Supreme Court has repeatedly held that private companies have their own right to decide what content to host. A platform’s decision to remove, prioritize, or deprioritize posts is itself a form of protected expression, and the government cannot force a private company to carry speech it finds objectionable any more than it could force a newspaper to print a specific letter.
The state action doctrine reinforces that boundary. The Constitution restricts government conduct, not private business decisions. Unless a private company is performing a traditional, exclusive government function, it is not bound by the same free speech obligations as a public agency. In Manhattan Community Access Corp. v. Halleck, the Court held that operating a forum for speech is not something only the government has traditionally done, so providing such a forum does not turn a private entity into a state actor.13Legal Information Institute. Manhattan Community Access Corp. v. Halleck That makes it very hard for lawmakers to write rules that directly dictate moderation outcomes.
Laws that single out particular types of speech or favor certain viewpoints face strict scrutiny, meaning they must serve a compelling government interest and be drawn as narrowly as possible. Broad mandates requiring platforms to be “neutral” have consistently failed that test because they cut too deeply into editorial judgment. Content-neutral regulations focused on business practices, data handling, or transparency face a lower bar, which is why privacy and antitrust law have had more traction than direct speech mandates.
Government Pressure Behind the Scenes
A separate question is whether officials cross constitutional lines when they pressure platforms through informal channels rather than formal rules. In Murthy v. Missouri, plaintiffs alleged federal officials coerced platforms into suppressing certain viewpoints. The Supreme Court ruled in 2024 that the plaintiffs lacked standing to seek an injunction, finding no concrete link between their specific injuries and the defendants’ conduct.14Supreme Court of the United States. Murthy v. Missouri The Court did not decide whether the government’s communications actually amounted to coercion, so the underlying First Amendment question is still open.
Proposed Federal Safety Rules
Congress has repeatedly considered legislation that would impose a duty of care on platforms to protect minors from design-level harms. The Kids Online Safety Act, most recently reintroduced in the 119th Congress as S. 1748, would require platforms to prevent and mitigate harms to minors caused by design choices, particularly recommendation algorithms and addictive product features.15U.S. Congress. S.1748 – 119th Congress – Kids Online Safety Act The categories of harm targeted include promotion of self-harm, eating disorders, substance abuse, and child sexual exploitation.
The bill would require platforms to turn on the strongest privacy settings for minors by default, give young users tools to disable addictive features and opt out of personalized algorithmic recommendations, and give parents and educators a dedicated channel to report harmful content. Independent audits would assess how platform design affects children. The legislation has not been enacted as of mid-2026 and its path forward remains uncertain. If it passes, most provisions would take effect 18 months after enactment. Critics have questioned how broadly the duty-of-care standard could be applied and whether it could chill protected speech, which is why the bill sits at the same First Amendment intersection that has shaped everything else in this area.