Apple just got a proposed class-action lawsuit wiped off its plate — and it’s a big one. A federal judge on Monday dismissed a case that accused the company of failing to stop child sexual abuse material (CSAM) from spreading through iCloud, a lawsuit that sought as much as $32.8 billion in damages.
U.S. District Judge Noël Wise ruled that Apple would be shielded from the claims by Section 230 of the Communications Decency Act, the 1996 law that protects online platforms from being sued over content their users upload. The judge tossed the case with prejudice, so it’s gone for good.
iCloud CSAM lawsuit dismissed on Section 230 grounds
The ruling does more than hand Apple a courtroom victory. It underscores the growing collision between child safety advocates, online privacy proponents and the legal shield that has long protected internet platforms. The court ruling effectively reinforces the idea that existing U.S. law doesn’t require tech companies to proactively scan users’ private content, even as critics argue that advances in on-device detection make doing nothing increasingly difficult to defend.
While this case might be over, the broader fight over who’s responsible for policing encrypted cloud services might shift from the courtroom to Congress.
Two plaintiffs in the case, identified only as Amy and Jessica, filed the lawsuit in 2024. They said images of their abuse kept circulating on iCloud. Apple, they claimed, had tools to detect and report such material, but did nothing.
The plantiffs said they represented roughly 2,680 people harmed in similar ways. Bundling the claims, they argued, would spare survivors the trauma of fighting alone.
The judge, based in San Jose, California, sided with Apple’s core defense. The lawsuit, she ruled, sought to hold Apple liable for content its users created and stored.
“Lawmakers can fix this problem that is contributing to the exploitation of children,” Wise wrote. “This Court cannot.”
The judge also noted that there is currently no federal law requiring Apple and other tech companies to build or deploy any CSAM scanning technology.
The NeuralHash baggage
At the center of this case was Apple’s now-abandoned NeuralHash system. Introduced in 2021, the tool was designed to check if images uploaded to iCloud Photos matched known abuse material. Apple said all this happened without it ever viewing the photos.
However, security researchers quickly warned that the tool could be repurposed for surveillance. Apple discontinued the system in December 2022. Later, Apple published a detailed explanation citing concerns about creating new attack surfaces for hackers and opening doors to broader government demands for scanning other encrypted platforms.
The plaintiffs argued that abandoning NeuralHash, without any alternatives, left survivors exposed. Apple says user privacy and security always come first, and that it continues to invest in child-safety features like Communication Safety, which screens for explicit images sent to or from young users’ devices.
What comes next
James Marsh, the attorney representing the plaintiffs, said they are weighing an appeal alongside other possible claims against Apple. While he didn’t dispute the judge’s reading of the law, Marsh argued that Congress needs to step up.
This isn’t Apple’s only headache on the CSAM front. West Virginia’s attorney general filed a separate lawsuit regarding the same issue. It’s apparently the first case of its kind brought by a state government, so Apple’s iCloud CSAM troubles are far from over.
Apple hasn’t commented, but for this particular case, the gavel’s already come down.
