Opinion

The question posed by this appeal is: Can an Internet Web server such as MySpace Incorporated, be held liable when a minor is sexually assaulted by an adult she met on its Web site? The answer hinges on our interpretation of section 230 of the Communications Decency Act. We hold section 230 immunizes MySpace from liability.

FACTS AND PROCEDURAL POSTURE

This appeal consolidates four cases involving similar facts and essentially identical legal allegations. In each case, one or more “Julie Does”—girls aged 13 to 15—were sexually assaulted by men they met through the Internet social networking site, MySpace.com (MySpace). The Julie Does, through their parents or guardians, have sued MySpace for negligence, gross negligence, and strict product liability.

I. An Overview of MySpace

MySpace.com is a social networking Web site founded in July 2003 that is popular with adults and teenagers. As of July 11, 2006, MySpace was the world’s most visited domain on the Internet for American users. MySpace membership is only open to users aged 14 and over. However, an underaged user can easily gain access simply by entering a false birth date to appear older.

MySpace users typically create profiles, which include personal information on such topics as age, gender, interests, personality, background, lifestyle, and schools. Other MySpace users are then able to search and view profiles that fulfill specific criteria, such as gender, age range, body type, or school. MySpace channels information based on members’ answers to various questions, allows members to search only the profiles of members with comparable preferences, and sends e-mail notifications to its members. Although profiles are automatically set to allow public access, users can adjust the levels of privacy on their profile when they navigate to a specific Web page on the site and select a setting of “public” or “private.” MySpace automatically sets to “private” all accounts for 14 and 15 year olds and does not allow searching or browsing of those accounts.

In its terms of use agreement, users are prohibited from soliciting personal information from anyone under 18. MySpace also lists safety tips to new users which, among other things, cautions:

Similar cautionary advice is provided to parents in the “Tips for Parents” page.

II. The Related Lawsuits

Then 15-year-old Julie Doe II created a MySpace profile in 2005. In 2006, she met a 22-year-old man through MySpace and was sexually assaulted by him at an in-person meeting. As a result, he is currently serving 10 years in prison. Julie Doe III was also 15 when she created a MySpace profile. She subsequently met a 25-year-old man on MySpace, who “lured Julie Doe from her home, heavily drugged her, and brutally sexually assaulted her.” Julie Doe Ill’s attacker pled guilty to charges stemming from the incident and is currently serving 10 years in prison. Julie Doe IV was 13 years old when she created a MySpace profile. In 2006, she turned 14 years old and met an 18- year-old MySpace user. He and his adult friend met Julie Doe IV, drugged her and took turns sexually assaulting her. As of August 2007, the 18-year-old user is awaiting trial while his friend pled guilty to second degree felony rape and was sentenced to four and one-half years in prison. In 2006, 14-year-old Julie Doe V and 15-year-old Julie Doe VI each met 18-year-old and 19- year-old men on MySpace and were later sexually assaulted by the men at in-person meetings. As of August 2007, both men were awaiting trial.

The appellants each bring substantially identical causes of action against MySpace for negligence, gross negligence, and strict product liability. In summary, they complain that “MySpace has made a decision to not implement reasonable, basic safety precautions with regard to protecting young children from sexual predators[.] [f] MySpace is aware of the dangers that it poses to underaged minors using [its Web site]. MySpace is aware that its Web site poses a danger to children, facilitating an astounding number of attempted and actual sexual assaults . . . .” They more specifically allege that MySpace should have implemented “readily available and practicable age-verification software” or set the default security setting on the Julie Does’ accounts to “private.”

The four cases were related at the trial court level. A demurrer to the original complaints was sustained on the ground that appellants’ claims were barred by section 230. The trial court, however, granted appellants leave to amend to plead around section 230. Appellants amended their complaint to include a section specifically entitled “Plaintiffs Bring No Claims That Implicate the Communications Decency Act.” Appellants alleged that their “claims rest on MySpace’s failure to institute reasonable measures to prevent older users from directly searching out, finding, and or communicating with minors. The claims are not content based.”

MySpace again demurred to the first amended complaints on the threshold legal question of MySpace’s immunity under section 230. In connection with its second demurrer, MySpace requested the trial court take judicial notice of the terms of use agreement, safety tips, and tips for parents it had posted on the Web site on June 19, 2006, as well as the ruling sustaining MySpace’s original demurrer and the reporter’s transcript of that hearing.

The trial court sustained the second demurrer without leave to amend, finding the plaintiffs had failed to allege sufficient facts to plead around the immunity granted by section 230, and entered judgments of dismissal in each case. Four separate appeals were filed, and on May 9, 2008, we consolidated them for purposes of briefing, oral argument, and decision.

DISCUSSION

I. Standard of Review

A demurrer tests the sufficiency of the complaint; that is, whether it states facts sufficient to constitute a cause of action. (Code Civ. Proc., § 430.10, subd. (e); Friedland v. City of Long Beach (1998) 62 Cal.App.4th 835, 841-842 [ 73 Cal.Rptr.2d 427 ].) To make this determination, the trial court may consider all material facts pleaded in the complaint and matters of which it may take judicial notice; it may not consider contentions, deductions or conclusions of fact or law. (Code Civ. Proc., § 430.30, subd. (a); Moore v. Conliffe (1994) 7 Cal.4th 634, 638 [ 29 Cal.Rptr.2d 152 , 871 P.2d 204 ].) “Where the complaint’s allegations or judicially noticeable facts reveal the existence of an affirmative defense, the ‘plaintiff must “plead around” the defense, by alleging specific facts that would avoid the apparent defense. Absent such allegations, the complaint is subject to demurrer for failure to state a cause of action . . . .’ [Citation.]” (Gentry v. eBay, Inc. (2002) 99 Cal.App.4th 816, 824 [ 121 Cal.Rptr.2d 703 ] (Gentry).)

Our review of a dismissal resulting from a demurrer is de novo. (Kong v. City of Hawaiian Gardens Redevelopment Agency (2002) 108 Cal.App.4th 1028, 1038 [ 134 Cal.Rptr.2d 260 ].) Appellants bear the burden of proving the trial court erred in sustaining the demurrer or abused its discretion in denying leave to amend. (Ibid.) We also review de novo the trial court’s interpretation of section 230. (Barner v. Leeds (2000) 24 Cal.4th 676, 683 [ 102 Cal.Rptr.2d 97 , 13 P.3d 704 ].)

II. Application of the CDA

Relevant portions of section 230 of the CDA provide as follows:

The express language of the statute indicates Congress did not intend to limit its grant of immunity to defamation claims. Instead, the legislative history demonstrates Congress intended to extend immunity to all civil claims: “This section provides ‘Good Samaritan’ protections from civil liability for providers or users of an interactive computer service for actions to restrict or to enable restriction of access to objectionable online material.” (142 Cong. Rec. H1130 (Jan. 31, 1996).)

Immunity under section 230 requires proof of three elements: (1) MySpace is an interactive computer services provider, (2) MySpace is not an information content provider with respect to the disputed activity, and (3) appellants seek to hold MySpace liable for information originating with a third party user of its service. (Zeran v. America Online, Inc. (4th Cir. 1997) 129 F.3d 327, 330 (Zeran); Delfino v. Agilent Technologies, Inc. (2006) 145 Cal.App.4th 790, 804-805 [ 52 Cal.Rptr.3d 376 ].) Appellants appear to take issue with the second and third elements required for immunity, arguing that they view MySpace as an information content provider and do not hold it liable for the communications between the Julie Does and their assailants, but rather, for MySpace’s failure to institute reasonable security measures.

A. Was MySpace Treated As a Publisher of Third Party Content?

We first examine appellants’ main argument: that their complaint does not treat MySpace as a publisher, which would trigger section 230 immunity, but instead alleges “a breach of a legal duty to provide reasonable safety measures to ensure that sexual predators did not gain otherwise unavailable access to minors through the use of the MySpace.com website . . . .” To circumvent section 230’s immunity provisions, appellants narrowly construe section 230 to extend only to claims “stemming from harms caused by the defendant’s republication of inherently offensive or harmful content.” That is, appellants contend that the words themselves have to be tortious, such as in the case of a defamatory statement.

1. Federal Case Law

The leading case on immunity protection under section 230 is Zeran, supra, 129 F.3d at pages 331-333. There, the plaintiff discovered that someone had falsely advertised on America Online that he was selling T-shirts containing tasteless slogans about the 1995 bombing of the Oklahoma City federal building. The plaintiff complained that America Online failed to remove the postings immediately, failed to notify other subscribers of the message’s false nature and failed to effectively screen future defamatory material. The trial court granted America Online’s motion for judgment on the pleadings and the Fourth Circuit affirmed, holding that immunity is extended even when a provider is notified of objectionable content on its site. The court reasoned: “Congress’ purpose in providing the § 230 immunity was thus evident. Interactive computer services have millions of users. [Citation.] The amount of information communicated via interactive computer services is therefore staggering. The specter of tort liability in an area of such prolific speech would have an obvious chilling effect. It would be impossible for service providers to screen each of their millions of postings for possible problems. Faced with potential liability for each message republished by their services, interactive computer service providers might choose to severely restrict the number and type of messages posted. Congress considered the weight of the speech interests implicated and chose to immunize service providers to avoid any such restrictive effect.” (Zeran, at p. 331.)

Appellants’ same argument was recently addressed by the Fifth Circuit in Doe v. MySpace, Inc. (5th Cir. 2008) 528 F.3d 413 . There, a 13-year-old girl represented that she was 18 when she created a MySpace profile. As a result, her profile was automatically set to “public” and she met a 19-year-old man on MySpace a year later, when she was 14. (Id. at p. 416.) The two spoke offline several times after exchanging phone numbers, and he sexually assaulted her when they met in person. (Ibid.) The girl and her mother filed suit in an attempt to hold MySpace liable for failing to implement basic safety measures to protect minors from adult predators whom they meet on MySpace. (Id. at p. 417.)

In light of Zeran and the legislative intent behind section 230, the Fifth Circuit upheld a Texas district court’s dismissal with prejudice of the plaintiffs’ complaint. The Fifth Circuit interpreted the statute to provide broad immunity extending to cases arising from the publication of user-generated content. (Doe v. MySpace, Inc., supra, 528 F.3d at p. 418 .)

It first considered the policy reasons underlying section 230’s enactment, emphasizing Congress’ intent “to remove disincentives for the development and utilization of blocking and filtering technologies that empower parents to restrict their children’s access to objectionable or inappropriate online material.” (§ 230(b)(4).) Further, cases from other circuit courts had broadly construed section 230, including one in which the service provider was notified of objectionable content on its site. (Doe v. MySpace, Inc., supra, 528 F.3d at pp. 418-419.) As a result, the Fifth Circuit found the plaintiffs’ “allegations are merely another way of claiming that MySpace was liable for publishing the communications and they speak to MySpace’s role as a publisher of online third-party-generated content.” (Id. at p. 420.) The court further noted, “Parties complaining that they were harmed by a Web site’s publication of user-generated content have recourse; they may sue the third-party user who generated the content, but not the interactive computer service that enabled them to publish the content online.” (Id. at p. 419.)

In a different context, the Ninth Circuit extended section 230 immunity to an online dating service, finding it was not liable when an unidentified party posted a false online profile of an actress, which resulted in harassing phone calls, letters, and faxes to her home. (Carafano v. Metrosplash.com, Inc. (9th Cir. 2003) 339 F.3d 1119, 1122 (Carafano).) The Carafano court held that “[ujnder § 230(c), ... so long as a third party willingly provides the essential published content, the interactive service provider receives full immunity regardless of the specific editing or selection process.” (Id. at p. 1124.)

Similarly, an Ohio district court extended section 230 immunity to an online dating service where the plaintiff had relied on another member’s claim on her profile that she was 18 years old when he had sex with her. He was subsequently arrested for unlawful sexual conduct with a minor because, in fact, she was only 14. (Doe v. SexSearch.com (N.D. Ohio 2007) 502 F.Supp.2d 719, 722 , affd. (6th Cir. 2008) 551 F.3d 412 .) The plaintiff asserted multiple causes of action, most of which were based on the allegation that the dating service had an obligation to, but failed, to discover the minor lied about her age. The defendant’s motion to dismiss was granted on the ground that the complaint attempted to hold the dating service liable for its publication of content provided by the minor. (Id. at p. 728.)

2. California Case Law

While the Fifth Circuit’s holding in Doe v. MySpace, Inc. is certainly persuasive, especially as it relates to an interpretation of a federal statute, its holding is not binding upon this court. Neither are the other federal precedents cited above. (Southern Cal. Ch. of Associated Builders etc. Com. v. California Apprenticeship Council (1992) 4 Cal.4th 422, 437 [ 14 Cal.Rptr.2d 491 , 841 P.2d 1011 ]; Wagner v. Apex Marine Ship Management Corp. (2000) 83 Cal.App.4th 1444, 1451 [ 100 Cal.Rptr.2d 533 ].) However, where the decisions of the federal courts on a federal question are “ ‘ “both numerous and consistent,” we should hesitate to reject their authority [citation].’ ” (Barrett v. Rosenthal (2006) 40 Cal.4th 33, 58 [ 51 Cal.Rptr.3d 55 , 146 P.3d 510 ] (Barrett).) Nevertheless, we must look to our own state’s treatment of section 230 immunity to confirm the above analysis.

It appears the only California Supreme Court case that addresses immunity under section 230 is Barrett, supra, 40 Cal.4th 33 . There, the high court was concerned with the distinction between a publisher and a distributor in the context of a defamation suit. While not exactly on point, the court’s construction of section 230 provides us with some guidance on how broadly to interpret section 230 immunity. Importantly, the court noted in Barrett that “the immunity conferred by section 230 applies even when self-regulation is unsuccessful, or completely unattempted.” (Barrett, supra, 40 Cal.4th at p. 53 , italics added.) The court also cited to the legislative history contained in a subsequent federal statute that explicitly supported a broad interpretation of section 230 immunity in negligence cases. (Barrett, at p. 54 [“ ‘The Committee notes that ISPs [Internet service providers] have successfully defended many lawsuits using section 230(c). The courts have correctly interpreted section 230(c), which was aimed at protecting against liability for such claims as negligence[.] (See, e.g., Doe v. America Online, [Inc. (Fla. 2001)] 783 So.2d 1010 )____’ ”].)

California’s intermediate appellate courts have also consistently extended liability to negligence claims similar to the one at hand. In Delfino v. Agilent Technologies, Inc., supra, 145 Cal.App.4th 790 , the plaintiffs brought suit against an employee and his employer for the employee’s cyberthreats against them, which originated from the employer’s computer system. The plaintiffs argued the employer was subject to negligence liability because it failed to take measures to protect them from its employee’s threatening communications. (Id. at p. 797.) The employer’s summary judgment motion was granted by the trial court. On appeal, the court affirmed, holding the employer was entitled to immunity under section 230 because the content of the messages was provided by the employee and was outside the scope of his employment. Moreover, the employer took prompt action when it learned of the misconduct. (Delfino, at pp. 810-813.)

In Gentry, supra, 99 Cal.App.4th 816 , the plaintiffs bought forged sports memorabilia on eBay. They sued eBay for, among other things, negligence and unfair trade practices. (Id. at p. 820.) The Gentry court ruled the plaintiffs failed to plead around the section 230 immunity protecting eBay from liability on the plaintiffs’ claims. Given the broad immunity provided by section 230, the court reasoned that the plaintiffs were trying to hold eBay responsible for disseminating information provided by the individual sellers who used its service. (Gentry, at pp. 828-831.) Regarding the allegation that eBay knew or should have known about the sellers’ illegal conduct but failed to prevent it by withdrawing or altering the fraudulent content, the Gentry court stated: “This is the classic kind of claim that Zeran found to be preempted by section 230, . . . one that seeks to hold eBay hable for its exercise of a publisher’s traditional editorial functions.” (Id. at p. 835.)

Aside from cases involving negligence and defamation, California courts have extended section 230 immunity to other types of claims. (Kathleen R. v. City of Livermore (2001) 87 Cal.App.4th 684 [ 104 Cal.Rptr.2d 772 ] [immunity from taxpayer action for waste of public funds granted to library providing Internet access to patrons].)

3. MySpace Is Not Liable for Content Provided by a Third Party User

Given the general consensus to interpret section 230 immunity broadly, extending from Zeran to the Fifth Circuit’s opinion in Doe v. MySpace, Inc. addressing identical facts and legal issues, we also conclude that section 230 immunity shields MySpace in this case. That appellants characterize their complaint as one for failure to adopt reasonable safety measures does not avoid the immunity granted by section 230. It is undeniable that appellants seek to hold MySpace responsible for the communications between the Julie Does and their assailants. At its core, appellants want MySpace to regulate what appears on its Web site. Appellants argue they do not “allege liability on account of MySpace’s exercise of a publisher’s traditional editorial functions, such as editing, altering, or deciding whether or not to publish certain material, which is the test for whether a claim treats a website as a publisher under Barrett.” But that is precisely what they allege; that is, they want MySpace to ensure that sexual predators do not gain access to (i.e., communicate with) minors on its Web site. That type of activity—to restrict or make available certain material—is expressly covered by section 230.

Appellants attempt to distinguish the line of federal and state cases supporting our analysis by characterizing the harm in those cases as caused by the release of information while the harm here was caused by the physical assaults. For example, appellants contend that because the description of the sports memorabilia in Gentry was false, the words themselves were tortious and thus fell under the purview of section 230. ( Gentry, supra, 99 Cal.App.4th at pp. 828-831.) Similarly, the statements falsely attributed to the plaintiff in Zeran were independently actionable, bringing them within the scope of section 230. ( Zeran, supra, 129 F.3d at pp. 331-333.) According to appellants, the communications exchanged between the Julie Does and their assailants in this case, on the other hand, were not actionable and thus, section 230 does not apply. Appellants create a false distinction between tortious information and harmless communications to cleave this matter from the extensive line of authority cited above. The real question, though, is whether appellants seek to hold MySpace liable for failing to exercise a publisher’s traditional editorial functions, namely deciding whether to publish certain material or not. Because they do, section 230 immunizes MySpace from liability.

In any case, appellants’ reading of the case law and the statute is not borne out by a more rigorous examination. In all but one of these cases, the harm actually resulted from conduct that occurred outside of the information exchanged, whether that information was actionable or not. In Gentry , the harm occurred when the plaintiffs purchased the sports memorabilia. In Zeran , supra, 129 F.3d at pages 331-333, and Carafano, supra, 339 F.3d at page 1122 , the harm occurred offline when the plaintiffs received harassing or threatening communications through their home telephones and fax machines. Similarly, in Doe v. SexSearch.com, supra, 502 F.Supp.2d at page 722 , the harm occurred when the plaintiff was arrested because he had sex with the minor. These incidents all occurred offline, just as the sexual assaults against the Julie Does occurred offline.

B. Was MySpace an Information Content Provider

Appellants also contend MySpace is an information content provider and thus is not immunized by section 230. According to appellants, “MySpace acted as a content provider when it collaborated with the Does and their eventual attackers to create and then flesh out their MySpace profiles .... MySpace also acted as a content provider when it allowed the attackers to channel information in profiles, search and browse profiles for particular characteristics and then use the results of those queries to locate, contact, and eventually sexually assault the Julie Does.”

Appellants rely on Fair Housing Coun., San Fernando v. Roommates.com (9th Cir. 2008) 521 F.3d 1157 (Roommates.com) to support their argument. There, the defendant ran a Web site to match people renting out spare rooms with people looking for a place to live. Before a subscriber can search listings or post housing opportunities on the Web site, he or she was required to answer a series of questions about his or her sex, sexual orientation, and whether he or she would bring children to a household. The site also encouraged subscribers to provide “additional comments” describing themselves and their desired roommate in an open-ended essay. Subscribers also received periodic e-mails, informing them of potential housing opportunities that matched their preferences. (Id. at p. 1162.) The plaintiffs complained that Roommates.com’s business violated the federal Fair Housing Act ( 42 U.S.C. § 3601 et seq.) and California’s fair housing law, both of which prohibit discrimination on the basis of race, familial status or national origin. ( 42 U.S.C. § 3604 (c); Gov. Code, § 12955.)

The district court granted Roommates.com summary judgment, holding that it was entitled to immunity under section 230. The Ninth Circuit reversed in part, finding that Roommates.com was an information content provider as to the questions because it created the discriminatory questions, presented a limited choice of answers and designed its search and e-mail systems to limit listings based on sex, sexual orientation, and presence of children. Further, Roommates.com forced subscribers to answer these questions as a condition of using its services. (Roommates.com, supra, 521 F.3d at p. 1166 .) Immunity was extended, however, with regard to the additional comments section because it published the comments as written, did not provide guidance or urge subscribers to input discriminatory preferences. (Id. at p. 1174.)

Roommates.com presents us with two ends of the spectrum with respect to how much discretion a third party user has in the content he or she posts on the site. A subscriber writing in the additional comments section is given almost unfettered discretion as to content. On the other hand, the subscriber must select one answer from a limited number of choices in the question and answer profile section. Our situation falls somewhere in between. MySpace members are not allowed unfettered discretion as to what they put in their profile. Instead, it is alleged that MySpace users are urged to follow the on-screen prompts to enter a name, e-mail address, gender, postal code, and date of birth. Users are also “encouraged” to enter personal information such as schools, interests and personality and background and lifestyle. This information is organized by the site and is searchable by other users. Unlike the questions and answers in Roommates.com , however, Appellants do not allege that MySpace’s profile questions are discriminatory or otherwise illegal. Neither do they allege that MySpace requires its members to answer the profile questions as a condition of using the site.

The facts here align more closely with those in Carafano, supra, 339 F.3d at page 1124 . There, the online dating service provided neutral tools, which the anonymous poster used to publish the libelous content. The dating service did nothing to encourage the posting of such content and in fact, the posting was contrary to its express policies. (Ibid.) As more fully explained in Roommates.com , “[t]he salient fact in Carafano was that the website’s classifications of user characteristics did absolutely nothing to enhance the defamatory sting of the message, to encourage defamation or to make defamation easier: The site provided neutral tools specifically designed to match romantic partners depending on their voluntary inputs. By sharp contrast, Roommate’s website is designed to force subscribers to divulge protected characteristics and discriminatory preferences, and to match those who have rooms with those who are looking for rooms based on criteria that appear to be prohibited by the [Fair Housing Act].” (Roommates.com, supra, 521 F.3d at p. 1172 .) In light of the cases above, we find MySpace was not an information content provider subject to liability under section 230.

DISPOSITION

The judgment is affirmed. MySpace is awarded its costs of appeal.

Rubin, Acting R J., and Flier, J., concurred.

Appellants’ petition for review by the Supreme Court was denied October . 14, 2009, S175399.

Citations to section 230 refer to that section of the Communications Decency Act of 1996 (CDA; 47 U.S.C. § 230 ). For ease of reference, all of the Julie Does and their parents or guardians will be referred to as appellants, unless more specifically identified. The following description is taken from the appellants’ factual allegations in their first amended complaint, which we accept as true, and from items of which the trial court took judicial notice. (Code Civ. Proc., § 430.30, subd. (a).) The CDA defines information service provider as “any person or entity that is responsible, in whole or in part, for the creation or development of information provided through the Internet or any other interactive computer service.” (§ 230(f)(3).) The plaintiffs in that case were represented by the same attorneys as appellants in this matter. Not surprisingly, appellants cannot and do not distinguish the Fifth Circuit’s opinion in Doe v. MySpace, Inc., supra, 528 F.3d at pages 418-419, which is exactly on point. They only contend that the Fifth Circuit was wrong.