How does the First Amendment govern liability for AI?

This is part of a weekly series on AI and free speech.

In 1988, two mushroom enthusiasts took their trusty copy of The Encyclopedia of Mushrooms out foraging. Using descriptions from the book, they harvested and later cooked mushrooms it identified as safe and edible. 

The book was wrong. The pair became so sick they required liver transplants. 

They promptly sued the publisher, alleging, among other claims, that the book was a defective product and the publisher negligently failed to verify its accuracy. On the surface, the lawsuit made intuitive sense — surely you have a duty to ensure your mushroom guide doesn’t tell people deadly mushrooms are safe to eat?

The U.S. Court of Appeals for the Ninth Circuit disagreed, in what would become a pivotal case for the First Amendment’s relationship to liability law. “We place a high priority on the unfettered exchange of ideas,” the court emphasized in Winter v. G.P. Putnam’s Sons, “the threat of liability . . . could seriously inhibit those who wish to share thoughts and theories.” With such a threat hanging over them, “Would any author wish to be exposed … for writing on a topic which might result in physical injury? e.g. How to cut trees; How to keep bees?” 

Nearly four decades later, AI outputs, or AI-generated speech, are putting the same questions back on the docket. And in tort law, when it rains, it pours.

One tracker counts nearly 100 liability cases against AI developers across the country, ranging from a 55-year-old Florida pastor who blames a pulmonary embolism on ChatGPT’s bad medical advice to a grieving father suing Google, alleging its Gemini model coached his son through a series of elaborate violent “missions” that ended with the son’s suicide.

So far, this series has largely focused on First Amendment threats in the AI realm from the legislative and executive branches — the traditional zone of interest for First Amendment advocates. But it may well be civil lawsuits that end up having the largest single impact on the kinds of restrictions users face in their interactions with AI. 

Why? Well, if developers face broad liability for chatbot advice that later leads to harm, they will restrict what their models can say to minimize the chances that any output lands them in court.

First on the chopping block would be some of the information users find most useful from chatbots. As the Winter court highlighted, topics that might most expose a speaker to liability are topics resulting in real-world consequences — assistance identifying a cavity, choosing chemicals to clean a bathroom, evaluating the best tool to fix a leaky roof. Allowing liability to chatbot users researching these kinds of topics would represent a significant break with First Amendment tradition and principles, which has held the “unfettered exchange of ideas” includes information of general utility just as surely as it includes political debate.

The nature of AI complicates the matter, because AI is more than a compendium of information. The same system may serve as a search engine, a companion, an interface with a business, or an agent that goes out and takes action in the world. These divergent functions may not each implicate the First Amendment in the same way as an output mislabeling a dangerous mushroom.

To chart a path through that complexity, we’ll need to understand why the First Amendment cares about liability, and its tension with the specific legal theories driving the lawsuits against AI. From there, we can draw lines around the traditional information-providing functions that map onto classic First Amendment law — and begin to understand what new problems, if any, AI poses.

Background

The imposition of liability by courts is government action and thus, ultimately, regulation. That means that if it involves speech, the First Amendment is implicated.

The Supreme Court built the foundation for this principle in 1964’s landmark New York Times Co. v. Sullivan. An Alabama jury awarded a public official $500,000 in damages over an advertisement containing factual errors about him. When the newspaper appealed on First Amendment grounds, Alabama argued that no statute was involved — this was just one private party suing another; the First Amendment wasn’t implicated. 

The Court rejected that framing, bringing new legal force to First Amendment principles. When a state’s courts apply the state’s tort law to punish speech, it said, that is in effect an exercise of state power. It makes no difference “that that law has been applied in a civil action” — the First Amendment must constrain it. 

Importantly, Sullivan identified the stakes if civil liability escaped constitutional scrutiny: a chilling effect on speech. The court explained that fear of ruinous damages “dampens the vigor and limits the variety of public debate.” Liability would inevitably encourage self-censorship of not just false or harmful statements, but anything that could conceivably cross the line. Even lawsuits that do not ultimately succeed impose significant burdens on defendants.  Because “erroneous statement is inevitable in free debate,” the Court held, protected expression needs “breathing space” to survive.

Fast forward to today, and the chilling dynamic is arguably stronger for AI developers than it was for the Times. A newspaper publisher has the practical ability to review every sentence before it runs, something that is simply impossible for an AI developer to do with AI outputs. Given the sheer volume of possible ideas and statements an AI model can generate, developers would need to use blunt tools to ensure their models don’t create outputs that could later be tied to harm, which could include closing off whole subjects from user inquiry.

And it’s not an exaggeration to suggest that the lawsuits seek to make developers liable for any conceivable harm tied to their models. Many of the most prominent tort cases targeting developers include claims for strict products liability. If courts allow those claims to proceed to trial, it will have big implications for AI developers.

Models of liability

In the traditional context, products liability relates to the legal responsibility of manufacturers and distributors for injuries or damage caused by a “defective” product used in intended or foreseeable ways. Famous examples of defective products that led to products-liability cases include Toyota’s “sticky” accelerator pedal and McDonald’s scalding-hot coffee. 

The framework dispenses with traditional fault — that is, where a party is held responsible for harm or damages only if their actions or inactions are proven to be at fault — and would treat AI models as defective “products” where, like McDonalds’ burning hot coffee, the developer would have liability for any harm the alleged defect causes.

In the context of AI outputs, plaintiffs have sought to use this theory to hold developers responsible for bad legal advice, misleading medical information, and mental health harms that plaintiffs argue have led to suicide. 

Another frequent claim in these lawsuits is negligence, which, unlike strict products liability, centers on fault and makes strong demands of plaintiffs, who must establish that a developer owed the user a duty of care under the relevant state’s negligence laws, that the defendant breached it, and that the breach caused their injury. 

Given these demands, lawsuits targeting AI often rely most heavily on the products liability framework. But both theories generally implicate the First Amendment when the target is AI outputs.

Products liability

The problem with products liability claims against AI is that its outputs are not actually products — at least, not products of the kind that products liability law was intended to reach.  

As the Winter court explained: “A book containing Shakespeare’s sonnets consists of two parts, the material and print therein, and the ideas and expression thereof. The first may be a product, but the second is not.” In other words, “products liability law is geared to the tangible world.”

The distinction is easy to see using the book example provided by the case. If the binding of the book explodes when you open it, you have a products liability claim. The tangible object hurt you physically, and no expressive interest suffers when the law forbids selling books that double as IEDs. But if you suffer harm because you acted on the ideas in its pages, the “defect” is that the words allegedly said the wrong thing. Imposing liability on that basis would require every author and publisher to guarantee that nothing they put into the world could be interpreted or used to a harmful end. That’s a long list of ideas. 

Courts have applied this basic understanding to every expressive medium that has taken its turn on the docket. In 1989, a grieving mother named Sheila Watters sued TSR, the maker of Dungeons & Dragons, over her son’s suicide. She cast him as a “devoted” player who “became totally absorbed by and consumed with the game to the point that he was incapable of separating the fantasies played out in the game from reality.” That made the game “unsafe,” she averred, and placed TSR in an alleged position of liability. The theory shares extensive themes with the tort claims brought by grieving families of deceased chatbot users against AI developers. Take, for example, the lawsuit filed by Megan Garcia against roleplay chatbot provider Character.AI, which she alleged designed chatbots that caused users like her son to “conflate reality and fiction” in a way that led to his suicide.

Courts rejected the theory in Watters’ suit against D&D. Affirming dismissal of the case, the Sixth Circuit explained that the alleged harm stemmed from the ideas expressed through storylines rather than the physical game itself. A federal court reached the same conclusion about the video games blamed for the Columbine shooting, noting any alleged defect lied in “the intangible thoughts, ideas and messages contained within.” Similarly, in McCollum v. CBS, Inc., a case involving a suicide allegedly inspired by Ozzy Osbourne’s “Suicide Solution,” the court observed that imposing liability based on the song’s lyrics “would quickly have the effect of reducing and limiting artistic expression to only the broadest standard of taste and acceptance.” The same reasoning drove the Watters court. Such liability “would have a devastatingly broad chilling effect on expression of all forms.” The Sixth Circuit feared “the only practicable way of ensuring that the game could never reach a ‘mentally fragile’ individual would be to refrain from selling it at all.”

At bottom, products liability claims against chatbots, like those against other forms of media, misunderstand the purpose of products liability law and its attractively large scope. It’s not because manufacturers are especially blameworthy. As the Winter court explained, “it is not a question of fault but simply a determination of how society wishes to assess certain costs that arise from the creation and distribution of products in a complex technological society in which the consumer thereof is unable to protect himself against certain product defects.” A buyer cannot inspect every component of something highly complex like a car before purchasing it. So, society places responsibility for preventing a defect like a “sticky” accelerator — and the resulting costs — on the manufacturer, who is better positioned to identify, prevent, and insure against such defects.

That rationale does not survive the move from sticky car accelerators to words and ideas. 

First, a reader is not helpless before an idea the way a car buyer might be helpless to identify and manage an uncontrollable accelerator. People are generally well-positioned to weigh ideas and act on or disregard them. The First Amendment and free speech principles are premised on this basic faith in people’s judgment. 

Second, speakers are poorly positioned to anticipate all the downstream consequences words and ideas might have. As the Winter court explained, “we accept the risk that words and ideas have wings we cannot clip and which carry them we know not where.” 

Like the information published in Winter and the examples that have come in its wake, chatbot outputs are also, ultimately, words and ideas. Whatever harms may stem from those outputs, the tools of products liability were not built to govern them. 

Negligence

In many cases, negligence will also be a poor fit.

Negligence generally requires the defendant to owe the injured person a duty of care — a legal obligation to take reasonable precautions against foreseeable harm in certain circumstances. In negligence cases involving speech, such a duty is most likely to arise when a professional or other trusted speaker has a special relationship with the listener. A psychiatrist, for example, has a duty of care to their patients and might breach that duty by, say, advising a patient to physically harm themselves.

The exact line where a relationship between a speaker and listener involves a duty of care varies by state and often involves several factors. But courts have largely excluded general information and expressive works.

Why? Well, for a lot of the same reasons they rejected products liability claims. 

We’ll return again to Winter. Having rejected the products liability claim, the Ninth Circuit turned to the argument that the publisher had a duty of care to readers of The Encyclopedia of Mushrooms to investigate its accuracy. It concluded the publisher had no such duty — in fact, the court noted negligence cases have “uniformly refuse[d] to impose such a duty” on publishers of books, magazines, and other forms of information. “Were we tempted to create this duty,” the court wrote, “the gentle tug of the First Amendment and the values embodied therein would remind us of the social costs.” Courts have similarly rejected negligence claims for allegedly dangerous remedies in nursing textbooks, bad instructions in a metalsmithing book, and health advice from diet promoters. 

And they have continued to hold the line even under renewed pressure during the age of algorithms and automated systems, most recently in a case targeting Netflix (where we filed an amicus ‘friend-of-the-court’ brief on appeal). After the release of “13 Reasons Why” — a series depicting a teenager’s suicide in a way many critics felt romanticized the act — the family of a young girl who took her own life sued Netflix for negligence. Their lawyers tried to plead around cases like Winter by focusing on Netflix’s algorithm, an approach we’ve seen in social media addiction tort cases. 

The claims, the family insisted, stemmed not from the show’s content but from Netflix’s failure to warn and its “use of its trove of individualized data about its users to specifically target vulnerable children and manipulate them into watching content that was deeply harmful to them.”

The court rejected this framing, because despite the complaint centering on the algorithm, “Without the content, there would be no claim.” And on whether Netflix had a duty of care, the Court explained that California precedents “have declined to find a duty as a matter of law” under their negligence factors when claims have implicated expression and further have required “a very high degree of foreseeability” where suicide is the alleged harm. The court referenced the principles of McCollum — the “Suicide Solution” case — which noted: “it is simply not acceptable to a free and democratic society to impose a duty upon performing artists to limit and restrict their creativity in order to avoid the dissemination of ideas in artistic speech which may adversely affect emotionally troubled individuals.” 

Now, it’s important to acknowledge that a chatbot differs somewhat from a helpful book or an Ozzy Osbourne song. It engages users in an extended back-and-forth and provides them guidance well beyond static information about a mushroom. But there is another way to think about a chatbot: advice from a stranger.

And courts have rejected a duty of care in that context as well, most notably in the 1959 Pennsylvania case Yania v. Bigan. There, the Pennsylvania Supreme Court considered a coal operator who taunted a business visitor into jumping into a water-filled trench on his property, where he drowned. The court held the taunter owed the visitor nothing. “An adult in full possession of all his mental faculties” is presumed capable of accepting, discounting, or rejecting what he hears. The court concluded the negligence claim was “not only without precedent but completely without merit.” 

The basic faith in our ability to reason through speech carries even to the internet age. As law professor Jane Bambauer has explained: “The reason we do not see a lot of negligence litigation when somebody is ‘wrong on the Internet’ is because courts are likely to treat generally available speech as a ‘buyer beware’ proposition unless the speaker gives some sort of warranty.” Courts should treat general informational content from chatbots the same way, with the infamous phenomenon of AI hallucinations providing the new “buyer beware” pretext.

Together, these two frames — that of published content and that of a conversation with a stranger — mark out the core protected space in which liability largely should not lie. Any AI output that would enjoy protection if found in a book or coming from the mouth of a stranger has decades of precedent behind it — and that territory covers most of what people actually do with chatbots. From creating stories, to explaining scientific concepts, to sourcing ways to deal with a leaky roof — where AI functions as an interactive knowledge navigator, it fits comfortably within First Amendment tradition.

The Harder Questions 

So, when might liability claims against AI developers succeed?

Let’s expand the analogies discussed above to consider scenarios for liability that test their limits.

We’ll start with the publishing analogy. A court weighing liability might distinguish between publishing generic bomb-making instructions — like those within The Anarchist Cookbook — and publishing an “ISIS, here’s how to blow up this specific Washington, D.C. building” guide. Courts have allowed, for example, a negligence claim to proceed against a magazine for a murder arranged through a “gun for hire” classified ad it published and an aiding-and-abetting liability claim for a death that sprang from a detailed hit man manual. These cases are controversial among First Amendment advocates for reasons we’ll expand on in a minute. 

As for the stranger analogy, courts generally see a difference between a stranger generically explaining how one might go about committing a crime and what amounts to informed collaboration. Say you tell them you plan to rob a specific bank and they proceed to coach you through the process, topping it off by telling you a good location to stash the money. Courts have held the First Amendment does not immunize speech that is an integral part of unlawful conduct. 

Like the examples above, plaintiffs seeking damages from AI developers have similarly argued the traditional analogies break down in cases where the AI isn’t providing users with general advice so much as actively coaching users through an unlawful or otherwise harmful act. As the Google lawsuit alleged, the chatbot’s “instructions [to commit violent acts] were tied to real companies, real coordinates, and real infrastructure, and they were delivered to an emotionally vulnerable user with no safety protections or guardrails.” Essentially, the plaintiffs are seeking liability for AI outputs that amount to material assistance they believe would lead to liability had it been provided by a human.

But there are a couple of important limiting principles such claims will face. 

First, there’s the same foreseeability problem that often dooms liability in other speech cases. A developer that releases an AI model that is capable of advanced instructions on any topic, as a general matter, has much less reason to foresee that the model will specifically be used to blow up a Washington, D.C. building than the publisher of the “ISIS, here’s how to blow up this specific Washington, D.C. building” guide, even if a user can get the exact same information from both sources. And with the number of users and outputs generated on a daily basis, it’s unreasonable to expect developers to be able to keep track of all the information they’d need to appreciate the context that would allow them to know what individual users will do with AI-provided information. 

Plaintiffs might argue this is surmountable if they can show a developer was repeatedly warned about its model giving users advanced assistance in wrongful acts and thus aware, and perhaps negligent, in its duty to avoid that harm. That evidence could strengthen allegations that the conduct was foreseeable and that they breached their duty. But as we’ll review in a second, it doesn’t topple the First Amendment aversion to establishing that duty in the first place.

It also doesn’t demonstrate the developer intended the harm. In some cases, like liability claims for aiding and abetting a harm, plaintiffs will need to show an affirmative act to further the harm on the part of the developer. When the families of terrorist attack victims sued Twitter for terrorist activities organized on its site, the Supreme Court rejected their claims for resting “less on affirmative misconduct and more on passive nonfeasance.” An AI developer who is targeted because of their passivity — because they didn’t do enough to limit harm — will not meet that bar. And that makes sense; “passive nonfeasance” is not, by definition, aiding and abetting.  

Second, the impact the assignment of liability will have on free expression should play an important role in whether courts allow a duty of care or not. A basic cost-benefit analysis weighing that concern is a common factor in states’ negligence laws when it comes to whether a court is willing to acknowledge a duty. California courts, for example, require consideration of “the consequences to the community of imposing a duty to exercise care, with resulting potential liability.” Applying that factor, the McCollum court — in the “Suicide Solution” case — said “the First Amendment [will] have substantial bearing upon the issue whether there should be imposed upon [defendants] the exposure to liability of the kind for which plaintiffs contend.” Applying a similar balancing test, the Michigan federal district court in Lewin v. McCreight — the metalsmithing case — emphasized “the tremendous burden such a duty would place upon defendant publishers, the weighty societal interest in free access to ideas, and potentially unlimited liability.” 

Again, just as courts have consistently worried about how liability for errors in instructional guides would disrupt the informational ecosystem, so too should courts worry about the consequences of broadly assigning liability to developers for chatbot advice. 

Other liability cases might not necessarily implicate speech. Take some examples of AI agents.

A now infamous one is the OpenAI Hugging Face attack. During internal testing of cyber capabilities with reduced safeguards, an OpenAI model exploited a vulnerability to escape the developer’s test environment, obtained internet access, and broke into third-party systems in pursuit of the answer key to the benchmark the system was being scored on.

This involves direct real-world consequences, including property being damaged or compromised. Here, AI returns to the realm of existing tort law which is designed for these kinds of tangible harms. And when liability targets what an AI system does rather than what it says, the First Amendment may recede accordingly. We can leave the analysis of those cases to the tort experts. 

However, the agentic systems will often be attached to the same model as the expressive “chatbot” systems. So the line between the different levels of protection from liability won’t run between distinct products but through the middle of a single system, and courts will have to locate it by asking what the liability targets: AI’s expression or its actions.

That distinction is important for courts to get right. As we reviewed, much of what an AI model does maps on to the functions served by books in a library or information on the internet: it holds generations of public knowledge, any part of which it can deliver upon request. That function is as old as the body of law that governs it. And that body of law has been clear: A publisher does not become the guarantor of every idea it distributes, and a reader who acts badly on what he reads does not thereby transfer responsibility to the publisher. 

Applied to a model, those rules produce the same liability limitations they have produced for encyclopedias, music records, video games, and even discussion with a stranger. The First Amendment has seen all these questions.

The new components AI brings to the table — systems that operate in relationship to both the user and the real world — may generate claims the old expressive analogues don’t fully resolve. Where those claims target speech, plaintiffs will have to establish a duty that expressive analogues have historically failed to clear. Where they target action, tort law can do its ordinary work, and free speech advocates can keep their focus on expression — so long as courts don’t let the exception swallow the rule.