Judge Wise Ruled for Apple on CSAM Liability, Then Called It Disturbing

Judge Wise dismissed Amy v. Apple over CSAM liability, then called the result disturbing

Plaintiffs in Amy v. Apple, including CSAM victims, argued before Judge Wise in the Northern District of California that iCloud has a design defect: Apple never deployed CSAM-detection tools like PhotoDNA, even though other cloud providers do. According to Eric Goldman's write-up of the ruling, the court dismissed the case entirely under Section 230 of the Communications Decency Act, the same statute that shields Facebook or Reddit from liability for what users post. Forcing Apple to scan, the court held, would require it "to act as a publisher" of third-party content, and Section 230 bars that claim regardless of what Apple knew was sitting on its own servers. Plaintiffs tried the usual workarounds courts have carved out of 230 immunity, citing Doe v. Twitter, Lemmon v. Snap and Roommates.com; all three failed to move the needle.

Apple's own history sits at the center of the case. It built a CSAM-scanning tool called NeuralHash, designed to run on the device before a photo ever reached iCloud. The 2021 announcement drew sustained backlash over surveillance concerns, Apple shelved the tool, and rolled out full end-to-end encryption for iCloud instead, closing the door on server-side scanning too. Judge Wise ruled for Apple but was plainly unhappy about it, writing that if lawmakers want companies to address CSAM on their platforms, "they must require it under the law." Goldman's own read goes further than the judge's regret: he argues that breaking end-to-end encryption to enable scanning would just create a new class of victims, pointing to the 2014 Sony hack as a reminder of what happens when a company's internal data gets exposed at scale, and that prosecuting offenders, not scanning photo libraries, is where resources belong.

The thread finds a different timeline for NeuralHash's death

The 352-point discussion didn't take the "Apple U-turned" framing at face value. One reply mapped out NeuralHash's actual architecture and read the sequence the other way around:

"The system was designed pretty elegantly and offers far better privacy protections - including guardrails - than what Microsoft and Google do, but the communication from Apple about it was absolutely horrible and generated enormous backlash." — a commenter who traced NeuralHash's original architecture in detail

Their case: NeuralHash wasn't a good-faith scanner that failed and got swapped for encryption. It was built on-device specifically so Apple could roll out full encryption without leaving CSAM undetected, meaning Advanced Data Protection may have been the plan from the start, not a retreat.

That reframing exposed a separate mix-up running through the thread, where several replies treated "CSAM scanning" as equivalent to age verification. Aurornis, a commenter with more than 56,000 karma, corrected it directly: the scanning Apple proposed used perceptual hashing to match photos already known to law enforcement, not to guess a subject's age from a private image, something the commenter called "an impossible task."

Was NeuralHash proof of Apple's privacy culture, or proof a surveillance tool works?

The thread split on what the NeuralHash episode actually demonstrates about Apple.

"I was an engineer at both MS and Apple. At Apple, privacy was baked into every new feature from the start. At MS, the privacy component was glued on at the very end, if ever." — a commenter who says he worked as an engineer at both Microsoft and Apple

Not everyone read the episode the same way. One reply pushed back bluntly:

"Apple is on the side of privacy if it serves their marketing. Which is why they would rather build and normalize CLIENT SIDE CONTENT SCANNING so they can continue to market iCloud as 'secure and private.'" — a skeptical voice in the same thread

A rival cloud builder: neither scanning method actually solves it

The most concrete answer in the thread came from someone who has to make this exact call in his own product.

"As the creator of mediaden.ca I've thought about this. Client side scanning is maybe marginally better than server side scanning, but both paths lead to privacy rot. Governments need to catch criminals, but they shouldn't do it at everyone else's expense." — ryanisnan, creator of the cloud storage service mediaden.ca

The ruling doesn't settle anything technical; it just moves the decision from Apple's product team to Congress, exactly as Judge Wise said. Until lawmakers write the scanning mandate she says is missing, Amy v. Apple tells every other cloud provider, not just Apple, that encrypting everything and refusing to look is now the legally safest design choice, not just the most private one.