First Amendment Limits on AI Liability

Editor’s note: This essay is part of a series on liability in the AI ecosystem, from Lawfare and the Georgetown Institute for Technology Law and Policy.

Generative artificial intelligence (AI) output is likely protected by the First Amendment, much like human-written speech is generally protected. But the existing First Amendment exceptions, such as that for defamation (written libel or oral slander), would apply to such output. AI companies therefore enjoy substantial protection for AI-generated speech, but not absolute protection.

First Amendment Protection

Though current AI programs are of course not people and do not themselves have constitutional rights, their speech may potentially be protected because of the rights of the programs’ creators. But beyond that, and likely more significantly, AI programs’ speech will likely be protected because of the rights of their users—both the users’ rights to listen and their rights to speak. 

As the second part of this piece will note, this isn’t absolute protection, just as protection for directly human-authored speech isn’t absolute. The restrictions will still be governed by the familiar First Amendment rules dealing with, for instance, prior restraints, distinctions between content-based and content-neutral restrictions, strict scrutiny of content-based restrictions, and the like. But the important point is that those rules will likely indeed apply, rather than there being some categorical rule that AI output is unprotected or less protected.

AI Creators’ Rights to Speak

AI programs aren’t engaged in “self-expression”; at least at this point, they appear to have no self to express. They generate text or images in automated ways in response to prompts and based on their training. While people commonly anthropomorphize AI, speaking of it “memorizing” (regurgitating content identical to something in its training data) or “hallucinating” (generating inaccurate information), the fact that AI generates text and images that we imbue with meaning doesn’t mean the AI is reasoning or even seeking to communicate with people.

For this reason, four Supreme Court justices have recently suggested that content moderation decisions made by AI programs may be less constitutionally protected than content moderation decisions made by humans. Justice Amy Coney Barrett, in Moody v. NetChoice wrote,

What if a platform’s owners hand the reins to an AI tool and ask it simply to remove “hateful” content? If the AI relies on large language models to determine what is “hateful” and should be removed, has a human being with First Amendment rights made an inherently expressive “choice ... not to propound a particular point of view”? In other words, technology may attenuate the connection between content-moderation actions (e.g., removing posts) and human beings’ constitutionally protected right to “decide for [themselves] the ideas and beliefs deserving of expression, consideration, and adherence.”

Likewise, Justice Samuel Alito in Moody, joined by Justices Clarence Thomas and Neil Gorsuch, wrote,

[W]hen AI algorithms make a decision, “even the researchers and programmers creating them don’t really understand why the models they have built make the decisions they make.” Are such decisions equally expressive as the decisions made by humans? Should we at least think about this?

Similar arguments can be made not just for content moderation decisions but also for content creation decisions.

But someone creates AI programs. AI companies and their high-level employees may design their generative AI programs in a way that guides how the programs create speech—by curating training data, adjusting hyperparameters, fine-tuning or aligning models, and building in safeguards—consistently with the companies’ and employees’ preferences and general ideologies. While some developers go to great lengths to build AI models that avoid certain kinds of speech, such as supposed hate speech or copyright infringement, other developers proudly tout “uncensored” AI models.

Generally, AI programs’ output is, indirectly, the AI company’s attempt to produce the most reliable answers to user queries, just as a publisher may establish a newspaper to produce the most reliable reporting on current events. The choices companies and their employees make about what sources to train on and what results to modify using human feedback directly or indirectly influence the output of their AI programs. The analysis shouldn’t change simply because this is done through writing algorithms, selecting training data, and then fine-tuning the models using human input rather than hiring reporters or creating workplace procedures. The AI companies are guiding the creation of AI programs’ speech and thus have a claim to the same First Amendment rights as publishers who set the editorial direction for their newspapers.

To be sure, some of the things AI programs generate aren’t intended or even contemplated by the people who programmed or trained the system. Dan Burk has compared content generated by AI to interesting patterns in clouds or the sound we hear from a seashell: Even if we imbue them with meaning, that doesn’t mean they were created to mean something. Likewise, Peter Salib has argued (see generally pp. 34-46) that “[t]he creators of generative AI systems” “are not trying to create a system with outputs that communicate their own message”: “The whole point of a generative AI system like GPT-4—it’s raison d’être—is to be able to say essentially everything.” 

Still, AI models are designed to generate content that humans understand, and they are trained and refined to facilitate some forms of that content and inhibit others. That is even more true when we move from foundation models to models that are built on them. AI programs thus seem likely to create speech, at least in part, based on the ideological perspective of their creators and fine-tuners.

Users’ Rights to Listen

But whatever one might think of the AI creators’ First Amendment rights, the likely strongest reason for First Amendment protection would be the interests of listeners in receiving meaningful communication. The First Amendment protects “speech” and not just speakers; and while the Fourteenth Amendment protects the liberty of “person[s],” that includes the liberty to receive speech and not just to speak.

To the extent that the First Amendment aims to protect democratic self-government, the search for truth, and the marketplace of ideas (the First Amendment’s three most commonly cited justifications), that must extend to the rights of those who would consider the speech in making democratic decisions, in trying to identify the truth, and in weighing the value of rival ideas, and not just to the rights of those who create and distribute the speech. And to the extent that the First Amendment aims to protect the interests of thinkers or democratic citizens, listeners have their own rights as thinkers and democratic citizens, including the right to receive speech. As users (for better or worse) increasingly turn to AI systems to easily access and aggregate information, these core First Amendment concerns justify protecting such sources of information.

Indeed, the Court has long recognized First Amendment rights “to hear” and “to receive information and ideas.” Regardless of whether any speaker interests are involved in an AI program’s output, readers can gain at least as much from what the program communicates as they do from commercial advertising, corporate speech, and speech by foreign propagandists—three kinds of speech that have been held to be protected in large part because of listener interests. Courts also periodically hold that dead people have no constitutional rights, but there is certainly a First Amendment-protected interest in reading the writings of, say, Aristotle or Galileo or Machiavelli.

Consider, for instance, a state law restricting AI output that is critical of the government, or that discusses abortion or gender identity or climate change (even if the restriction is framed in an ostensibly viewpoint-neutral way). Such a law would undermine users’ ability to hear arguments that they might find persuasive and relevant to their political and moral decision-making. The First Amendment protects readers from such government restrictions on speech composed by AI programs, just as it protects readers from government restrictions that block the readers from speech composed by foreign governments or corporations or dead authors. (To be sure, some speech that fits within First Amendment exceptions, such as libel or perhaps deepfake nonconsensual pornography, may be constitutionally unprotected against such restrictions whether or not there is listener demand for it, as the second part of this piece will describe—but that is a narrow set of exceptions.

Commercial advertising is less protected from speech restrictions than other speech, especially when it is false or misleading; but this stems from other features of commercial advertising, not from its being justified by listener interests. It is possible that certain specific types of AI program output—such as the output of AI systems that are highly integrated into personalized advertising delivery systems—are indeed a form of commercial advertising. But there is little reason to apply commercial speech doctrine when AI programs produce material that has no connection to advertising. And speech outside commercial advertising does not lose protection because it is distributed for profit.

Users’ Rights to Speak

People also often use AI programs to create their own speech: to create text that they can edit and then publish; to fill in gaps in already-drafted work; and, more indirectly, to get a general research summary of a subject that facilitates more research and then future speech. Some such uses may of course be dishonest, for instance, if a student turns in an AI-written project in a course where such technological assistance is forbidden. But all technologies can be used dishonestly, and much AI-assisted writing is perfectly legitimate.

Courts have recognized that the First Amendment protects the use of technology to gather information and create materials that will be part of users’ speech. This is particularly clear in the recent circuit court cases recognizing the right to video record and audio record in public places (at least when people are recording government officials, such as police officers), because such recording enables further speech by the recorder. The recorder isn’t speaking. The recording itself doesn’t directly facilitate listening. But the recording is constitutionally valuable because it can be communicated to others.

The same may be said about AI programs, even apart from users’ rights as readers and AI companies’ rights as speakers. They are tools for creating user speech and, therefore, are as protected by the First Amendment as are cameras and voice and video recorders.

All this is just a special case of the proposition that the First Amendment protects technologies that make it easier to speak. The “press” itself refers to one such technology, the printing press, which was of course both immensely valuable and immensely disruptive. Since then, the Court has recognized such protection for film, cable television, the internet, social media, and more. 

The same would likely apply to generative AI. Just as the internet and social media have become “the most important places ... for the exchange of views,” and are thus fully protected by the First Amendment, so too are AI programs likely to be among the most important tools for people to be able to speak (as well as to listen).

First Amendment Exceptions

But even if AI output is presumptively protected by the First Amendment, much as human-written web pages or newspaper articles are, it, like other speech, may still be restricted.

Defamation

False Statements of Fact

There is, for instance, a defamation exception to the First Amendment, and it would likely apply to some AI output. Say, for instance, that you use a search engine that outputs an AI summary of the results, and that the AI summary contains false and reputation-damaging information about a particular person you’re thinking of hiring or doing business with. This output about the person, even if just sent to one reader (you), would count as “publication” required for defamation liability. It would be seen as a factual assertion about the person. And it has the potential to damage the person’s reputation. (These are basically the elements of the defamation claim, in addition to the speaker’s mental state, which is addressed below.)

Some observers have argued that AI programs’ output shouldn’t be seen as a factual claim, because it’s just the result of a predictive algorithm that chooses the next word based on its frequent location next to the neighboring ones in the training data—in discussions with other legal scholars, I’ve seen analogies made to Ouija boards, Boggle, “pulling Scrabble tiles from the bag one at a time,” and a “typewriter (with or without an infinite supply of monkeys).”

But I don’t think that’s right. In libel cases, the threshold “key inquiry is whether the challenged expression, however labeled by defendant, would reasonably appear to state or imply assertions of objective fact.” And AI companies have generally touted their programs as generally pretty reliable (though not fully reliable) sources of factual assertions, not just as a source of entertaining nonsense.

What, for instance, is OpenAI doing when it promotes ChatGPT’s ability to get high scores on bar exams or the SAT? Or when it stresses in the subtitle to its product description, “GPT-4 can solve difficult problems with greater accuracy, thanks to its broader general knowledge and problem-solving abilities”? It’s trying to get the public to view ChatGPT’s output as pretty trustworthy. 

Likewise when AI software is incorporated into search engines, or into other applications, presumably precisely because it’s seen as pretty reliable. The AI companies’ current and future business models rest entirely on their programs’ credibility for producing reasonably accurate summaries of the facts.

Indeed, as OpenAI has noted, “hallucinations”—meaning the inclusion of incorrect information made up by the AI program itself—“can become more dangerous as models become more truthful, as users build trust in the model when it provides truthful information in areas where they have some familiarity.” After OpenAI promotes its superiority to 90 percent of test-takers at producing answers to complicated questions, it can’t then turn around and, in a libel lawsuit, argue that it’s all just Jabberwocky.

Naturally, everyone understands that AI programs aren’t perfect. But everyone understands that newspapers aren’t perfect either, and some are less perfect than others—yet that can’t be enough to give newspapers immunity from defamation liability; likewise for AI programs. And that’s especially so when the output is framed in quite definite language, often with purported quotes from respected publications. 

To be sure, people who are keenly aware of the “large libel models” problem might be so skeptical of anything AI programs output that they wouldn’t perceive any of the programs’ statements as factual. But libel law looks at the “natural and probable effect” of assertions on the “average lay reader,” not at how something is perceived by a technical expert.

The Limits of Disclaimers

AI programs often include disclaimers that stress the risk that their output will contain errors. But such disclaimers don’t immunize AI companies against potential libel liability.

To begin with, such disclaimers can’t operate as contractual waivers of liability: Even if the AI programs’ users are seen as waiving their rights to sue based on erroneous information when they submit a query despite seeing the disclaimers, that can’t waive the rights of the third parties who might be defamed.

Nor do the disclaimers keep the statements from being reasonably viewed as actionable false statements of fact. Defamation law has long treated false, potentially reputation-damaging assertions about people as actionable even when it’s evident that the assertions might be false. No newspaper can immunize itself from libel lawsuits for a statement that “our research reveals that John Smith is a child molester” by simply adding “though be warned that this might be inaccurate” (much less by putting a line on the front page, “Warning: We may sometimes publish inaccurate information”). Likewise, if I write, “I may be misremembering, but I recall that Mary Johnson had been convicted of embezzlement,” that could be libelous despite my “I may be misremembering” disclaimer.

To be sure, if a disclaimer actually describes something as fiction, or as parody or a hypothetical (both forms of fiction), that may well preclude defamation liability. Stating something that obviously contains no factual assertion at all can’t lead to defamation liability. But such liability can be imposed when speakers state factual assertions about which they express uncertainty.

And AI program interfaces generally don’t describe the programs as producing fiction (at least in the absence of a prompt that asks them to produce fiction), since that would be a poor business model for them. Rather, they tout their general reliability and simply acknowledge the risk of error. That acknowledgment doesn’t preclude liability. 

The law’s treatment of rumors offers a helpful analogy. When reasonable people hear the statement, “Rumor has it that John Smith was convicted of embezzlement,” they recognize that the underlying assertion about the conviction might be true but might be false. “Rumor has it” is in practice a form of disclaimer, since all of us are aware that rumors are often untrustworthy.

Yet “when a person repeats a slanderous charge, even though identifying the source or indicating it is merely a rumor, this constitutes republication and has the same effect as the original publication of the slander.” When speakers identify something as rumor, they are implicitly saying “this may be inaccurate”—but that doesn’t itself get them off the hook. (Discussing rumors in the course of calling for an investigation of the matter, or of reporting on the controversy created by the rumors, might sometimes be seen as not actionable; but that context is absent in the typical AI program output.)

Likewise, say that you present both an accusation and the denial of the accusation. By doing that, you’re making clear that the accusation may well be inaccurate—perhaps the accusation is wrong and the response is right. Yet that doesn’t generally stop you from being liable for repeating the accusation. 

To be sure, there are some narrow and specific privileges that defamation law has developed to free people to repeat possibly erroneous content without risk of liability, in particular contexts where such repetition is seen as especially necessary. For instance, some courts recognize the “neutral reportage” privilege, which immunizes “accurate and disinterested” reporting of “serious charges” made by “a responsible, prominent organization” “against a public figure,” even when the reporter has serious doubts about the accuracy of the charges. But other courts reject the privilege. 

And even those that accept it apply it only to narrow situations: Reporting false allegations remains actionable—even though the report makes clear that the allegations may be mistaken—when the allegations relate to matters of private concern, or are made by people or entities who aren’t “responsible” and “prominent.” Such reporting certainly remains actionable when the allegations themselves are erroneously recalled or reported by the speaker.

The privilege is seen as needed precisely because of the general rule that, absent such a privilege, passing on allegations can be libelous even when it’s made clear that the allegations may be erroneous. And the privilege is a narrow exception justified by the “fundamental principle” that, “when a responsible, prominent organization ... makes serious charges against a public figure,” the media must be able to engage in “accurate and disinterested reporting of those charges,” because the very fact that “they were made” makes them “newsworthy.” 

The AI Companies’ Mental State

Libel law famously requires “actual malice”—knowledge or recklessness as to falsehood—for lawsuits brought by public officials, public figures, and some others. But while that element wouldn’t be satisfied for many AI hallucinations, it might be satisfied once the person about whom the falsehoods are being generated alerts the AI company to the error. If the AI company doesn’t take reasonable steps to prevent that particular falsehood from being regenerated, then it might well be held liable when the particular hallucination is conveyed again in the future: At that point, the company would indeed know that its software is spreading a particular falsehood. Such knowledge plus failure to act to prevent such repeated spread of the falsehood would likely suffice to show actual malice.

And sometimes, in lawsuits brought by private figures or as to speech on matters of private concern, libel law can be satisfied by a showing of negligence. That might well be found, by analogy to product liability for negligent design, if “the foreseeable risks of harm posed by the product could have been reduced or avoided by the adoption of a reasonable alternative design ... and the omission of the alternative design renders the product not reasonably safe.” Of course, this would require a great deal of argument about what alternative designs were available, and how effective they would be. But such an argument is a standard feature of design defect liability lawsuits.

Section 230

Nor would Section 230 provide protection for AI companies here (or in the scenarios discussed below). Section 230 states that “[n]o provider or user of an interactive computer service shall be treated as the publisher or speaker of any information provided by another information content provider.” But AI programs’ output is composed by the programs themselves—it isn’t merely quotations from existing sites (as with snippets of sites offered by search engines) or from existing user queries (as with some forms of autocomplete that recommend the next word or words by essentially quoting them from user-provided content). 

A lawsuit against an AI company would thus aim to treat it as a publisher or speaker of information provided by itself. And the AI company would thus itself be a potentially liable “information content provider.” Under Section 230, such providers—defined to cover “any person or entity that is responsible, in whole or in part, for the creation or development of information provided through the Internet or any other interactive computer service” (emphasis added)—can be legally responsible for the information they help create or develop.

To be sure, large language models (LLMs) appear to produce each word (or portion of a word, called a token) based on word frequency connections drawn from sources in the training data. Their output is thus in some measure derivative of material produced by others.

But all of us who are writing our own material rely almost exclusively on words that exist elsewhere and then arrange them in an order that likewise stems largely from our experience reading material produced by others. Yet that can’t justify immunity for us when we assemble others’ individual words in defamatory ways. 

For instance, courts have read § 230 as protecting even individual human decisions to copy and paste particular material that they got online into their own posts: If I post to my blog some third-party-written text that was intended for use on the internet (for instance, because it’s already been posted online), I’m immune from liability. But if instead I myself write a new defamatory post about you, I lack § 230 immunity even if I copied each word from a different web page and then assembled them together: I’m responsible in part (or even in whole) for creating the defamatory information. Likewise for AI programs.

Negligent Errors That Can Lead to Physical Harm

AI companies might also be held liable for some speech beyond just defamation, though that is less clear. For instance, if an LLM outputs information that people are likely to misuse in ways that harm persons or property—for instance, inaccurate medical information—there might be liability, but not certainly so. 

In one of the few cases on the subject, the U.S. Court of Appeals for the Ninth Circuit rejected—partly for First Amendment reasons—a products liability and negligence claim against the publisher of a mushroom encyclopedia that allegedly “contained erroneous and misleading information concerning the identification of the most deadly species of mushrooms.” But the decision left open the possibility of liability in a case alleging “fraudulent, intentional, or malicious misrepresentation.” As with public-figure libel, then, an AI company might be liable when it receives actual notice that its AI program is producing specific false factual information but doesn’t take reasonable steps to stop the program from doing so.

Accurate Information That Can Be Misused by Criminal Users

Sometimes an AI program might communicate accurate information that some readers can use for criminal purposes. This might include information about how one can build bombs, pick locks, bypass copyright protection measures, and the like. It might also include information that identifies particular people who have done things that may target them for retaliation by some readers.

Whether such “crime-facilitating” speech is constitutionally protected from criminal and civil liability is a difficult and unresolved question. But, again, if there ends up being liability for ordinary publishers knowingly distributing some such speech (possible) or negligently distributing it (unlikely, given lower court decisions expressing skepticism about negligence-based liability for speech that leads to physical harm by third parties), similar liability might be imposed on AI companies. By contrast, if legal liability is limited to purposeful distribution of crime-facilitating speech, as some laws and proposals have provided, then the AI company would be immune from such liability, unless the employees responsible for the software were deliberately seeking to promote such crimes through the use of their software.

Infringement of Rights of Privacy and Publicity (Especially as to Video Deepfakes)

Likewise, pornographic images that depict nonconsenting parties may well be constitutionally unprotected. Some courts have upheld restrictions on such nonconsensual pornography on the grounds that they are “narrowly tailored” to a “compelling government interest” in protecting privacy; those cases have focused on actual photographs or videos, but their logic may apply to AI-generated images as well. Alternatively, such restrictions may be defended on the grounds that they fit within the exceptions for “obscenity” or for the so-called right of publicity. (The right of publicity generally applies to commercial distribution of people’s likenesses without their consent, but a variant of the invasion of privacy tort labeled “appropriation of ... likeness” might apply to noncommercial material as well.)

In any event, if the images are indeed constitutionally unprotected, then the developers might potentially be held liable for such output. But any such liability would, I think, require a showing that the AI product developers know their products are being used to create such images and fail to institute reasonable measures that would prevent that result without unduly interfering with the creation of constitutionally protected material.

Costs and Benefits, of the Software and of Litigation

The creation of GPT-4 and similar AI programs appears to be an extraordinary feat. The programs are remarkable in their ability to produce often potentially quite useful and accurate answers to users’ questions. There is also reason to think that they will grow still more powerful and reliable. They have the potential to save humans from a remarkable amount of work and to sharply democratize access to knowledge.

Yet the creators and distributors of even the most useful inventions—medicines, electric power lines, airplanes, trains, cars, and more—are generally subject to legal liability when the inventions cause certain kinds of harm. That is especially so when the harm is caused not just by deliberate misuse by their users (something that is generally hard to prevent) but also by outcomes that the product users clearly do not desire: side effects, electrocution, crashes, and more. The risk of communications by AI programs that are defamatory or that lead to physical harm is one such example.

Exactly what will count as actionable negligent or knowing misconduct by AI companies, and what will count as an inevitable and nonnegligently created risk of the technology, will turn in large part on the facts. But some such liability, especially as to defamation, seems plausible.

* * *

This article is based on Eugene Volokh, Mark A. Lemley, & Peter Henderson, “Freedom of Speech and AI Output,” and on Eugene Volokh, “Large Libel Models? Liability for AI Output.”