The Volokh Conspiracy

Mostly law professors | Sometimes contrarian | Often libertarian | Always independent

The Reverse Spiderman Principle: With Great Responsibility Comes Great Power

A quick sketch of a longer article that I'm writing for a symposium; I'd love to have readers' suggestions and reactions!


An entity—a landlord, a manufacturer, a phone company, an Internet platform, a manufacturer of self-driving cars—is making money off its customers' activities. Some of those customers are using the entity's services in ways that are criminal or tortious. Should the entity be held responsible for the customers' activities?

This is a broad question, and there might be no general answer. But in this essay, I'd like to focus on one downside of answering it "yes": What I call the Reverse Spiderman Principle—with great responsibility comes great power. We should think whether we want to empower such entities to surveil, investigate, and police their customers' behavior.

* * *

Let me begin by offering three examples of where courts have balked at imposing legal liability, because they didn't want to require or encourage businesses to police their customers. The first came in the early 1900s, where some government officials demanded that telephone and telegraph companies block access to their services by people suspected of running illegal gambling operations. Prosecutors could have gone after the bookies, of course, and they did. But they also argued that the companies should have done the same—and indeed sometimes prosecuted the companies for allowing their lines to be used for such criminal purposes. No, held many courts; to quote one:

A railroad company has a right to refuse to carry a passenger who is disorderly, or whose conduct imperils the lives of his fellow passengers or the officers or the property of the company. It would have no right to refuse to carry a person who tendered or paid his fare simply because those in charge of the train believed that his purpose in going to a certain point was to commit an offense. A railroad company would have no right to refuse to carry persons because its officers were aware of the fact that they were going to visit the house of [the bookmaker], and thus make it possible for him and his associates to conduct a gambling house. Common carriers are not the censors of public or private morals. They cannot regulate the public and private conduct of those who ask service at their hands.[1]

If the telegraph or telephone company (or the railroad) were held responsible for the actions of its customers, then it would acquire power—as "censor[] of public or private morals"—that it ought not possess.

Now those companies were common carriers, denied such power (and therefore, the courts said, responsibility) by law. But consider a second example, Lunney v. Prodigy Services Co., a 1999 case in which the New York high court held that e-mail systems were immune from liability for allegedly defamatory material sent by their users.[2] E-mail systems aren't common carriers, but the court nonetheless reasoned that they shouldn't be held responsible for failing to block messages, even if they had the legal authority to block them: An e-mail system's "role in transmitting e-mail is akin to that of a telephone company," the court held, "which one neither wants nor expects to superintend the content of its subscribers' conversations."[3] Even if e-mail systems aren't forbidden from being the censors of their users' communications, the law shouldn't pressure them into becoming such censors.

And here's a third example: Castaneda v. Olsher, where a mobile home park tenant injured in a gang-related shootout involving another tenant sued the landlord, claiming it "had breached a duty not to rent to known gang members." No, said the court:

[W]e are not persuaded that imposing a duty on landlords to withhold rental units from those they believe to be gang members is a fair or workable solution to [the] problem [of gang violence], or one consistent with our state's public policy as a whole. . . .

If landlords regularly face liability for injuries gang members cause on the premises, they will tend to deny rental to anyone who might be a gang member or, even more broadly, to any family one of whose members might be in a gang.[4]

This would in turn tend to lead to "arbitrary discrimination on the basis of race, ethnicity, family composition, dress and appearance, or reputation," which may itself be illegal (so the duty would put the landlord in a damned-if-you-do-damned-if-you-don't position).

But even apart from such likely reactions by landlords being illegal, making landlords liable would jeopardize people's housing options and undermine their freedom even if they aren't gang members, putting them further in the power of their landlords: "families whose ethnicity, teenage children, or mode of dress or personal appearance could, to some, suggest a gang association would face an additional obstacle to finding housing." Likewise, even if landlords respond only by legally and evenhandedly checking all tenants' criminal histories, "refusing to rent to anyone with arrests or convictions for any crime that could have involved a gang" would "unfairly deprive many Californians of housing." This "likely social cost" helped turn the court against recognizing such a responsibility on the part of landlords.

* * *

Now of course many such companies (setting aside the common carriers or similarly regulated monopolies) have great power over whom to deal with and what to allow on their property, even though they aren't held responsible—by law or by public attitudes—for what happens on their property. In theory, for instance, Prodigy could have decided that it wanted to kick out users who they thought were using their e-mail for evil purposes (whether libel or, say, anti-capitalist advocacy).

But in practice, in the absence of responsibility (whether imposed by law or social norms), many companies will eschew such power, for several related reasons—even setting aside the (presumably minor) loss of business from the particular customers who are ejected:

  1. Policing customers takes time, effort, and money.
  2. Policing customers risks error and bad publicity associated with such error, which could alienate many more customers than the few who are actually denied service.
  3. Policing customers in particular risks allegation of discriminatory policing, which may itself be illegal and at least is especially likely to yield bad publicity.
  4. Policing some customers will often lead to public demands for broader policing: "You kicked group X, which we sort of like, off your platform; why aren't you also kicking off group Y, whom we loathe and whom we view as similar to X?"
  5. Conversely, a policy of "we don't police our customers"—buttressed by social norms that don't require (or even affirmatively condemn) such policing—offers the company a simple response to all such demands.
  6. Policing customers creates tension even with customers who aren't violating the company's rules—people often don't like even the prospect that some business is judging what they say, how they dress, or whom they associate with.
  7. Policing customers gives an edge to competitors who can sell their services as "our only job is to serve you, not to judge you or eject you."

Conversely, imposing legal responsibility on such companies can encourage them to exercise power even when they otherwise wouldn't have. And that is in some measure so even if responsibility is accepted as a broad moral norm, enforced by public pressure, not just a legal norm. That norm would increase the countervailing costs of non-policing. And it would decrease the costs of policing: For instance, the norm and the corresponding pressure will likely act on all major competitors, so the normal competitive pressures encouraging a "the customer is always right" attitude will be sharply reduced.

Likewise, when people fault a company for errors or perceived discrimination, the company can use the norm as cover, for instance arguing that "regrettably, errors will happen, especially when one has to do policing at scale." "After all, you've told us you want us to police, don't you?"

Accepting such norms of responsibility can also change the culture and organization of the companies. It would habituate the companies to exercising such power. It would create bureaucracies within the companies staffed with people whose jobs rely on exercising the power—and which might be looking for more reasons to exercise that power.

And by making policing part of the companies' official mission, it would subtly encourage employees to make sure that the policing is done effectively and comprehensively, and not just at the minimum that laws or existing social norms command. Modest initial policing missions, based on claims of responsibility for a narrow range of misuse, can thus creep into much more comprehensive use of such powers.

* * *

So far, there has been something of a constraint on calls for business "responsibility" for the actions of their customers: Such calls have generally involved ongoing business-customer relationships, for instance when Facebook can monitor what its users are posting (or at least respond to other users' complaints).

Occasionally, there have been calls for businesses to simply not deal with certain people at the outset—consider Castaneda v. Olsher, where plaintiffs argued that defendants just shouldn't have rented the mobile homes to likely gang members. But those have been rare. Few people, for instance, would think of arguing that car dealers should refuse to sell cars to suspected gang members who might use the cars for drive-by shootings or for crime getaways.[5] Presumably most people would agree that even gang members are entitled to buy and use cars in the many lawful ways that cars can be used, and that car dealers shouldn't try to deny gang members access to cars. (If the legislature wants to impose such responsibilities, for instance by banning sales of guns to felons or of spray paint to minors, then presumably the legislature should create such narrow and clearly defined rules, which rely on objective criteria that don't require seller judgment about which customers merely seem likely to be dangerous.)

But now more and more products involve constant interaction between the customer and the seller. Say, for instance, that I'm driving a self-driving Tesla that is in constant contact with the company. Recall how Airbnb refused to rent to people who it suspected were coming to Charlotteville for the "Unite the Right" rally.[6] If that is seen as proper—and indeed as mandated by corporate social responsibility principles—then one can imagine similar pressure on Tesla to stop Teslas from driving to the rally (or at least to stop such trips by Teslas of those people suspected of planning to participate in the rally).

To be sure, this might arouse some hostility, because it's my car, not Tesla's. But of course Airbnb was refusing to arrange bookings for other people's properties, not its own. Its rationale was that it had a responsibility to stop its service from being used to promote a racist, violent event. But why wouldn't Tesla then have a responsibility to stop its intellectual property and its computers (assuming they are in constant touch with my car) from being used the same way? To be sure, Tesla's sale contract might be seen as implicitly assuring that its software will always try to get me to my destination. But that is just a matter of the contract—if companies are seen as responsible for the misuse of their services, why wouldn't they have an obligation to draft contracts that allow them to fulfill that responsibility?

Now maybe some line might be drawn here: Perhaps, for instance, we might have a special rule for services that are ancillary to the sale of goods (Tesla, yes, Airbnb, no), under which the transfer of the goods carries with it the legal or moral obligation to keep providing the services even when one thinks the goods are likely to be used in illegal or immoral ways. (Though what if I lease my Tesla rather than buying it outright?) Or at least we might say there's nothing irresponsible about a product seller refusing to police customers' continuing use of the services that make those products work.

But that would just be a special case of the broader approach that I'm suggesting here: For at least some kinds of commercial relationships, a business should not be held responsible for what its customers do—because we don't want it exercising power over its customers' actions.

* * *

[Again, this is of course just a sketch of what concerns me here. I'll be elaborating on this, and also discussing areas where businesses are indeed held responsible for the actions of others—certainly of their employees but also, sometimes, of tenants and other customers.[7] I'll also discuss how responsibility to prevent crime on one's property has led to pressure to institute more surveillance, for instance with many courts recognizing a duty to install cameras on commercial property. I'd love to hear any suggestions or reactions you folks might have, since I still have plenty of time to work on this.]

[1] Commonwealth v. Western Union Tel. Co., 67 S.W. 59, 60 (Ky. 1901); see also Pa. Publications v. Pa. Pub. Util. Comm'n, 36 A.2d 777, 781 (Pa. 1944) (cleaned up); People v. Brophy, 120 P.2d 946, 956 (Cal. App. 1942).

[2] The case turned on conduct that happened before the enactment of 47 U.S.C. § 230, which provided such immunity by statute. The court therefore addressed whether a libel claim was available in the first place, thus avoiding the need to determine whether § 230 was retroactive.

[3] Lunney v. Prodigy Servs. Co., 723 N.E.2d 539, 542 (N.Y. 1999).

[4] 162 P.3d 610 (Cal. 2007). On this point, the Justices were unanimous.

[5] But see Andrew Jay McClurg, The Tortious Marketing of Handguns: Strict Liability Is Dead, Long Live Negligence, 19 Seton Hall Legis. J. 777, 816 n.178 (1995) (quoting a proposal that gun sellers must, on pain of liability for negligence, "be especially alert to, and wary of, gun buyers who display certain behavioral characteristics such as … appear[ing] in unkempt clothing and hav[ing] a slovenly appearance").


[7] Cf. Morris v. Giant Four Corners, Inc., 498 P.3d 238 (N.M. 2021) (a rare case holding a gas station liable for selling gas to a drunk driver). Many courts reject such negligent entrustment claims when someone is selling goods, as opposed to merely lending them or renting them out.

NEXT: Today in Supreme Court History: January 31, 2006

Editor's Note: We invite comments and request that they be civil and on-topic. We do not moderate or assume any responsibility for comments, which are owned by the readers who post them. Comments do not represent the views of or Reason Foundation. We reserve the right to delete any comment for any reason at any time. Report abuses.

  1. This idea applies to government too. And of course, it's a bedrock principle of statist interpretation of Constitutions. Because government has the responsibility to do such and such, it automatically has the authority to do everything that could possibly further that goal.

    1. A prevailing belief of the modern American statist/Democrat is that the General Welfare clause grants the government virtually unlimited power so long as the intent is for the betterment of the General Welfare.

    2. I have always thought of judge-made common law as really being an excuse for government meddling in areas which are hard to define. Don't try to write down forbidden actions in statutes, that's much too easy for the common peasant to read and (try to) understand. Instead, cloak it in precedent, written in an arcane language, buried in libraries full of dusty books describing cases stretching back centuries, all of which requires an expensive law degree to understand. Keep written laws vague, rely on precedent and judge-made common law to fill in the holes. The side effect is that government employees (judges) get to define government's limits, and they know which side of their bread is buttered.

  2. I sort of like #7 Professor Volokh....

    Policing customers gives an edge to competitors who can sell their services as "our only job is to serve you, not to judge you or eject you."

    This is pragmatic, too.

    1. Then their hosting service and bank say, "Our only job is to spike any platform that thinks that way."

      1. Yeah, what ever happened to 'live and let live'. When I do business with someone, it is 98% transactional. You sell me X for Y price, we're done.

        Ain't the job of business to be a cop. That is what I have taxes for, to pay for cops.

        1. ESG happened.

          1. What does Perry Mason have to do with this?

        2. A key villain in this case is Congress, which passed the Communications Decency Act with the express intent of censoring the Internet. Most of the act was overturned, but the provision known as Section 230 was left in place.

          Under Cubby, Inc. v. CompuServe Inc. (1991), it was previously established that if an interactive computer service did not control what users posted, it was not liable for what users said. And under Stratton Oakmont, Inc. v. Prodigy Services Co. (1995), it was established that if it did exercise control over what users posted, it was liable.

          The combination meant that the only safe harbor for interactive computer services from defamation suits for what users posted was refraining from controlling what users posted. That, of course, was anathema to a Congress that wanted the Internet censored, and accordingly Congress granted immunity to interactive computer services willing to carry out Congress's censorial agenda.

          Historically, the American left would have yelled that when the government gives special privileges to corporations in order to carry out a Congressional agenda of censorship, that constituted government action in violation of the First Amendment. But that was back when the American left wasn't composed of people who were secure in the knowledge that they were the establishment that would control who was censored and why.

  3. Interesting how he didn't use firearms manufacturers as one of his examples.

    1. Firearms manufacturers don't sell direct to the customer, only to government licensed sellers, so the manufacturers' connection to the end user is too indirect.

      1. The "Government Licensed Sellers" are THEIR consumer. I missed that he did mention "a manufacturer" though.

      2. "Firearms manufacturers don't sell direct to the customer, only to government licensed seller"

        Incorrect. I can buy a rifle direct from the manufacturer and pay them. It's shipped to an FFL who performs a background check when I go to pick it up, and I'm out the door with my new rifle. The FFL I've used works out of his home.

        1. Right, but the FFL is supposed to be supplying the 'responsibility' here, it's the chief justification for forcing us to do it that way.

    2. jimc5499: I might end up doing that, because it's an unusual situation where Congress has specifically preempted many theories of legal responsibility (correctly, I think, since those are generally unsound theories that wouldn't be applied to other products); that's the Protection of Lawful Commerce in Arms Act. It just didn't make its way into this early sketch (partly because the legislative action makes this unusual), except indirectly in footnote 5.

      1. I've never understood the legalities surrounding the PLCAA. Its passage seems (to me! IANAL!) to have confirmed that prior lawsuits were valid; why then have not drunk driving victims similarly sued car manufacturers? It's not how long the products have been on the market; guns existed long before cars. It's not the FFL requirement; states have long required cars to be sold by dealers who are separate from manufacturers. and Tesla and others are still fighting such laws n a few states, I believe.

        Or IOW, either the PLCAA was necessary and drunk driving victims are slow to catch on, or the PLCAA was unnecessary and the courts were lax in saying so. Either way smells like hoplophobe politics infesting the judiciary.

        1. "Its passage seems (to me! IANAL!) to have confirmed that prior lawsuits were valid; "

          Nope. If you look at what the people pushing the lawsuits at the time were saying, they didn't actually expect to win in court all that often, they knew quite well the suits were legally frivolous. They were actually engaged in a form of extortion: "Do as we say, or we'll bankrupt you with legal costs and the occasional outlier victory!"

          It was a tactic that wasn't at all dependent on having a good legal case, just gun manufacturers not having deep pockets, and the judiciary being hostile enough to 2nd amendment rights that they wouldn't sanction the frivolous lawsuits.

          Try the same tactic against another product, and the courts would slap you down so fast your head would spin.

        2. Why would the PLCAA's passage confirm that the prior lawsuits against manufacturers were valid? It seems equally consistent with the view that (1) the lawsuits were based on unsound legal theories that courts shouldn't adopt, but (2) there was a risk that a small minority of courts would adopt those legal theories and would do a lot of damage to gun manufacturers and law-abiding gun owners as a result, and (3) in the meantime, the need to defend the lawsuits could do a lot of damage as well. (Indeed, at the time the PLCAA passed, most of the lawsuits against gun manufacturers had been thrown out, but a few courts allowed them to go forward.)

          1. Here's a CATO analysis of the issue.

            The lawsuits were purely extortion, based on the threat of legal costs imposed by government plaintiffs with bottomless litigation pockets.

          2. Thanks -- Brett answered it. I guess I am too rational to think of kamikaze lawsuits. I was thinking it stopped real, plausible, practical legal attacks.

            1. If they were plausible and practical legal attacks, why wasn't anyone making them against other industries (car manufacturers)?

  4. The Tesla example is why we should seriously discourage the growing practice of routing key functionality of products through remote servers. It renders ownership uncomfortably similar to mere rental, and empowers the company providing the functionality to brick the product at its discretion, or even by error.

    It's very rare that a product actually requires continued interaction with the manufacturer. Such dependencies are being deliberately introduced into products that don't actually require them.

    1. This is somewhat related to the right to repair movement, and especially brings to mind how hard John Deere makes it for farmers to repair the tractors they supposedly own, not rent or lease.

  5. We have laws against monopolies largely because of some of the abuses of power they perpetuated in the late 1800's and early 1900's.

    I'm not crazy about the idea doing that again with every single tech platform, but as a few select ones become our de facto public square it is making the application of certain laws seem more enticing. Or the end result is that we are letting a few powerful private individuals determine what you can and cannot effectively say.

    The one sure fire way to finally get some sort of societal consensus on this would be if the left started to get censored by tech companies. Right now they are in bed with them so don't mind it at all. It is cheap (to them) but paid for message control with greater force than even the legacy media. Not going to exactly give that up while they enjoy it.

    The table will turn though at some point in time and then we will hear from the left about "evil corporations controlling our constitutional rights" finally.

    1. I thought you and BravoCharlieDelta were going to shoot us so what's the difference if tech companies lean left right now?

  6. This is an excellent treatment of an important topic!

    Similar situations arise for innkeepers and, over time, innkeepers have become agents of the state. For example, a bartender must be able to recognize valid driver's licenses issued, often with annual modifications, by each of the 50 states (plus the District, the minor outlying islands) and must use this knowledge to enforce drinking law: failure to properly prohibit drinking results in a penalty to the bartender and failure to properly allow drinking (by, say, a Muslim wearing and otherwise-prohibited head covering) also results in a penalty to the bartender. Likewise, an innkeeper must be able to recognize a valid proof-of-vaccination or incur penalty for wrongful admission or penalty for wrongful denial of admission. And in some jurisdictions an innkeeper must be able to distinguish the blue plaid shirts worn by gang members from the blue plaid shirts worn by others, again at a penalty for wrongful admission or a penalty for wrongful exclusion.

    Most innkeepers are not Tesla; that is, Joe the Bartender likely lacks the resources necessary to allow him to be an expert at license examination, medical records examination, and fashion analysis. Moreover, Joe the Bartender wants to be an innkeeper, not a police officer, and receives no compensation -- other than the ability to continue his business operations -- for fulfilling his duties as a police officer.

    We routinely impose cumbersome policing duties on innkeepers. Why not impose policing duties on Tesla? To be certain, I'm not advocating imposing such duties: Tesla should not be able to prevent me from driving a vehicle it built to a naughty place... and, as noted in a comment above, perhaps shouldn't even have the _ability_ to prevent me from undertaking such a journey. But what is the guiding principle: what -- other than size and ability to engage legal resources -- makes Tesla different from the Joe the Bartender?

    1. Government intervenes where it can, like ants or wasps swarming a house, or rain following gravity into whatever nooks and crannies it can find, or ivy gradually tearing down a house -- except some damn fools open the door to invite the good meddling in, not realizing that all meddling has the same unwanted end goal.

    2. Your example of innkeepers is of very recent vintage, and hardly widespread as yet. I have literally NEVER had a hotel ask me about my vaccination status, and until very recently indeed, I don't think anybody was doing it anywhere.

    3. Massachusetts law provides a safe harbor for serving underage drinkers who show an in-state license or federal ID (MGL 138-34B). You accept a New Hampshire license at your own risk. The incentive is to only accept passports, military ID, and Massachusetts ID cards.

  7. The Spidermans are a lovely family but the Marvel Comics hero vigilante is “Spider-Man.”

    1. Ah, good point, thanks, updated my draft article accordingly. And don't forget Batman bin Suparman.

  8. The telegraph example reminded me of a form to apply for an FCC license. You had to check off a box saying you had never been convicted of certain drug offenses.

    I have seen a few cases where companies were sued for renting cars to people who come from countries where they drive on the wrong side of the road, after a crash that might have been caused by driving on the wrong side of the road. The courts declined to impose a duty to refuse to rent to such people. Overall you're much more likely to collide head-on with an old, tired, or drunk driver.

  9. A mention of Dram Shop Acts, which impose liability on an establishment that sells alcohol to an intoxicated person for injuries caused by that person due to his intoxication, might be in order. (The typical case is an intoxicated individual leaving a bar and injuring someone with his car.)

    At common law, the seller of alcohol was not liable for such injuries, but forty-three states and the District of Columbia have decided to supersede that with dram shop acts, though they vary in form, some only applying to minors. In New York, for example, perhaps incongruously, an intoxicated individual cannot sue for his own injuries, but if he dies, his heirs can sue. I think many, if not most of these acts, date to the anti-drunk driving fervor of the 1980s, particularly by MADD (for those old enough to remember).

  10. FYI, if this does get published somewhere, Spider-Man is spelled with a hyphen.

Please to post comments