FOSTA-SESTA: what actually creates criminal liability for a classifieds operator
The question every operator asks eventually
Every operator who runs adult classifieds in or toward the United States eventually asks the same question, usually late at night: am I personally exposed if someone uses my platform to post something illegal? The honest answer sits between two stories operators tell themselves. The first is the old one, that a platform is just a pipe and cannot be blamed for what flows through it. The second is a newer, more anxious one, that any moderation at all creates a paper trail proving the operator knew, so the safest move is to look away. Neither is accurate, and the gap between them is exactly where a real business has to operate.
The law that changed the first story is FOSTA, the Fight Online Sex Trafficking Act, signed on April 11, 2018. It carved a hole in Section 230 of the Communications Decency Act, the federal rule that normally shields a platform from liability for what its users post. Before FOSTA, that shield was close to absolute for sex-trafficking-adjacent claims. After it, a platform can face both criminal charges and a civil lawsuit from a trafficking victim if its own conduct crosses a specific line.
The rest of this piece is about where that line actually sits, because it is narrower and more knowledge-dependent than the panic around FOSTA usually suggests, and because the one prosecution everyone cites to explain it is usually explained wrong. Getting the mechanism right matters more than getting the general fear right, because the fear alone tells an operator nothing about what to actually change in how listings get reviewed.
What the statute actually punishes
FOSTA added a new federal crime, 18 U.S.C. § 2421A. The base offense makes it illegal to own, manage, or operate an interactive computer service with the intent to promote or facilitate the prostitution of another person, and it carries up to ten years in prison. An aggravated version reaches up to twenty-five years, and it applies in two situations: when the operator intended to promote or facilitate the prostitution of five or more people, or when the operator acted in reckless disregard of the fact that the conduct contributed to sex trafficking under the separate federal trafficking statute, 18 U.S.C. § 1591.
That second statute is where the civil exposure lives, and FOSTA changed its wording in a way every operator should read literally. It redefined participation in a venture under § 1591 to mean knowingly assisting, supporting, or facilitating a trafficking violation. Section 230 was then amended to strip away platform immunity for civil claims brought under 18 U.S.C. § 1595, the trafficking victim's private right to sue, whenever the underlying conduct violates § 1591. A trafficking victim does not need a criminal conviction against the platform first; they can sue directly, and the same word does the work in both the criminal and civil tracks: knowingly.
That word is not decorative, and it is the entire hinge of the statute. The law is built around intent and knowledge rather than strict liability for the act of hosting content. A platform that carries listings it has no reason to suspect are connected to trafficking is not automatically exposed just because a bad actor slipped one past its filters; that is a moderation failure, not a federal crime.
What the law reaches is conduct that shows the operator understood what was happening and helped it along anyway, and the hardest part of running a classifieds business under this rule is that understood and helped along gets defined after the fact, from whatever records happen to exist. That is the part worth planning around, not the abstract risk of a single bad listing.
The case everyone cites, and why the popular version is wrong
Almost every article about this topic points to Backpage.com as the reason FOSTA matters, and almost every one gets the sequence backward. Backpage was seized by federal agents on April 6, 2018, and a 93-count indictment against its founders and executives was unsealed three days later, on April 9. FOSTA was not signed into law until April 11, five days after the seizure and two days after the indictment became public. The charges against Backpage's leadership were built on statutes that already existed: the Travel Act, which reaches use of interstate commerce to facilitate an unlawful business, and several counts of money laundering. FOSTA did not take Backpage down; ordinary federal criminal law did that, and FOSTA arrived days later to make sure the next platform built the same way could not rely on Section 230 to avoid the same outcome.
The distinction matters because the actual evidence against Backpage is a far more useful lesson than the myth of a new law reaching back to punish an old site. Investigators, and later a Senate subcommittee, documented an internal tool the company used called Strip Term From Ad Filter. Rather than rejecting listings that contained words associated with trafficking or minors, the tool deleted just those words and republished the rest of the ad automatically. Company records described this as a way to keep the listing live while building what the government's own report called plausible deniability, a phrase that shows up almost verbatim in later court filings.
Editing the evidence of a problem and putting the ad back up is not moderation. It is the single fact pattern that turned a content-hosting defense into a facilitation prosecution, and it is the one habit an operator can eliminate entirely without hiring a lawyer first: reject, do not launder.
The outcome for the people who ran the site tracks that distinction closely. Co-founder Michael Lacey was convicted on November 16, 2023, on one count of international concealment money laundering, while the jury deadlocked on roughly eighty-four other counts the same day. He was sentenced on August 29, 2024, to five years in prison and a three-million-dollar fine, a conviction anchored in financial conduct rather than in a single bad ad slipping through. CEO Carl Ferrer pleaded guilty in April 2018 and cooperated with prosecutors against Lacey and his co-founder. None of this required FOSTA to happen, and none of it is a story about a platform being punished simply for hosting classifieds.
The law is settled, and it is read narrowly, not loosely
FOSTA has been challenged in court since it passed, most seriously by the Woodhull Freedom Foundation and a group of advocacy organizations and sex workers who argued the law was so vague and broad it would chill lawful speech about sex work safety. The case reached the U.S. Court of Appeals for the D.C. Circuit, which ruled on July 7, 2023, upholding the law against that constitutional challenge.
The part of the ruling operators should actually notice is not the outcome but the reasoning: the court said the statute had to be read narrowly, avoiding the broadest interpretations that would raise serious constitutional problems, specifically to keep it from sweeping in operators who never intended to promote or facilitate anything. That is a meaningfully different situation from a law that got struck down, and a meaningfully different situation from one that got a blank check.
FOSTA is not going anywhere, and no pending court challenge is likely to remove it. At the same time, an appellate court has already gone on record that the law reaches intentional or recklessly indifferent conduct, not an operator who ran a normal moderation program and still missed something. Knowing that distinction exists does not make the exposure disappear, but it changes what an operator should actually spend effort defending against: not the theoretical risk of hosting the wrong ad once, but the very real risk of building internal habits that look, on paper, like Backpage's.
What a moderation policy should actually do
Start by writing down, in plain language, what the platform prohibits: any listing connected to a minor, any content suggesting coercion, force, or an inability to consent, and the general categories that regulators and card networks already expect a listings business to police. A policy that exists only as an unwritten understanding between two moderators is not something anyone can point to later as evidence of consistent, good-faith enforcement.
When a listing trips that policy, reject it and require a fresh submission. Do not edit out the flagged word and republish the same ad, no matter how minor the edit feels in the moment. That single habit, automated or manual, is the exact mechanism that turned Backpage's moderators into witnesses against the company; a rejected ad that never goes live again looks nothing like an edited ad that stays up with the incriminating word quietly removed.
Keep a log of moderation decisions that is separate from the personal data collected during identity verification, since the two records serve different purposes and can have different retention needs: one exists to show a rejection was applied consistently rather than selectively, the other exists to prove who an advertiser actually is. A moderation log with a timestamp, the rule that was triggered, and the action taken is cheap to keep and is exactly what turns a hypothetical defense into a real one if a regulator or a plaintiff's lawyer ever asks what happened to a specific listing.
Never coach an advertiser, even in an informal message, on how to reword a rejected listing so it clears the filter next time. That crosses directly into the statute's own language: assisting, supporting, or facilitating. The safer version of customer service explains that a listing was rejected and points to the policy it violated, without drafting a workaround for it.
Do not swing to the opposite extreme and gut moderation out of fear that reviewing content is itself risky. An unmoderated platform is not a safer platform under this statute, since a documented, consistently enforced rejection process is evidence against the state of mind the law actually punishes, and a platform with no review process at all still carries every other risk that comes with unchecked listings. The EU's own liability framework works through a different mechanism, but it rests on a comparable idea: what a platform knew, and what it did once it knew, is what the rules actually measure. Bring in a lawyer who has handled this specific statute when the policy is being written, not after a subpoena arrives, because the cheapest legal work here happens before there is a case.
