Everyone Hates These Design Patterns. Turns Out They’re Already Illegal.
And they admitted it in court.
In February 2026, Google’s trial lawyer stood up in a Los Angeles courtroom and told the jury that every YouTube feature the plaintiff challenged in opening statement could be disabled. Autoplay. Infinite scroll. Push notifications. Algorithmic recommendation defaults. All of it. The speaker was Luis Li, trial counsel for YouTube and Google in KGM v. Meta & YouTube, JCCP 5255. Opening statement. Open court. On the record.
The concession was meant to help Google. Counsel was telling the jury the plaintiff had user controls and chose not to use them. That framing has consequences counsel did not intend, because on-the-record feasibility of accommodation is the element a disability civil rights plaintiff needs to establish that a federal statute has been violated and the correct remedy is prospective redesign.
Five weeks later, the jury reached six million dollars finding Meta and Google liable for design features that caused addictive use and mental health harm in a twenty-year-old who had started on YouTube at six and Instagram at nine. One day before that verdict, on March 24, 2026, a Santa Fe jury in New Mexico v. Meta Platforms, Inc. had found Meta liable under the New Mexico Unfair Practices Act and assessed roughly $375 million in civil penalties, with a bench trial on public nuisance and injunctive relief set for May.
Two juries. Two states. Forty-eight hours. Both verdicts are under appeal. Neither appeal can erase the trial records, which are now public. Those records are the point of this piece.
The press has called this social media’s tobacco moment. Tobacco fell to a convergence of enforcement mechanisms: product liability, state consumer protection, FDA action, state AG coordination, and the Master Settlement Agreement. The current social media litigation runs almost entirely on negligence and state consumer protection. MDL 3047 and JCCP 5255 together hold roughly 1,600 individual plaintiffs and 800 school district claims, all pleaded under product liability and negligence. The next bellwether trials begin in San Francisco this summer.
Absent from every one of those cases is the federal civil rights framework that would convert per-plaintiff damages into systemic injunctive relief against the defaults themselves. Two federal statutes already reach these design choices.
The first is Section 504 of the Rehabilitation Act, which prohibits disability discrimination in any program or activity of any entity that receives federal financial assistance. The second is Title III of the Americans with Disabilities Act, which prohibits disability discrimination by any private entity that operates a place of public accommodation. The two statutes do not compete. They cover different parts of the defendants’ portfolios, and together they reach the entire thing.
What the design patterns actually do
The features the KGM jury condemned are not arbitrary. Each targets a specific neurological mechanism that, when impaired, constitutes a recognized disability under federal civil rights law.
Infinite scroll removes the natural stopping point that ends a browsing session. Stopping is an executive function event, a prefrontal-cortex computation comparing the cost of continuing against the cost of disengaging. Executive function impairment is a defining diagnostic criterion of ADHD under DSM-5. Roughly 4.4 percent of American adults and 11 percent of American children meet criteria. All of them are protected under Section 504 and the ADA.
Autoplay removes the moment of choice between videos; task transition difficulty is a defining feature of autism spectrum disorder and ADHD. Push notifications manufacture urgency that triggers attentional capture, a vulnerability recognized in ADHD, anxiety disorders, and OCD. Variable-reward algorithmic recommendation exploits dopamine-mediated reward prediction error; dopamine dysregulation is central to ADHD, bipolar disorder, substance use disorder, and behavioral addictions including gambling disorder. Beauty filters and social comparison metrics exploit body image and social evaluation systems whose dysregulation is central to body dysmorphic disorder, eating disorders, major depressive disorder, and anxiety disorders.
The population reached through these mechanisms is not niche. ADHD alone covers about one in ten American adults. Depression and anxiety together cover roughly one in five. Autism, PTSD, substance use histories, and the broad ADA Amendments Act definition push the numbers further. The protected class in the meaningful-access analysis ends up being most internet users. The remedy for the disabled class reaches everyone because the mechanism of harm is universal.
Project Myst
Meta’s own internal research did most of the hard work of the civil rights case already. Project Myst was a Meta study of one thousand teens and their parents, admitted into evidence in KGM. Children who had experienced adverse events (trauma, stress, pre-existing vulnerability) were particularly susceptible to addictive use patterns on Meta platforms. The population overlapping with federally protected disability classes was identified by Meta as disproportionately harmed. Parental controls and supervision settings had little impact on use patterns. The accommodation Meta points to as its defense was shown by Meta’s own researchers to fail.
Internal Meta communications admitted at trial described Instagram as “like a drug” and the employees running it as “basically pushers.” Internal strategy documents noted that eleven-year-olds were four times as likely to return to Instagram as to competing platforms, despite the platform’s thirteen-year-old minimum age. “If we wanna win big with teens, we must bring them in as tweens.” Internal Google documents compared YouTube’s engagement mechanics to those of a casino. The statutes follow.
Section 504 and the four pathways
Section 504 attaches when a private corporation receives federal financial assistance. The scope of coverage depends on which of four pathways at 29 U.S.C. § 794(b)(3) the particular award falls under. Subparagraph (A) covers the entire corporation when assistance is extended to the corporation as a whole (entity-level grants, corporate-level PPP loans). Subparagraph (B) covers the entire corporation when the corporation is principally engaged in one of five enumerated service categories: education, health care, housing, social services, or parks and recreation. Subparagraphs (C) and (D) cover the specific program or facility receiving assistance.
The pathway analysis is defendant-specific and runs off public records. USAspending.gov shows Microsoft as a (D)-pathway facility-specific recipient through Department of Defense and Department of Agriculture research grants, and as an (A)-pathway whole-corporation recipient by successor inheritance through its October 2021 acquisition of Clear Software (which held a 2020 PPP loan) under the successor-liability language of 45 C.F.R. § 84.3(f). Google LLC appears as direct recipient on Affordable Connectivity Program payments and a $46 million OPIC political risk insurance policy. Fitbit LLC appears as sub-recipient on NIH Precision Medicine Initiative awards through Scripps Research Institute as pass-through.
None of those awards, standing alone, pulls a parent corporation’s general consumer product operations inside Section 504. The pathway that does is (B), principal engagement in one of the five enumerated categories. A subsidiary or product line that is purpose-built for one category, marketed as tailored to the category, priced at a premium for that tailoring, and certified under category-specific compliance regimes because of it, is principally engaged in the category. Fitbit and One Medical (an Amazon subsidiary) are the cleanest candidates. Microsoft Cloud for Healthcare, Google Cloud for Healthcare, Microsoft Education, Google Classroom, YouTube Health, Apple Health, and Amazon Pharmacy sit on the same spectrum.
On March 25, 2026, the same day as the KGM verdict, the Supreme Court decided Cox Communications, Inc. v. Sony Music Entertainment, a copyright case holding that an internet service provider is not liable for contributory infringement absent affirmative inducement or provision of a service “tailored to” the infringing use. Cox is not civil rights law. The connection is analogical. The Cox distinction between general-purpose infrastructure and purpose-built tailored service maps onto the § 794(b)(3)(B) principal-engagement inquiry. Google, Amazon, Microsoft, Mozilla, and Pinterest filed a joint amicus brief in Cox arguing that their services are neutral general-purpose technology infrastructure. They prevailed. Those same corporations cannot credibly tell a Section 504 court that Microsoft Cloud for Healthcare, Google Cloud for Healthcare, and AWS Public Sector Healthcare are merely general-purpose infrastructure that happens to get used in health care, while marketing the same offerings as HIPAA-compliant purpose-built health care services commanding premium pricing for their specialization. Whether a court formalizes the contradiction through judicial estoppel under New Hampshire v. Maine, 532 U.S. 742 (2001), or treats it as persuasive tension, principal engagement follows the tailoring.
Section 504 accordingly reaches the vertical products of Microsoft, Alphabet, Apple, and Amazon cleanly. It reaches Meta less cleanly, because Meta does not operate purpose-built health care, education, housing, social services, or parks and recreation verticals on the same scale. The primary enforcement vehicle against Meta for the KGM conduct is Title III.
Title III
Title III does not require recipient status. It reaches whatever a company operates as a place of public accommodation. The categories at 42 U.S.C. § 12181(7) include places of public gathering, service establishments, sales or rental establishments, and places of exhibition or entertainment.
The Ninth Circuit in Robles v. Domino’s Pizza, LLC, 913 F.3d 898 (9th Cir. 2019), held that a pizza chain’s website and mobile app were covered by Title III because they connected to the physical places of public accommodation. The Supreme Court denied certiorari. The First Circuit’s earlier opinion in Carparts Distribution Center, Inc. v. Automotive Wholesaler’s Association of New England, 37 F.3d 12 (1st Cir. 1994), articulated the foundational logic: if Title III’s coverage were strictly geographic, the statute would protect a disabled person walking into a shoe store and strip the same person of all civil rights the moment the transaction moved to a telephone or mail-order catalog. Carparts, Pallozzi v. Allstate Life Insurance, 198 F.3d 28 (2d Cir. 1999), and Doe v. Mutual of Omaha Insurance, 179 F.3d 557 (7th Cir. 1999), establish in the First, Second, and Seventh Circuits that standalone digital services can be public accommodations without any physical-place nexus.
The Third, Sixth, Ninth, and Eleventh Circuits apply a nexus requirement in some contexts. The split does not foreclose Title III coverage of the platform defendants anywhere. Amazon runs warehouses, Whole Foods, and Amazon Fresh. Apple runs more than 270 physical stores. Microsoft operates retail locations and direct hardware sales. Google integrates Maps and Pay with physical merchants. Meta’s Reality Labs sells Meta Quest hardware through Best Buy partnerships and direct Meta retail; the hardware requires Meta account authentication to function. Instagram Shopping, Facebook Marketplace, and WhatsApp Business each connect users to physical merchants. The nexus is present wherever a circuit demands it. Federal courts have converged on WCAG 2.1 Level AA as the operative digital-accessibility standard.
Alexander v. Choate and the empty design record
Neither statute requires proof of discriminatory intent. The Supreme Court in Alexander v. Choate, 469 U.S. 287 (1985), held that Section 504’s prohibition reaches “thoughtlessness and indifference” toward disabled persons, not only animus. The same principle carries through Title III and through the disparate-impact analyses under both statutes. Disparate impact means a facially neutral practice has the effect of discriminating against a protected class; proof of the disproportionate effect plus failure to accommodate carries the claim.
The KGM discovery record documents two things the plaintiffs’ negligence theory did not need. First, the platforms’ design records contain no documented consideration of disability, accessibility, or disparate impact on cognitive disability classes. Internal design documents, product specifications, and engineering decision records produced in discovery do not reveal any point at which Meta or Google evaluated the effect of infinite scroll, autoplay, push notifications, algorithmic recommendation, or variable reward on users with ADHD, autism, mood disorders, PTSD, or eating disorders. The design process proceeded as if the protected class did not exist. That is Choate thoughtlessness at its center.
Second, where internal research did identify disparate vulnerability, the platforms failed to respond. Meta had Project Myst. Meta did nothing with it. The Supreme Court in Davis v. Monroe County Board of Education, 526 U.S. 629 (1999), articulated the deliberate-indifference standard as actual knowledge plus a response that is clearly unreasonable. Meta’s response to Project Myst was no response at all.
An empty design record is itself affirmative evidence that disability consideration was not part of the process. A recipient whose design record is empty cannot meet the affirmative-defense burden that disparate-impact doctrine places on it: the burden to show it considered disability and adopted the least-discriminatory alternative available. The recipient did not consider, and did not adopt. The remedy at that point is prospective compliance, meaning redesign of defaults.
The consent gate
The consent gate is the interface through which a prospective user accepts the platform’s terms of service, privacy policy, data collection practices, algorithmic recommendation defaults, arbitration clauses, and class-action waivers. Access to the service is contingent on acceptance. The consent flow is itself a communication from the platform to the user, and the design of that communication is subject to both Section 504 and Title III.
28 C.F.R. § 36.303 requires a public accommodation to furnish appropriate auxiliary aids and services to ensure effective communication with individuals with disabilities. Section 504’s corresponding obligation operates through Choate‘s meaningful-access doctrine. A consent flow composed of dense legal text, low-contrast typography, timed acceptance, pre-checked boxes, dark-pattern defaults, and service denial as the alternative to immediate acceptance is not effective communication with users whose executive function, attentional capture, working memory, or stress tolerance is impaired. Every one of those cognitive features defines a federally protected disability. The FTC’s 2022 report on dark patterns identifies consent-gate manipulation as a distinct category of unfair practice.
Project Myst does the same work at the gate that it does downstream. A user who cannot effectively exercise parental controls post-acceptance cannot effectively exercise consent pre-acceptance. The same cognitive vulnerabilities that defeat the accommodation defeat the consent.
The consent-gate violation is standing-cognizable at the moment of the consent demand, without reference to downstream harm. Class certification is structurally available; the class is definable without individual downstream experience, and the common question is answerable class-wide through evidence about the flow’s design and the clinical literature on the protected class’s cognitive profile. The theory bypasses the Title III physical-nexus question entirely under the Section 504 pathway, because Section 504’s coverage unit is the recipient’s program or activity.
Consent obtained through a gate that violated the defendant’s civil rights duty to provide effective communication is not meaningful consent with respect to the disabled user. The contract the gate purports to form is formed through a federal civil rights violation. Terms of service embed binding arbitration, class-action waivers, jury-trial waivers, and liability limitations; every one of those provisions depends for its validity on the premise that the user consented at the gate.
The Supreme Court in Rent-A-Center, West, Inc. v. Jackson, 561 U.S. 63 (2010), distinguished challenges to arbitration clauses from challenges to formation of the underlying contract. A plaintiff arguing the consent gate violated federal civil rights law is challenging formation. If no valid contract was formed, no valid arbitration obligation exists. AT&T Mobility LLC v. Concepcion, 563 U.S. 333 (2011), enforces class-action waivers inside arbitration clauses; it does not address the prior formation question. The FAA’s preemption doctrine does not run against federal civil rights statutes that operate on contract formation. A plaintiff who establishes the consent-gate violation unlocks the courtroom door for every other claim a member of the protected class might bring against the platform.
Doctrinal challenges
Three objections get raised across both frameworks. Each has an answer.
Alexander v. Sandoval, 532 U.S. 275 (2001), held there is no private right of action to enforce disparate-impact regulations promulgated under Title VI. Because Section 504 borrows Title VI’s remedial scheme, Sandoval reaches Section 504 disparate-impact private plaintiffs the same way. It does not reach administrative enforcement by the Office for Civil Rights, Protection and Advocacy agency standing, state attorney general parens patriae enforcement, or Title III (which supplies its own express private right of action at 42 U.S.C. § 12188(a)(1)). The enforcement architecture here works around Sandoval by deploying the mechanisms the decision does not reach.
Cummings v. Premier Rehab Keller, P.L.L.C., 142 S. Ct. 1562 (2022), held that emotional distress damages are not available under Spending Clause civil rights statutes, which includes Section 504. Cummings does not eliminate Section 504 remedies. It leaves injunctive relief, declaratory relief, attorneys’ fees, and administrative remedies intact. It does not reach Title III at all. For a systemic project whose primary remedy is injunctive redesign of defaults, Cummings is a narrow constraint. Rule 23(b)(2) injunctive classes remain available under both statutes.
Section 230 of the Communications Decency Act immunizes interactive computer services from liability for third-party content. The Ninth Circuit in Lemmon v. Snap, Inc., 995 F.3d 1085 (9th Cir. 2021), held that claims targeting a platform’s own design feature are not barred by Section 230 when the claim does not depend on any characterization of third-party content. The design features at issue in KGM are the companies’ own engineering choices. Infinite scroll is their code. Autoplay is their code. Push notification timing is their code. The New Mexico Attorney General cleared Section 230 in New Mexico v. Meta on the design-conduct theory and obtained a jury verdict. A state AG adding Section 504 or Title III counts to a case that has already cleared Section 230 on design-conduct grounds faces materially less Section 230 exposure than a plaintiff bringing a standalone civil rights case would.
Enforcement pathways
Six enforcement mechanisms are available now against defendants already in the record.
OCR administrative complaints under Section 504. An organizational complainant can file without individual plaintiffs, without damages, and without waiting for litigation. A complaint citing USAspending records for recipient status, the KGM record for design conduct, the clinical literature for disability mapping, and the on-the-record feasibility concession invokes OCR investigative jurisdiction. The administrative record survives whatever the short-term enforcement posture happens to be.
Rule 23(b)(2) injunctive class actions. Wal-Mart Stores, Inc. v. Dukes, 564 U.S. 338 (2011), denied certification to a 1.5 million-member class challenging dispersed discretionary decisions by thousands of store managers. The commonality failure in Dukes was the diversity of the challenged conduct. The defaults-redesign class presents the opposite structure: the challenged conduct is the uniform design of a single platform’s default settings, confronting every class member at the same point in the user experience, with uniform relief. Dukes‘s commonality objection does not carry over.
Amended counts in MDL 3047 and JCCP 5255. Roughly 1,600 individual plaintiffs and 800 school district claims are already in the pipeline. Their counsel can add Section 504 and Title III counts to existing complaints. The discovery record is done.
State Protection and Advocacy agency litigation under Section 504. Every state has a federally funded P&A agency with statutory authority to bring Section 504 actions on behalf of disabled residents, under 42 U.S.C. § 15043, 42 U.S.C. § 10801 et seq., and 29 U.S.C. § 794e. Disability Rights California sits in the right jurisdiction for MDL 3047 and the KGM proceedings. A coordinated multi-state P&A filing, organized through the National Disability Rights Network, presents the platforms with civil rights litigation in multiple jurisdictions simultaneously.
State attorney general coordination. AGs already suing Meta and Google can add Section 504 counts where recipient coverage is established and Title III counts for consumer products regardless of recipient status. Many state disability-rights statutes (California’s Unruh Civil Rights Act, New York State Human Rights Law, Washington Law Against Discrimination, Colorado Anti-Discrimination Act, among others) incorporate or parallel federal standards and authorize state AG enforcement with remedies that in some cases exceed federal remedies. The New Mexico AG’s path is a proven template.
Department of Justice Title III pattern-or-practice enforcement. DOJ has authority under 42 U.S.C. § 12188(b) to bring pattern-or-practice actions with civil penalties of up to $75,000 for a first violation and $150,000 for subsequent violations, plus monetary damages for aggrieved persons. The KGM record establishes pattern conduct across multiple platform defendants. Administrative petitions requesting DOJ enforcement create a record subsequent DOJ action can build upon regardless of the current administration’s enforcement priorities.
What happens in practice
The filing has not happened. The disability rights movement has historically focused on physical accessibility and assistive technology compliance. The consumer protection movement is running negligence and deceptive-practices cases. The state AGs are building on advertising and youth-protection theories. None of those efforts has invoked the federal civil rights frameworks the KGM record makes available. Section 504 has been operative since 1973. Title III has been operative since 1990. The 1987 Civil Rights Restoration Act settled the breadth-of-coverage question. The defendants are already covered under one statute or the other, often both.
Someone will plead this. A state AG will add Section 504 and Title III counts to an existing complaint. A Protection and Advocacy agency will file under its own standing. A Rule 23(b)(2) class will get certified on a consent-gate theory that defeats forced arbitration. An organizational OCR complaint will enter the administrative record. When the remedy comes, it will be forced redesign of defaults, reaching every user of the redesigned product. The defaults the public already hates are the same defaults the disabled class cannot navigate. Fix them for the class, and they are fixed for everyone.