GOOGLE, Facebook and other online giants like to see their rapid rise as the product of their founders’ brilliance. Others argue that their success is more a result of lucky timing and network effects—the economic forces that tend to make bigger firms even bigger. Often forgotten is a third reason for their triumph: in America and, to some extent, in Europe, online platforms have been inhabiting a parallel legal universe. Broadly speaking, they are not legally responsible, either for what their users do or for the harm that their services can cause in the real world.

It is becoming ever clearer, however, that this era of digital exceptionalism cannot last for ever. Governments and courts are chipping away at the sovereignty of internet firms, and public opinion is pushing them to police themselves better. Given their growing heft, this shift is likely not just to continue but to accelerate.

When the internet went mainstream in the mid-1990s, online firms feared being held liable if their services were used in illegal ways—for instance, when subscribers posted copyrighted content or defamatory information. The danger was underlined in 1995, when an investment firm sued Prodigy, an early online service, alleging that it had been defamed in one of its discussion forums. Plaintiffs later dropped the suit, but they had claimed $200m in damages.

To shield firms against potentially ruinous suits, as well as to protect free speech online, Congress in 1996 added a section to a law that otherwise focused on the more headline-grabbing topic of obscene material online: the Communications Decency Act (CDA). This section, now known by its number, 230, immunised online firms for torts committed through their services. Soon afterwards the European Union created a similar safe-harbour rule in its own e-commerce directive of 2000.

All this can be seen as an implicit subsidy for a nascent industry, according to Anupam Chander of the University of California, Davis. Online firms have been exempt from regulations that apply to offline firms, he argued in a paper in 2013. That is similar to the way in which American courts in the 19th century gave railroads and other firms a leg-up by limiting liability for harm caused by defective machinery.

Only a few exceptions to immunity were allowed. One was obviously illegal content, such as child porn. As a result of lobbying by film studios and record labels, the exceptions also included copyrighted material. In 1998 Congress also passed the Digital Millennium Copyright Act, which requires online firms to take down infringing content as soon as they have been put on notice. In Europe similar rules apply.

Although limiting liability online was intended to protect sites hosting digital content, it carried over to service platforms. Airbnb, which lets people rent out their homes, has long held that it is not responsible for the actions of hosts and guests. Uber, a ride-hailing service, has argued that it is just a technology firm and needn’t comply with many of the detailed regulations that apply to conventional transport businesses (which must, for instance, conduct more thorough security checks on drivers than Uber carries out). Accordingly, the terms of service for such platforms usually disclaim any liability.

If the tide is turning, it is the result of a combination of causes. One reason to expand liability for online platforms is their size: they are no longer fragile startups. Airbnb’s inventory of 2.3m rooms makes it bigger than the three largest hotel chains—Hilton, Marriott and InterContinental—combined. Incumbents are demanding that online rivals obey rules that constrain everyone else. “The internet is no longer a discrete side activity,” says Jonathan Zittrain of Harvard Law School.

Airbnb stands accused of reducing the supply of affordable housing in big cities. Uber is said to worsen traffic problems and to weaken public-transport systems by luring away passengers. Facebook and Twitter are accused of enabling the spread of fake and biased news during America’s election. Such services have also become favourite hangouts for bullies and trolls.

As these “negative externalities” become more obvious, public calls for regulators and the platforms themselves to take action is mounting. Facebook is a case in point. After Donald Trump’s victory, it came in for much criticism for not having done enough to limit the spread of fake news. In Germany, many worry that false news, particularly Russian misinformation campaigns, could influence federal elections in September.

It is also becoming exceedingly hard to maintain that platforms are—like telecoms networks—“neutral”. The argument that they do not interfere in the kind of content that is shown was a key rationale for exempting them from liability. But they are starting to resemble regulators themselves, which makes it odder still that they act outside legal limits. Facebook’s algorithms determine what members see in their news feeds. Uber’s software decides what drivers get paid. It is getting easier to police platforms, too, thanks to artificial-intelligence techniques which can recognise and predict patterns of bad user behaviour.

Unsurprisingly, given Europe’s penchant for regulation, and the fact that most big platforms are based in America, European bodies have been first to take steps to rein them in. An important change was a decision in 2014 by the European Court of Justice, the European Union’s highest court, to establish a “right to be forgotten”. Search engines must stop linking to information about a person if it is found to be “inadequate, irrelevant or excessive” and if the person has asked the firms to do so. Later this year, the same court will be asked to decide whether Uber is just a digital service or a transport company; if it is judged to be the latter, it will need to comply with a web of rules written in the analogue age, which would lift its costs significantly.

The European Commission, the EU’s executive body, last year proposed plans to regulate platforms. It will not change its e-commerce directive, but it has pushed platforms into signing up to a “voluntary” code of conduct which commits them to actively and swiftly remove illegal hate speech such as racial abuse (instead of reacting to complaints). Some EU member states are considering going further: the German government may bring in a law to impose fines of up to €500,000 ($534,000) on a platform like Facebook if it fails to take down illegal content within 24 hours.

Section 230 of the CDA is under pressure, too. True, the Supreme Court recently refused to revive an unsuccessful lawsuit against Backpage, an American site for classified ads with a popular adult section, which had been accused of facilitating forced prostitution. But last year saw a “swarm” of adverse Section 230 rulings, says Eric Goldman of the Santa Clara University School of Law.

Too much mayhem

In May a court allowed a lawsuit to proceed against Model Mayhem, a network that connects models and photographers, for having failed to warn users that rapists have used the site to target victims. In June a judge decided that Yelp, a site for crowdsourced reviews, cannot challenge a court order to remove a defamatory review of a lawyer by a client. Courts and lawmakers are not about to abolish section 230, says Daphne Keller of the Centre for Internet and Society at Stanford Law School, but it is unlikely to survive for decades.

Service platforms are also facing new operational restrictions. Late last year Uber ended an experiment with self-driving cars in San Francisco after resistance from the authorities. Uber is also embroiled in lawsuits in several countries over whether its drivers should be treated as full-time employees (in October a London court said they are, entitling them to the minimum wage and holiday pay). Many cities are creating new rules, or enforcing old ones, on who can rent out their homes and for how long. One example is New York’s move in October to pass a law imposing fines of up to $7,500 on hosts who advertise stays of 30 days and less on Airbnb and similar sites.

He’s worried Tech firms fear what regulators might do. Content platforms say that in the short term they fret most about being required energetically to police their platforms, which would be difficult and costly and could turn them into censors. All share a longer-term concern that they could end up being regulated in exactly the same way as pre-internet incumbents, which would make them less profitable and perhaps even destroy their business models. The industry would naturally prefer self-regulation. Platforms not only have strong incentives to spot bad actors, but good information to identify them and the means to sanction in response, notes Urs Gasser of the Berkman Klein Centre for Internet & Society at Harvard University. Yet self-regulation goes only so far: platforms may have not much incentive, for instance, to do something about noisy short-term tenants or to limit drivers’ working hours. They are working hard, nonetheless, to show willing. Only a few weeks after Mark Zuckerberg, Facebook’s boss (pictured), batted away criticism of the company’s election coverage, he announced that the firm would work with fact-checking sites to verify news and allow users to flag fake stories. Uber, for its part, recently launched Movement, a website sharing its aggregate ride data with urban-planning agencies, so that they can see, for instance, what effect a baseball game has on traffic patterns. If there has to be regulation, Nick Grossman of Union Square Ventures, a technology investor, wants regulators to shift from the idea of handing out permission to do things to an accountability-based approach he calls “Regulation 2.0”. In the past, he argues, regulators were “data-poor”: to do their job, local agencies, for instance, had to actively select who was allowed to do what by handing out licences—to drive a cab, say. Now that data are plentiful and available in real time, regulators could instead check regularly on whether service providers are following certain policy goals.

Internet activists and the firms themselves may deplore the fact that the early heyday of digital exceptionalism is drawing to a close. Michael Masnick, the editor of Techdirt, a site covering tech policy, worries about limits on free speech, and also warns that regulation can stymie innovation. Rules are disproportionately costly for small firms. Google has the money to hire enough lawyers to handle requests based on the right to be forgotten. For smaller search engines, it is a big burden.

But giving platforms a free pass is increasingly difficult for regulators and courts: they simply have become too important for the economy and society more generally. Successful online platforms, in other words, carry the seeds of their own regulation.