The Court of Appeals for the Ninth Circuit held that the service provider immunity provisions of the Communications Decency Act bar an Oregon woman from bringing a tort suit against Yahoo! for failing to remove fraudulent profiles posted by her ex-boyfriend, but that, once Yahoo! promised to remove them, then failed to do so, she could sue on a promissory estoppel theory. In the course of its opinion, the court said in dictum that because CDA immunity is an affirmative defense, it cannot be raised on a motion to dismiss, and the court apparently said as well that CDA does not provide protection against claims under federal law. Public Citizen, joined by other public interest and civil liberties groups, filed a brief urging the Ninth Circuit to retract the dictum. The court of appeals denied rehearing but withdrew the part of the opinion stating that section 230 immunity cannot be raised on a motion to dismiss.