Zimmerman explains that a prosecutor would have to show that the tech company knew about some specific illegal activity. Generalized knowledge that illegal things happen on a service isn't enough. Simply put, it wouldn't be feasible for a company, even one as smart as Google, to police each Gmail message, and the law was designed to protect them from that responsibility.
Zimmerman points out that there are two major "buts" with the above. First, CDA 230 only applies at a state law enforcement level. If state officials went to Craigslist and pointed at a heroin ad, "they couldn't actually go after Craigslist for doing anything." However, he says, "That protection doesn't exist on the federal side."