California State Capitol Dome at Sunset in Sacramento
SAN FRANCISCO — A federal appeals panel ruled a district judge correctly blocked parts of a law tech groups have long challenged as unconstitutional online censorship presented in the name of child protection.
NetChoice, an association representing the interests of a consortium of tech companies, social media platforms and online marketplaces, first sued in 2022 to block enforcement of Assembly Bill 2273, which supporters labeled the Age-Appropriate Design Code Act (AADCA). Coalition members, including Facebook- and Instagram-parent Meta and the parent company of TikTok, have argued the law unconstitutionally forces businesses to “over moderate” and restrict certain information.
In defending the law, California Attorney General Rob Bonta has endorsed the intent to force social media companies to redesign products and eliminate “features that may be harmful to children, including manipulative techniques to prod them to spend hours on end online or provide personal information beyond what is expected or necessary.”
After NetChoice initially prevailed in a San Jose federal court, Bonta failed to convince the U.S. Ninth Circuit Court of Appeals to completely undo the ruling. Although the panel vacated most of U.S. District Judge Beth Labson Freeman’s preliminary injunction — finding the companies were likely to prevail on at least one First Amendment argument, namely an improper restraint on protected speech — it did affirm it to the extent it blocked enforcement of a requirement regarding mitigating the risk of exposure to harmful online material.
On remand, NetChoice again pursued a preliminary injunction. In March 2025, Freeman again enjoined the entire law while offering an alternative injunction on seven individual provisions NetChoice had challenged. The state again asked the Ninth Circuit to reverse. Judge Milan Smith Jr. wrote the panel’s opinion, filed March 12; Judges Mark Bennett and Anthony Johnstone concurred.
The panel vacated Freeman’s order to the extent she agreed the law was entirely unconstitutional as written. It found she “erroneously concluded” the law’s coverage definition meant NetChoice had met the high legal bar required to challenge the AADCA as written and said it found similar reasons for vacating the injunction with respect to an age estimation requirement.
The coverage debate involves the law’s stated application to any “business that provides an online service, product or feature likely to be accessed by children.” Whereas the state argued the statute’s explanation of which businesses it covers doesn’t itself regulate anything, Judge Freeman agreed with NetChoice’s position the definition “burdens speech based on content in every application,” Smith wrote.
The panel preferred the state’s argument that whether it might be reasonable to expect children could access a business’ website “says nothing about the nature of the business providing that service, product, or feature.” Examples of non-child businesses young people could regularly access are ride sharing services, ticket sellers, online payment processors and fitness and educational software.
Smith said the law’s “coverage definition consists of six separately enumerated indicators enabling online businesses to determine whether or not they are subject to the act. Because each indicator demands different inquiries of online businesses, the coverage definition cannot apply to every online business in the same way.”
For one example, learning if a significant number of children access an online service requires examining traffic demographic data, the panel said, which is information such businesses frequently already have and not explicitly a function of what they publish. But another possible indicator is whether outside evidence demonstrates routine access “by a significant number of children.”
Reading those indicators “as cumulative would allow a business with, for example, substantial company evidence of child users to escape coverage simply by contesting external demographic data, an absurd statutory result,” Smith wrote. “Because the question that each indicator requires an online business to ask demands a different answer, we cannot say that the coverage definition likely raises the same First Amendment issues in every possible application.”
Ultimately the panel said on this front NetChoice “could have brought an as-applied challenge on behalf of some of its members” to avoid the higher bar required for a facial constitutional claim.
However, the panel agreed with Judge Freeman’s finding that NetChoice was likely to prevail on individual AADCA provisions. The organization challenged seven provisions as facially violating the First Amendment or being vague. The state appealed with respect to an age estimation requirement, on which the panel ruled success was unlikely, and four data use restrictions and a “dark patterns” restriction, which the panel affirmed.
“We cannot say that the age estimation requirement facially violates the First Amendment at all, much less in a substantial majority of its applications,” Smith wrote. “For one, it is unclear that the age estimation requirement prevents access to content.”
The panel noted the provision allows a business that doesn’t want to estimate ages to “publish any content they would like, as long as they default to data and privacy protections for all users.” It remanded the complaint on this matter with a suggestion “to consider the effect of that opt-out language on any burden on expression that may arise from the age estimation requirement.”
Turning to data use, the panel said NetChoice challenged provisions restricting how and why businesses can use a child’s personal information, attacking “their reliance on the undefined terms ‘material detriment,’ ‘best interests,’ and ‘well-being,’ ” Smith wrote. He added the state’s proffered suggestion that the plain meaning of all the terms together could involve dangers like sexploitation or recommending illicit substances “are extreme examples at the margins of what might be materially detrimental to a child’s well-being. The more difficult questions arise with examples like sleep loss, distraction, or hurt feelings.”
While state law does have an accepted standard for “best interests” of a child in the context of custody arrangements, “the state does not persuasively explain why that case-by-case standard translates to data privacy regulation.” As written, the panel said, the AADCA dictates a business has to prospectively determine whether any practice is in the best interests of any child who might access a covered website.
The panel also agreed with Judge Freeman on the vagueness of a provision barring covered business from using deceptive interfaces often known as “dark patterns to lead or encourage children to provide personal information beyond what is reasonably expected to provide that online service, product, or feature to forego privacy protections, or to take any action that the business knows, or has reason to know, is materially detrimental to the child’s physical health, mental health, or well-being.”
Freeman said the law offers no guidance for businesses on how to have “reason to know” an interface could be “materially detrimental.” The panel agreed that although the AADCA defines “dark pattern,” the law still has the problem of appearing to allow litigation based on the experience one child has on one app or website should a regulator determine the child encountered a “material” harm.
“Businesses of ordinary intelligence cannot reliably determine what compliance requires,” Smith wrote.
Finally, the panel said it remains unclear if an AADCA “notice-and-cure” provision can be severed from its “remaining, valid provisions” and remanded that matter for further proceedings as well.
“Today’s decision is a huge victory for free speech and essentially a death knell for California’s online speech code, ,” said Paul Taske, NetChoice Litigation Center co-director, in an online statement. “California cannot mandate vague and onerous changes to how speech is disseminated online. The Ninth Circuit was clear: on the substance, NetChoice is likely to prevail. This law is hanging on by a thread. To the extent there is some additional work to do in the district court, we look forward to making a full showing and striking down California’s Speech Code permanently.”
NetChoice is represented by Davis Wright Tremaine, of Washington, D.C., Seattle and Los Angeles, as well as the Foundation for Individual Rights and Expression, of Washington, D.C.
Common Sense Media is represented by Digital Smarts Law & Policy, of Shaker Heights, Ohio.