NetChoice, LLC v. BontaNetChoice, LLC v. Bonta
[Re: ECF 101]
Committed to protecting children from harmful online products and services, the California State Legislature enacted the California Age-Appropriate Design Code Act (“CAADCA” or “Act“),
While the appeal was pending, the Supreme Court decided Moody v. NetChoice, LLC, 603 U.S. 707 (2024), which clarified the standard for analyzing a facial challenge to a statute under the First Amendment. Applying Moody, the United States Court of Appeals for the Ninth Circuit concluded that this Court‘s preliminary injunction order did not conduct the analysis required for a First Amendment facial challenge. See NetChoice, LLC v. Bonta (”NetChoice II“), 113 F.4th 1101, 1108 (9th Cir. 2024). The Ninth Circuit nonetheless affirmed the preliminary injunction as to one aspect of the CAADCA, the requirement that each covered business create a Data Protection Impact Assessment (“DPIA“) identifying, for each offered online service, product, or feature likely to be accessed by children, any risk of material detriment to children arising from the business‘s data management practices. See id. at 1108-09. The Ninth Circuit also affirmed the injunction as to provisions of the CAADCA that are not grammatically severable from the DPIA requirement. See id. at 1108. The preliminary injunction was vacated in all other respects, and the case was remanded for further proceedings. See id.
On remand, NetChoice filed a first amended complaint (“FAC“), and a second motion for a preliminary injunction. See FAC, ECF 100; Pl.‘s Second Mot. for Prelim. Inj., ECF 101. The motion is opposed by the State. See Def.‘s Opp‘n., ECF 112. The Court has considered the motion, the State‘s opposition, NetChoice‘s reply, the parties’ supplemental briefs, the briefs filed by five sets of amici curiae, and the record evidence. The Court heard oral argument on January 23, 2025, and the State agreed to defer enforcement of the non-enjoined portions of the CAADCA until April 5, 2025, to allow the Court time to issue a reasoned decision.
NetChoice‘s second motion for a preliminary injunction is GRANTED for the reasons discussed below.
I. BACKGROUND
In recent years, “[s]ocial-media platforms, as well as other websites, have gone from unheard-of to inescapable.” Moody, 603 U.S. at 716. “They structure how we relate to family and friends, as well as to businesses, civic organizations, and governments.” Id. “The questions of whether, when, and how to regulate online entities, and in particular the social-media giants, are understandably on the front-burner of many legislatures and agencies.” Id.
In general, government actors are better positioned than courts to address public policy issues relating to online platforms. See Moody, 603 U.S. at 716. However, “courts still have a necessary role in protecting those entities’ rights of speech, as courts have historically protected traditional media‘s rights.” Id. The tension between legislative interests in regulating online entities and those entities’ First Amendment rights has generated lawsuits throughout the United States, many – like this one – brought by NetChoice. See, e.g., Moody, 603 U.S. 707; NetChoice v. Bonta, No. 5:24-CV-07885-EJD, 2024 WL 5264045 (N.D. Cal. Dec. 31, 2024); NetChoice, LLC v. Reyes, No. 2:23-CV-00911-RJS-CMR, 2024 WL 4135626 (D. Utah Sept. 10, 2024); Computer & Commc‘ns Indus. Ass‘n v. Paxton,1 747 F. Supp. 3d 1011 (W.D. Tex. 2024); NetChoice, LLC v. Fitch, 738 F. Supp. 3d 753 (S.D. Miss. 2024); NetChoice, LLC v. Yost, 716 F. Supp. 3d 539 (S.D. Ohio 2024).
The CAADCA was enacted for the purpose of regulating “business[es] that provide[] an online service, product, or feature likely to be accessed by children” (“coverage definition“).
The CAADCA imposes numerous affirmative requirements and prohibitions on covered businesses (collectively, “Regulatory Provisions“). See
DPIA Requirement and Notice and Cure Provision
The cornerstone of the Act‘s affirmative requirements “is the provision requiring online businesses to create a Data Protection Impact Assessment (DPIA) report identifying, for each offered online service, product, or feature likely to be accessed by children, any risk of ‘material detriment to children that arise from the data management practices of the business.‘” NetChoice II, 113 F.4th at 1109 (quoting
A covered business that is in substantial compliance with the DPIA requirement is entitled to written notice and a 90-day cure period before civil penalties may be assessed for violation of the Act. See
The DPIA requirement is currently enjoined, as are other provisions of the CAADCA that the Ninth Circuit found to be not grammatically severable from the DPIA requirement, including the notice and cure provision. See NetChoice, LLC v. Bonta, 113 F.4th at 1108. The enjoined provisions are
Other Affirmative Requirements
In addition to complying with the DPIA requirement and related provisions, covered businesses must take the following actions enumerated in
- (5) Estimate the age of child users with a reasonable level of certainty appropriate to the risks that arise from the data management practices of the business or apply the privacy and data protections afforded to children to all consumers.
- (6) Configure all default privacy settings provided to children by the online service, product, or feature to settings that offer a high level of privacy, unless the business can demonstrate a compelling reason that a different setting is in the best interests of children.
- (7) Provide any privacy information, terms of service, policies, and community standards concisely, prominently, and using clear language suited to the age of children likely to access that online service, product, or feature.
- (8) If the online service, product, or feature allows the child‘s parent, guardian, or any other consumer to monitor the child‘s online activity or track the child‘s location, provide an obvious signal to the child when the child is being monitored or tracked.
- (9) Enforce published terms, policies, and community standards established by the business, including, but not limited to, privacy policies and those concerning children.
- (10) Provide prominent, accessible, and responsive tools to help children, or if applicable their parents or guardians, exercise their privacy rights and report concerns.
Prohibitions
Covered businesses are prohibited from taking the following actions enumerated in
- (1) Use the personal information of any child in a way that the business knows, or has reason to know, is materially detrimental to the physical health, mental health, or well-being of a child.
- (2) Profile a child by default unless both of the following criteria are met:
- (A) The business can demonstrate it has appropriate safeguards in place to protect children.
- (B) Either of the following is true:
- (i) Profiling is necessary to provide the online service, product, or feature requested and only with respect to the aspects of the online service, product, or feature with which the child is actively and knowingly engaged.
- (ii) The business can demonstrate a compelling reason that profiling is in the best interests of children.
(3) Collect, sell, share, or retain any personal information that is not necessary to provide an online service, product, or feature . . . unless the business can demonstrate a compelling reason that [doing so] is in the best interests of children likely to access the online service, product, or feature. - (4) If the end user is a child, use personal information for any reason other than a reason for which that personal information was collected, unless the business can demonstrate a compelling reason that use of the personal information is in the best interests of children.
- (5) Collect, sell, or share any precise geolocation information of children by default unless the collection of that precise geolocation information is strictly necessary for the business to provide the service, product, or feature requested. . . .
- (6) Collect any precise geolocation information of a child without providing an obvious sign to the child for the duration of that collection that precise geolocation information is being collected.
- (7) Use dark patterns to lead or encourage children to provide personal information beyond what is reasonably expected to provide that online service, product, or feature to forego privacy protections, or to take any action that the business knows, or has reason to know, is materially detrimental to the child‘s physical health, mental health, or well-being.
- (8) Use any personal information collected to estimate age or age range for any other purpose or retain that personal information longer than necessary to estimate age. Age assurance shall be proportionate to the risks and data practice of an online service, product, or feature.
Taking these provisions directly from a law enacted in the United Kingdom, the California Legislature left it to the courts to pass the CAADCA through the filter of our First Amendment. See 2022 Cal. Stat. ch. 320 (A.B. 2273), §§ (1)(d)-(e).
NetChoice‘s Complaint and First Motion for Preliminary Injunction
Before the CAADCA‘s original effective date of July 1, 2024, NetChoice filed this suit alleging six claims – four facial challenges to the Act on constitutional grounds and two challenges to the Act on federal preemption grounds. See Compl. ¶¶ 76-122. NetChoice also filed a motion for a preliminary injunction to enjoin the Act‘s enforcement. See Pl.‘s Mot. for Prelim. Inj. This Court granted the motion for a preliminary injunction on September 18, 2023, concluding that that NetChoice had shown it was likely to succeed on its facial challenge to the CAADCA under the First Amendment. See NetChoice I, 629 F. Supp. 3d at 961. The Court did not reach NetChoice‘s additional constitutional challenges to the Act or its challenges based on
The Ninth Circuit affirmed the preliminary injunction only as to the DPIA provisions. See NetChoice II, 113 F.4th at 1108. The Ninth Circuit found that the DPIA requirement triggers review under the First Amendment because it “compels speech by requiring covered businesses to opine on potential harm to children,” and because “it deputizes covered businesses into serving as censors for the State.” See id. at 1117-18. The Ninth Circuit found a facial challenge to the DPIA requirement appropriate, because “[i]n every application of the DPIA report requirement to a covered business, the DPIA report requirement raises the same First Amendment issues.” Id. at 1123. When determining what level of scrutiny applies to the DPIA requirement, the Ninth Circuit held that “[s]trict scrutiny is warranted because the DPIA report requirement (1) compels speech with a particular message about controversial issues; and (2) deputizes private actors into censoring speech based on its content.” Id. at 1118 (internal quotation marks and citations omitted). The Ninth Circuit concluded that the DPIA requirement is likely to fail strict scrutiny, because (among other reasons) “a disclosure regime that requires the forced creation and disclosure of highly subjective opinions about content-related harms to children is unnecessary for fostering a proactive environment in which companies, the State, and the general public work to protect children‘s safety online.” Id. at 1122.
The Ninth Circuit vacated the preliminary injunction in all other respects. See NetChoice II, 113 F.4th at 1108. Stating that most of the CAADCA‘s other provisions “by their plain language, do not necessarily impact protected speech in all or even most applications,” the Ninth Circuit determined that the record needed further development before a First Amendment facial challenge could be evaluated under the standard clarified in Moody. Id. at 1122-23. The Ninth Circuit found that this Court‘s order “not only failed to properly consider the facial nature of NetChoice‘s First Amendment challenges to other provisions of the CAADCA,
NetChoice‘s FAC and Second Motion for Preliminary Injunction
On remand, NetChoice filed the operative FAC, asserting the same six claims pled in the original complaint. See FAC ¶¶ 77-126. However, whereas the original complaint raised only facial challenges to the CAADCA, each of the claims of the FAC is asserted both facially and as applied to NetChoice‘s members. See FAC ¶¶ 77-126.
The FAC asserts claims for: (1) violation of the First and Fourteenth Amendments to the U.S. Constitution, and Article I, Section 2(a) of the California Constitution (facial and as applied); (2) violation of the Fourth Amendment to the U.S. Constitution (facial and as applied); (3) void for vagueness under the First Amendment and Due Process Clause of the U.S. Constitution, and Article I, Section 7(a) of the California Constitution (facial and as applied); (4) violation of the dormant Commerce Clause of the U.S. Constitution (facial and as applied); (5) preemption under the Children‘s Online Privacy Protection Act (“COPPA“),
NetChoice adds a new First Amendment theory challenging the Regulatory Provisions,
NetChoice also filed a second motion for a preliminary injunction, which is the subject of this order.
II. LEGAL STANDARD
“The Supreme Court has explained that plaintiffs seeking a preliminary injunction must establish that (1) they are likely to succeed on the merits, (2) they are likely to suffer irreparable harm absent preliminary relief, (3) the balance of equities tips in their favor, and (4) an injunction is in the public interest.” Where Do We Go Berkeley v. California Dep‘t of Transportation, 32 F.4th 852, 859 (9th Cir. 2022) (citing Winter v. Nat. Res. Def. Council, Inc., 555 U.S. 7, 20 (2008)). The Ninth Circuit employs a sliding scale approach to the four Winter factors, under which a strong showing on the balance of hardships may compensate for a lesser showing of
In cases arising under the First Amendment, showing a likelihood of success on the merits generally results in a finding that the remaining Winter factors are satisfied as well. See Am. Beverage Ass‘n v. City & Cnty. of San Francisco, 916 F.3d 749, 757-58 (9th Cir. 2019). Where the plaintiffs “have a colorable First Amendment claim, they have demonstrated that they likely will suffer irreparable harm if the [law] takes effect.” Id. at 758. Next, a finding that the plaintiffs have raised serious First Amendment questions compels a finding that the balance of hardships tips sharply in their favor. See id. Finally, there is a “significant public interest in upholding First Amendment principles,” and “it is always in the public interest to prevent the violation of a party‘s constitutional rights.” Id. (internal quotation marks and citations omitted).
III. DISCUSSION
The parties devote the bulk of their arguments to the first Winter factor, likelihood of success on the merits. As NetChoice points out in its reply, the State effectively concedes the other three Winter factors. See Pl.‘s Reply at 17, ECF 121; Def.‘s Opp‘n. at 7.
NetChoice contends that it is likely to succeed on the merits of its First Amendment claims; that it is entitled to injunctive relief on the ground that the previously enjoined DPIA provisions are not severable from the remainder of the CAADCA; and that it is likely to succeed on the merits of its claims that the CAADCA is preempted by Section 230 and COPPA and is invalid under the dormant Commerce Clause. The State disputes those contentions. The Court addresses them in turn.
A. First Amendment Claims (Claims 1 and 3)
In Claim 1 of the FAC, NetChoice asserts that the CAADCA violates the expressive rights of NetChoice and its members under the First Amendment, and in Claim 3, NetChoice asserts that the CAADCA is void for vagueness under the First Amendment.3 NetChoice argues that it is
The Court begins by discussing First Amendment principles generally, as well as the standard for First Amendment facial challenges clarified in Moody. The Court then takes up NetChoice‘s four asserted bases for likely success on the merits of its First Amendment claims.
1. General Principles
“The First Amendment, applicable to the States through the Fourteenth Amendment, prohibits the enactment of laws ‘abridging the freedom of speech.‘” Reed v. Town of Gilbert, Ariz., 576 U.S. 155, 163 (2015) (quoting
2. Standard for Evaluating First Amendment Facial Challenges
In general, “a plaintiff cannot succeed on a facial challenge unless he establishes that no set of circumstances exists under which the law would be valid, or he shows that the law lacks a plainly legitimate sweep.” Moody, 603 U.S. at 723 (internal quotation marks, citation, and brackets omitted). “In First Amendment cases, however, [the Supreme Court] has lowered that very high bar,” substituting “a less demanding though still rigorous standard.” Id. “The question is whether a substantial number of the law‘s applications are unconstitutional, judged in relation to the statute‘s plainly legitimate sweep.” Id. (internal quotation marks, citation, and brackets omitted).
“[A] First Amendment facial challenge has two parts[.]” NetChoice II, 113 F.4th at 1115. “The first step in the proper facial analysis is to assess the state laws’ scope.” Moody, 603 U.S. at 724. “What activities, by what actors, do the laws prohibit or otherwise regulate?” Id. The second step “is to decide which of the laws’ applications violate the First Amendment, and to measure them against the rest.” Id. at 725.
The party bringing the First Amendment facial challenge has the burden to show the full scope of the law‘s coverage; to identify which of the law‘s applications are constitutionally permissible and which are not; and, ultimately, to show that the law “prohibits a substantial amount of protected speech relative to its plainly legitimate sweep.” Moody, 603 U.S. at 744 (internal quotation marks and citation omitted).
3. Facial Challenge to CAADCA based on Coverage Definition
NetChoice contends that the CAADCA‘s coverage definition, limiting the Act‘s application to “business[es] that provide[] an online service, product, or feature likely to be accessed by children,” is facially content-based, triggering strict scrutiny of the Act as a whole. Because this gateway coverage definition controls whether the Act applies in the first instance, and is facially content-based, NetChoice argues that the State must show that the burdens imposed by the Act‘s Regulatory Provisions are the least restrictive means to achieve a compelling state interest. NetChoice asserts that the State cannot make that showing, and that as a result NetChoice
In opposition, the State argues that the coverage definition is content-neutral. The State also argues that NetChoice‘s facial challenge to the Act as a whole does not comport with the Ninth Circuit‘s opinion in this case or with the Supreme Court‘s opinion in Moody, because in the State‘s view both of those opinions require evaluation of a First Amendment facial challenge to a statute on a provision by provision basis.
NetChoice did not raise this argument, that the gateway coverage definition is content-based, in its first motion for a preliminary injunction. Consequently, neither this Court nor the Ninth Circuit had occasion to consider whether the coverage definition causes the CAADCA‘s Regulatory Provisions to be subject to strict scrutiny in every application. This Court takes up that analysis here.
a. CAADCA Regulates Protected Speech
NetChoice must demonstrate as an initial matter that the CAADCA, through its coverage definition, regulates protected speech and thereby implicates the First Amendment. See NetChoice II, 113 F.4th at 1116-17 (determining as an initial matter whether “the DPIA report requirement regulates the speech of covered businesses and thus triggers review under the First Amendment.“). A court considering a First Amendment facial challenge “may assume without deciding that the statute ‘reaches some protected speech.‘” Arizona Attorneys for Crim. Just. v. Mayes, 127 F.4th 105, 110 (9th Cir. 2025) (quoting United States v. Hansen, 599 U.S. 762, 784 (2023)). The Court need not rely on an assumption in this case, however, because NetChoice has demonstrated that the Act regulates protected speech through its coverage definition.
As noted, the CAADCA regulates “business[es] that provide[] an online service, product, or feature likely to be accessed by children.”
In opposition, the State does not dispute that the Act‘s coverage definition implicates protected speech. Nor does the State identify any non-speech application of the CAADCA. Instead, the State contends that the coverage definition is content-neutral, and designed only to identify businesses that target children so that those businesses may be regulated. The Court addresses the latter contention below in the context of its discussion regarding the appropriate level of scrutiny.
b. The CAADCA is Content-Based on its Face
Having concluded that the CAADCA regulates protected speech, the Court must determine what level of scrutiny applies. The “crucial first step” in evaluating a First Amendment challenge to a law regulating expression is “determining whether the law is content neutral on its face.” Reed, 576 U.S. at 165. “A law that is content based on its face is subject to strict scrutiny regardless of the government‘s benign motive, content-neutral justification, or lack of animus toward the ideas contained’ in the regulated speech.” Id. (quotation marks and citation omitted). A law is content-based on its face if it “applies to particular speech because of the topic discussed or the idea or message expressed.” Id. at 163. A law that is facially content-neutral nonetheless will be considered a content-based regulation of speech if the law “cannot be justified without reference to the content of the regulated speech[.]” Id. at 164. “Those laws, like those that are content based on their face, must also satisfy strict scrutiny.” Id.
In Reed, the Supreme Court addressed a First Amendment challenge to a town‘s code
Applying Reed to the present case, this Court finds that the CAADCA‘s coverage definition makes the Act content-based in every application. See
(A) The online service, product, or feature is directed to children as defined by the Children‘s Online Privacy Protection Act (
15 U.S.C. Sec. 6501 et seq. ).(B) The online service, product, or feature is determined, based on competent and reliable evidence regarding audience composition, to be routinely accessed by a significant number of children.
(C) An online service, product, or feature with advertisements marketed to children.
(D) An online service, product, or feature that is substantially similar or the same as an online service, product, or feature subject to subparagraph (B).
(E) An online service, product, or feature that has design elements that are known to be of interest to children, including, but not limited to, games, cartoons, music, and celebrities who appeal to children.
(F) A significant amount of the audience of the online service, product, or feature is determined, based on internal company research, to be children.
The State argues that the Act‘s coverage definition is content-neutral even though its application requires examination of the content published by a particular business, relying mainly on City of Austin. City of Austin involved a city code that distinguished between on-premises and off-premises signs and imposed additional regulations on the latter. See City of Austin, 596 U.S. at 66. The code defined an off-premises sign to be one “advertising a business, person, activity, goods, products, or services not located on the site where the sign is installed, or that directs persons to any location not on that site.” Id. The Supreme Court acknowledged that application of the code required an examination of the particular sign‘s content, but found that such examination was required “only in service of drawing neutral, location-based lines.” Id. at 69. Under those circumstances, the Supreme Court concluded that the code was content-neutral, observing that “[t]his Court‘s First Amendment precedents and doctrines have consistently recognized that restrictions on speech may require some evaluation of the speech and nonetheless remain content neutral.” Id. at 72.
Seizing on that language, the State argues “[t]hat determining whether a business‘s users are children may involve looking at the content of a product, service, or feature does not make the Act content based.” Def.‘s Opp‘n at 12, ECF 112. The State‘s argument ignores the differences between the present case and City of Austin. The code addressed in City of Austin did “not single out any topic or subject matter,” because a sign‘s substantive message itself was irrelevant to the code‘s application. City of Austin, 596 U.S. at 71. A sign was treated differently under the code based solely on whether it was located on the same premises as the thing being discussed, and the sign message mattered “only to the extent that it inform[ed] the sign‘s relative location.” Id. In contrast, the CAADCA does single out particular subject matter, specifically, online content that is likely to be accessed by children. A business will be treated differently under the CAADCA if it provides online services, products, or features with design elements that are known to be of interest to children, such as games, cartoons, music, or other content that appeals to children, or the business knows that a significant portion of its audience is children. Thus, the present case is not like City of Austin, in which evaluation of speech was necessary only to determine whether the sign was an on-premises sign or an off-premises sign.
The State cites the Ninth Circuit‘s recent decision in Project Veritas v. Schmidt, 125 F.4th 929 (9th Cir. 2025), in support of its position that the necessity to examine online content to apply the CAADCA does not make it content-based. Project Veritas involved a nonprofit media organization‘s challenge to an Oregon law prohibiting the recording of oral conversations without the knowledge of all participants. See id. at 937. The plaintiff frequently recorded individuals without their knowledge when engaged in undercover journalism; in the plaintiff‘s experience, an announcement that a conversation is being recorded may cause individuals to refuse to talk or to distort their story. See id.. The plaintiff challenged the Oregon law under the First Amendment, both facially and as-applied. See id. at 939.
The Ninth Circuit determined that the Oregon statute regulates speech protected by the First Amendment. See Project Veritas, 125 F.4th at 942. In deciding whether the statute is content-based or content-neutral, the Ninth Circuit summarized the holdings of Reed and City of Austin as follows: “a regulation of speech is facially content based . . . if it targets speech based on its communicative content – that is, if it applies to particular speech because of the topic discussed or the idea or message expressed.” Id. at 950 (internal quotation marks, citations, and brackets omitted). Applying those standards, the Ninth Circuit found that the Oregon statute is facially neutral, as it merely limits the circumstances under which a conversation may be recorded, but does not draw distinctions based on the speaker‘s message. See id. at 950-51. Here, the CAADCA does draw distinctions based on the speaker‘s message, namely, whether it is content likely to be accessed by children, in which case the content is regulated to protect children‘s “best interests.” Given that critical difference between the two statutes, this Court finds the State‘s arguments based on Project Veritas to be unpersuasive.
The Court likewise finds the State‘s reliance on Porter v. Martinez, 68 F.4th 429 (9th Cir. 2023), to be misplaced. In Porter, the plaintiff brought a First Amendment challenge to a state law prohibiting the honking of a vehicle‘s horn except when reasonably necessary to warn of a safety hazard. See id. at 434. Even accepting the plaintiff‘s “questionable assertion that honking to give a warning is a form of expression,” the Ninth Circuit found that the law did not distinguish “between honks intended to convey warnings and honks intended to convey other messages.” Id.
The State suggests that the CAADCA is not content-based if its sole purpose is to regulate businesses that serve children. See Def.‘s Opp‘n at 12. As NetChoice points out, however, the Act does not regulate all businesses that provide services to children, only those that provide online content to children. Businesses that provide online content featuring “advertisements marketed to children,” “games,” “cartoons,” “music,” or “celebrities who appeal to children” fall within the Act‘s coverage definition.
NetChoice points to three recent cases in which statutes were held to be content-based on their face, and thus subject to strict scrutiny, because of their coverage definitions. See Reyes, 2024 WL 4135626, at *11; Fitch, 738 F. Supp. 3d at 771; Yost, 716 F. Supp. 3d at 558. In Reyes, the district court held that because “the Central Coverage Definition facially distinguishes between
Yost addressed a statute with a coverage definition that limited the statute‘s application to websites “targeted at children, or reasonably anticipated to be accessed by children.” Yost, 716 F. Supp. 3d at 554. The Yost court found the distinction between websites on the basis of whether they target children was not sufficient, standing alone, to make the statute content-based. See id. at 556. The Yost court reasoned that “[t]here is no indication that the State disfavors the sort of content designed to appeal to children – cartoons and the like.” Id. However, the Yost court determined that the statute‘s exclusion from the coverage definition of two categories of websites – product review websites and “widely recognized” media outlets – were “easy to categorize as content based.” Id. at 557-58. By crafting the coverage definition to exclude product review websites and widely recognized media outlets, the State was “favoring engagement with certain topics, to the exclusion of others,” which was “plainly a content-based exception deserving of strict scrutiny.” Id. at 558. Thus, while the Yost court declined to find the statute‘s coverage definition to be content-based solely because it was limited to websites targeting children, the Yost court ultimately did find the coverage definition to be content-based because of its exclusions of certain categories of websites. See id. Based on that content-based coverage definition, the Yost court went on to apply strict scrutiny to the statute as a whole. See id.
After the hearing in the present case, NetChoice filed a statement of recent decision advising the Court of another decision finding a statute to be content-based on its face because of its coverage definition. See Students Engaged in Advancing Texas v. Paxton (”SEAT“), No. 1:24-CV-945-RP, 2025 WL 455463 (W.D. Tex. Feb. 7, 2025). SEAT involved a statute that distinguished between DSPs based on whether they allowed users to interact with each other
In Reyes, Fitch, Yost, SEAT, and Computer & Commc‘ns Indus. Ass‘n, the district courts found the statutes they addressed to be content-based on their face in light of distinctions drawn by their coverage definitions. The State argues that Reyes, Fitch, and Yost are distinguishable from the present case, because they addressed statutes that specifically regulated social media companies, and the courts’ decisions were largely based on differential treatment between “social” speech and other speech. The State argues that the CAADCA does not distinguish between social speech and other speech, but rather applies to all types of companies that produce all kinds of content likely to be accessed by children. Nothing in Reyes, Fitch, and Yost suggests that their holdings are limited to statutes governing social media companies. The Court reads those decisions to stand for the proposition that where a statute‘s gateway coverage definition divides the universe into covered and uncovered business based on the type of content they publish, those statutes are content-based and subject to strict scrutiny.
For example, in Reyes, the district court concluded that the statute at issue was content-based because “the Act‘s Central Coverage Definition divide[d] the universe of internet platforms into social media services, defined as websites or applications that ‘allow users to interact socially with each other,’ and other internet platforms, such as platforms for ‘news, sports, commerce, [and] online video games.‘” Reyes, 2024 WL 4135626, at *11. In the present case, the coverage definition divides the universe of businesses into those that publish content likely to be accessed by children and those that publish content not likely to be accessed by children. The fact that the dividing line is drawn differently does not render the CAADCA content-neutral. To the extent the
The State argues that the CAADCA is not intended to regulate any particular expressive content, but rather is intended to protect children from harm. See Def.‘s Opp‘n at 12. In essence, the State argues that it may burden speech directed to, or likely to be accessed by, children because its intentions are good. See id. (asserting that in order to remediate harms to children, “regulate[] businesses that serve children, irrespective of what sort of content they host.“). However, “[a] law that is content based on its face is subject to strict scrutiny regardless of the government‘s benign motive, content-neutral justification, or lack of ‘animus toward the ideas contained’ in the regulated speech.” Reed, 576 U.S. at 165. “No doubt a State possesses legitimate power to protect children from harm, but that does not include a free-floating power to restrict the ideas to which children may be exposed.” Brown, 564 U.S. at 794 (citations omitted). “Speech that is neither obscene as to youths nor subject to some other legitimate proscription cannot be suppressed solely to protect the young from ideas or images that a legislative body thinks unsuitable for them.” See id. at 794 (internal quotation marks and citation omitted). Accordingly, the State‘s intentions in enacting the CAADCA cannot insulate the Act from the requirements of the First Amendment.
In summary, this Court finds that the CAADCA‘s coverage definition is content-based. The Court also finds persuasive the reasoning of Reyes, Fitch, and Yost that if a statute‘s gateway coverage definition is content-based, the statute as a whole is subject to strict scrutiny because the coverage definition applies in all applications of the statute. See Reyes, 2024 WL 4135626, at *11 (“Accepting that the entire Act, through the Central Coverage Definition, is facially content based, strict scrutiny applies.“); Fitch, 738 F. Supp. 3d at 771 (finding that the statute‘s coverage definition “makes the Act content-based, and therefore subject to strict scrutiny“); Yost, 716 F. Supp. 3d at 558 (“Having concluded that NetChoice is likely to succeed on its argument that the Act is a content-based regulation, this Court considers whether the Act is likely to fail strict scrutiny.“).
The parties disagree as to how strict scrutiny is to be applied. NetChoice argues that once it has established that the CAADCA is content-based, the burden shifts to the State to show that the Act’s Regulatory Provisions, collectively, are narrowly tailored to achieve a compelling state interest. The State contends that the standard articulated by the Supreme Court in Moody, 603 U.S. at 724-25, and applied by the Ninth Circuit in this case, NetChoice II, 113 F.4th at 1108, requires NetChoice to show that the CAADCA is unconstitutional on a provision by provision basis.
Reyes, Fitch, and Yost took the approach urged by NetChoice here. In those cases, the district courts applied strict scrutiny to the statutes as a whole, and found that the defendants had not shown the statutes were narrowly tailored to serve a compelling state interest. See Reyes, 2024 WL 4135626, at *12-14; Fitch, 738 F. Supp. 3d at 772-76; Yost, 716 F. Supp. 3d at 558-60. Yost was decided before Moody, and Fitch was decided the same day, so neither court addressed the impact of Moody on the application of strict scrutiny to a statute.
Reyes was decided after Moody, and the Reyes court received supplemental briefing on the effect of Moody. See Reyes, 2024 WL 4135626, at *6 n.71, *9 n.92. With respect to the scope-framing Central Coverage Definition, the Reyes court found the inquiries mandated by Moody to be easily answered, as there was no dispute about who and what the statute regulated. Id. After determining that the state failed to show the statute passed strict scrutiny, the Reyes court determined that the plaintiff, NetChoice, had shown it was likely to succeed in showing that the statute had no constitutionally permissible application. Id. at *9.
SEAT took a different approach, applying strict scrutiny to each challenged statutory provision individually. See SEAT, 2025 WL 455463, at *11. The SEAT court opined that [e]ven if HB 18 is a content-based regulation, it does not follow as a matter of course that the law is facially invalid. Id. The same district court had concluded in a related case that [p]er Moody, the Court must instead go through each provision and examine its respective permissibility under the First Amendment. Computer & Commc‘ns Indus. Ass‘n, 747 F. Supp. 3d at 1034-35. Accordingly, in SEAT the district court held that HB 18’s threshold coverage definition is a
This Court finds that applying strict scrutiny to the Regulatory Provisions as a whole, and applying Moody in that context, is the better approach. Under well-established precedent, a plaintiff’s showing that a statute is content-based shifts the burden to the State to show that the statute is narrowly tailored to promote a compelling Government interest. See, e.g., Reed, 576 U.S. at 155 (applying strict scrutiny to sign ordinance based on determination that it was content-based); United States v. Playboy Ent., 529 U.S. at 813 (applying strict scrutiny to content-based statute governing cable operators). Moody did not disturb that precedent; it clarified that the standard for analyzing a First Amendment facial challenge requires the court to assess the law’s scope and compare its unconstitutional applications to its constitutional ones. See Moody, 603 U.S. at 724-25. Thus, even where strict scrutiny applies, the plaintiff must show that the applications of the statute that fail strict scrutiny are substantial in comparison to any applications of the statute that do not. See id. at 718 (the question . . . is whether a law’s unconstitutional applications are substantial compared to its constitutional ones).
Moody does not require that a First Amendment facial challenge must be analyzed on a provision by provision basis. In most cases, as in Moody, consideration of the full range of activities covered by a statute may well require analysis of each statutory provision. See Moody, 603 U.S. at 724-25. However, Moody did not involve, and does not speak to, a First Amendment facial challenge to a statute’s coverage definition that extends to every application of the statute’s substantive provisions. The Act’s coverage definition draws a line between businesses that provide an online service, product, or feature likely to be accessed by children (covered under the Act) and businesses that do not. NetChoice has shown that the vast majority (if not all) of such online services, products, and features will involve expressive content. Thus, even assuming the full sweep of the Act’s Regulatory Provisions, collectively, may apply to some online services, products, and features that do not implicate protected speech, any such applications of the Regulatory Provisions necessarily will be substantially outweighed by the applications of the Regulatory Provisions that do implicate protected speech. And the Supreme Court has made clear
NetChoice’s prior First Amendment challenge to the CAADCA addressed only certain of the Act’s Regulatory Provisions; it was not framed as a challenge based on the gateway coverage definition. Thus, the Ninth Circuit was not presented with, and did not address, a challenge to the Regulatory Provisions as a whole, as is raised in the present motion. See NetChoice II, 113 F.4th at 1108. Considering that challenge for the first time here, this Court finds it appropriate to apply strict scrutiny to the Regulatory Provisions as a whole, and to perform the analysis required by Moody in that context.
d. The Act’s Regulatory Provisions Likely Fail Strict Scrutiny
Because strict scrutiny applies to the Regulatory Provisions as a whole, those provisions of the Act are presumptively unconstitutional and may be justified only if the government proves that they are narrowly tailored to serve compelling state interests. Reed, 576 U.S. at 163.
The State does not even attempt to satisfy strict scrutiny. Instead, the State argues that strict scrutiny does not apply. See Def.’s Opp’n at 11. Consequently, the State has failed to meet its burden to prove that the Regulatory Provisions, collectively, serve a compelling state interest and are narrowly tailored. For the sake of completeness, the Court nonetheless touches on the issues of compelling state interest and narrow tailoring.
The State asserts that it has a substantial interest in protecting the privacy and well-being of children. See Def.’s Opp’n at 24. In its order granting NetChoice’s first motion for a preliminary injunction, this Court found that the State had submitted evidence sufficient to
The demonstration of a compelling interest is not sufficient to satisfy strict scrutiny, however. The State must show that the recited harms are real, not merely conjectural, and that the regulation will in fact alleviate these harms in a direct and material way. Video Software Dealers Ass‘n, 556 F.3d at 961-62 Id. (internal quotation marks, citation, and brackets omitted). The State’s expert, Dr. Radesky, opines that children suffer many types of harm as result of being online. See Radesky Suppl. Decl. ¶¶ 22-27, 30, 43. According to Dr. Radesky, those harms include sleep disruption, bullying, harassment, interference with attention and learning, sexual exploitation, and invasion of privacy. See id. Dr. Radesky claims that research has shown a causal link between nighttime media use by teens and poor sleep. See id. ¶ 52. The State argues that the CAADCA will address these harms.
NetChoice challenges Dr. Radesky’s opinions and the State’s argument based thereon, submitting declarations from its own expert, psychology professor Christopher Ferguson. See Ferguson Decl., ECF 101-4; Ferguson Suppl. Decl., ECF 121-1. Professor Ferguson states his view that there is no evidence establishing a cause-and-effect relationship between social media and other online media on the one hand and mental health impacts on the other. See Ferguson Suppl. Decl. ¶¶ 22-25. Given the conflicting evidence submitted by the parties, the Court concludes that the State has not carried its burden to prove that being online harms children in a way that can be alleviated by the CAADCA. This conclusion is consistent with the Court’s first
Even if the Court were to accept that the Act advances a compelling State interest in protecting the privacy and well-being of children, the State has not shown that the CAADCA is narrowly tailored to serve that interest. The Act applies to all online content likely to be accessed by consumers under the age of 18, and imposes significant burdens on the providers of that content. For example,
In effect, the CAADCA controls access to features distinctive to the medium of online communication, and appears to suppress those features to the extent they offer detrimental material to children, 2022 Cal. Stat. ch. 320 (A.B. 2273), § 1(a)(8), but to protect the same features to the extent they deliver content in the best interests of children,
Based on the State’s failure to even attempt to satisfy strict scrutiny, and the evidence and authorities discussed above, the Court concludes that the Regulatory Provisions, collectively, are likely to fail strict scrutiny. That is not the end of the Court’s inquiry, however. Applying the two-step Moody framework, the Court must consider the full range of activities regulated by the Act, and then must decide whether the unconstitutional applications of the Act substantially outweigh the constitutional ones. Moody, 603 U.S. at 724-25. Here, the application of strict scrutiny is grounded in the content-based definition of a covered business, which applies in all applications of the Act. Accordingly, as in Reyes, the Act has no constitutionally permissible application. Reyes, 2024 WL 4135626, at *9; see also NetChoice II, 113 F.4th at 1116 (finding Moody satisfied where the DPIA report requirement, in every application to a covered business, raises the same First Amendment issues).
Consequently, the Court concludes that NetChoice has demonstrated a likelihood of success on the merits of its First Amendment facial challenge to the CAADCA’s Regulatory Provisions,
The Court ordinarily would not go on to address NetChoice’s other First Amendment challenges, and in particular its challenges to Individual Provisions of the CAADCA. However, as noted above, at least one district court has construed Moody to require facial challenges to be analyzed provision by provision. See SEAT, 2025 WL 455463, at *10. In light of the State’s insistence that NetChoice’s facial challenge to the Regulatory Provisions as a whole is improper,
2. Facial Challenge to Individual Provisions of CAADCA
NetChoice independently asserts facial challenges to each of seven Individual Provisions of the CAADCA, either in its entirety or as to certain applications. Pl.’s Second Mot. for Prelim. Inj. at 14. NetChoice divides its arguments regarding the Individual Provisions into four categories:
- specific applications of
California Civil Code § 1798.99.31(a)(9) , requiring a covered business to [e]nforce published terms, policies, and community standards established by the business, including, but not limited to, privacy policies and those concerning children; - specific applications of
California Civil Code §§ 1798.99.31(b)(1) -(4) , restricting how and for what purpose a covered business may use the personal information of children; - specific applications of
California Civil Code § 1798.99.31(b)(7) , prohibiting covered businesses from using dark patterns to lead or encourage children to provide personal information beyond what is reasonably expected, or to take any action the business has reason to know is materially detrimental to children’s health or well-being; and - all applications of
California Civil Code § 1798.99.31(a)(5) , requiring covered businesses to [e]stimate the age of child users with a reasonable level of certainty appropriate to the risks that arise from the data management practices of the business or apply the privacy and data protections afforded to children to all consumers.
The State contends that under Moody, NetChoice cannot challenge only specific applications of the Individual Provisions. In the State’s view, NetChoice must show that the asserted unconstitutional applications of an Individual Provision substantially outweigh the constitutional applications of the entire Individual Provision. The State also asserts that even if NetChoice may challenge specific applications of Individual Provisions, NetChoice has not defined a discrete, clear application of any Individual Provision that properly could be enjoined by the Court.
The Supreme Court acknowledged that the challenge had characteristics of both a traditional as-applied challenge and a facial challenge. See Doe, 561 U.S. at 194. The claim was as-applied in the sense that it was not directed to the PRA in all its applications, but it was facial in the sense that it went beyond the plaintiffs’ particular case by challenging the PRA’s application to all referendum petitions, not just the referendum signed by the plaintiffs. See id. Ultimately, the Supreme Court treated the challenge as a facial one, observing that the plaintiffs’ claim and the relief that would follow – an injunction barring the secretary of state from making referendum petitions available to the public, – reach[ed] beyond the particular circumstances of these plaintiffs. Id. (internal quotation marks and citation omitted).
In considering the plaintiffs’ facial challenge, the Supreme Court found that [t]he compelled disclosure of signatory information on referendum petitions is subject to review under the First Amendment. Doe, 561 U.S. at 194. The Supreme Court went on to consider whether the PRA, as limited to referendum petitions, survived what it termed exacting scrutiny. Id. at 196. That standard requires a substantial relation between the disclosure requirement and a sufficiently important’ governmental interest. Id. (internal quotation marks and citations omitted). The Supreme Court found that [t]he State’s interest in preserving the integrity of the electoral process is undoubtedly important, encompassing efforts to identify invalid signatures caused by mistake or fraud, and to promoting transparency in the electoral process. Id. at 197-98. The Supreme Court compared the State’s interest against any burdens to First Amendment rights
Although it ruled against the Doe plaintiffs at the end of the day, the Supreme Court did consider their First Amendment facial challenge to a specific application of the PRA (referendum petitions) to be properly before it. NetChoice argues that under the reasoning of Doe, it may raise First Amendment facial challenges not only to entire provisions of the CAADCA, but to specific applications of some provisions. This Court agrees that based on Doe, a plaintiff may assert a First Amendment facial challenge to a specific application of a statutory provision.
The State argues that such a challenge is foreclosed by the Ninth Circuit’s decision in Arizona Attorneys, 127 F.4th 105, which issued on the same day as the hearing on NetChoice’s second motion for a preliminary injunction. The Court requested supplemental briefing from the parties as to any potential impact Arizona Attorneys may have on this case. NetChoice argues that Arizona Attorneys is factually distinguishable from the present case and therefore does not apply here.
Arizona Attorneys addressed a state statute that, among other things, prohibited criminal defense attorneys from initiating direct contact with crime victims, requiring the defense team to initiate any contact with victims through the prosecutor’s office. See Arizona Attorneys, 127 F.4th at 107. The plaintiffs challenged that prohibition, referred to as the Victim Contact Limit, as facially invalid under the First Amendment. See id. The Victim Contact Limit covered any communication during a criminal case, and its primary application was to requests for interviews with crime victims. See id. at 110. The plaintiffs did not challenge the primary application of the Victim Contact Limit, but instead restricted their challenge to defense team contacts with victims to share information about the crime, the case, and the legal system generally. See id. at 111.
NetChoice argues that because Arizona Attorneys involved a facial challenge to the entire Victim Contact Limit, it sheds no light on the proper analysis of a facial challenge to only specific applications of a statutory provision. This Court agrees. Accordingly, the Court does not find persuasive the State’s assertion that Arizona Attorneys precludes NetChoice’s proposed facial challenges to specific applications of the Individual Provisions under Doe. The Court addresses NetChoice’s facial challenges to the Individual Provisions below.
This Court is mindful of the fact that the Ninth Circuit vacated the first preliminary injunction with respect to the Individual Provisions that NetChoice challenges again here. See NetChoice II, 113 F.4th at 1122-23. The Ninth Circuit stated that those Individual Provisions, by their plain language, do not necessarily impact protected speech in all or even most applications. Id. at 1122 (citing
a. Policy Enforcement Requirement – Specific Applications
The State argues that NetChoice has identified an amorphous range of applications in its challenges to the Individual Provisions, which are not sufficiently specific to be analyzed as facial challenges. Def.’s Opp’n at 1. While the Court finds that argument persuasive as to NetChoice’s challenges to specific applications of other provisions, it is not well-taken here. The meaning of content policies and community standards is readily understood. Requiring a business to enforce its own published content policies and community standards to the satisfaction of the State would burden the business’s right to exercise its editorial judgment whether to permit or prohibit any given content in any given instance. The Supreme Court has held that exercise of such editorial judgment is protected by the First Amendment, because [a]n entity exercising editorial discretion in the selection and presentation of content is engaged in speech activity. Moody, 603 U.S. at 731 (internal quotation marks, citation, and brackets omitted). Consequently, even if the Court had not determined that all Regulatory Provisions are subject to strict scrutiny because of the content-based coverage definition, the Court would find
Applying strict scrutiny, the Court must determine whether the State has satisfied its burden to show that
The State argues that the First Amendment does not preclude it from requiring private parties to honor their promises, and that the provision requiring businesses to comply with their own content policies simply requires that they adhere to the contract made with users, a private agreement between private parties. Def.’s Opp’n at 14. The State cites two cases, Cohen v. Cowles Media Co., 501 U.S. 663 (1991), and Belgau v. Inslee, 975 F.3d 940 (9th Cir. 2020), neither of which held that an internet business’s published content policy is a contract. In fact, neither Cohen nor Belgau involved content policies at all. See id. Cohen involved a confidential source’s claim that a newspaper breached a confidentiality agreement, while Belgau involved a contractual relationship between a union and its employees. See Cohen, 501 U.S. at 665; Belgau, 975 F.3d at 950. Consequently, to the extent the State argues that content policies may be enforced as contracts, the State has failed to offer any legal support for its position.
Based on the foregoing, the Court finds that
Accordingly, the Court concludes that NetChoice is likely to prevail on its claim of facial invalidity with respect to
b. Information Use Restrictions – Specific Applications
The Court finds the State’s argument that NetChoice has identified an amorphous range of applications to be well-taken with respect to
That is not the case with respect to NetChoice’s proposed challenge to specific applications of
Although the Court identified a number of likely unconstitutional applications of
Looking to NetChoice to present this analysis, the Court finds that NetChoice’s simple narrowing of the scope of its claim under Doe to only use of personal information to publish content or make other information available does not answer the critical question of what is the full sweep of the narrowed application of the provision as compared to the unconstitutional applications. The Court is not persuaded that every application is unconstitutional given the amorphous definitions offered by NetChoice such as restrict[ions] [on] how services decide what speech to publish. Pl.’s Reply at 9.
Accordingly, the Court finds that NetChoice has not shown that it is likely to prevail on its claim of facial invalidity with respect to
c. Dark Patterns Restriction – Specific Applications
The State argues that this challenge to
Accordingly, the Court finds that NetChoice has not shown that it is likely to prevail on its claim of facial invalidity with respect to
d. Age Estimation Requirement – All Applications
The State contends that estimating a user’s age is conduct, not expressive activity. But this provision does not merely require covered a business to estimate age. The business must estimate a user’s age with a reasonable level of certainty appropriate to the risks to that user. The
Applying strict scrutiny, the Court must determine whether the State has satisfied its burden to show that
The State contends that the age estimation requirement furthers its interest in the privacy and well-being of children, because a business that estimates a user’s age will know which of the Act’s substantive protections must be applied. For example, once a business has estimated that a user is under the age of 18, the business must [c]onfigure all default privacy settings . . . to settings that offer a high level of privacy, unless a different setting is in the best interests of children.
The State’s argument is grounded in an assumption that greater data privacy for children
The State presents the declaration of Serge Egelman, Ph.D., who discusses a report on age estimation prepared by a French agency. See Egelman Decl. ¶¶ 64-65, ECF 112-2. Dr. Egelman states that the report describes France’s practice of using third parties for age estimation, as well as a prototype system for performing age estimation through access to restricted websites without sharing other personally identifiable data. Id. Dr. Egelman’s report does not explain how using third parties for age estimation would address the intrusive aspects of that process described by Ms. Rumenap, nor does Dr. Egelman’s report suggest that the prototype system described in the French report is widely available to covered businesses in the United States. See id. On this record, the Court finds that the State has not met its burden to show that age estimation furthers its interest in the privacy and well-being of children.
If a business chooses not to estimate the age of its users, it must apply the privacy and data protections afforded to children to all consumers. However, the Supreme Court has made clear that under the First Amendment, a state could not reduce the adult population . . . to reading only what is fit for children. Ashcroft v. Free Speech Coal., 535 U.S. 234, 252 (2002) (internal quotation marks and citation omitted). A statute that effectively suppresses a large amount of speech that adults have a constitutional right to receive and to address to one another . . . is unacceptable if less restrictive alternatives would be at least as effective in achieving the legitimate purpose that the statute was enacted to serve. Ashcroft v. ACLU, 542 U.S. 656, 665 (2004) (internal quotation marks and citation omitted). While the State asserts that there are no
Based on the foregoing, the Court finds that
Accordingly, the Court concludes that NetChoice is likely to prevail on its claim of facial invalidity with respect to
3. Vagueness Challenge
In Claim 3 of the FAC, NetChoice asserts that the Individual Provisions are unconstitutionally vague under the First Amendment.5 Specifically, NetChoice raises vagueness challenges to the policy enforcement requirement,
A statute can be impermissibly vague for either of two independent reasons. Hill v. Colorado, 530 U.S. 703, 732 (2000). First, if it fails to provide people of ordinary intelligence a reasonable opportunity to understand what conduct it prohibits. Id. Second, if it authorizes or even encourages arbitrary and discriminatory enforcement. Id. Although perfect clarity is not
a. Policy Enforcement, Cal. Civ. Code § 1798.99.31(a)(9)
NetChoice’s first vagueness challenge is asserted against
NetChoice does not contend that businesses will not understand the directive to enforce their own content policies. However, NetChoice contends that the provision will authorize and invite arbitrary and discriminatory enforcement because the State will have wide discretion to interpret businesses’ policies differently from the businesses themselves. NetChoice submits examples of covered businesses’ content policies to illustrate its point. Reddit’s Content Policy states that Reddit is a place for creating community and belonging, not for attacking marginalized or vulnerable groups of people and so users who promote hate based on identity of vulnerability will be banned. Kumar Decl. Ex. 3., ECF 29-4. The New York Times’ content policy requires use of respectful language and tells uses to [d]ebate, but don’t attack. Kumar Decl. Ex. 5, ECF 29-6. NetChoice suggests that a State regulator might understand an attack on a marginalized person differently than Reddit, or might understand the phrase respectful language differently than the New York Times. Certainly we all understand that language a parent might find to be disrespectful will not comport with the view of the child who uses that language. The Court agrees with NetChoice that the provision at issue, which gives the State legal authority to decide whether a covered business is complying with its own content policies, grants the State nearly unfettered discretion.
b. Information Use Restrictions, Cal. Civ. Code §§ 1798.99.31(b)(1) -(4)
Pursuant to
California Civil Code §§ 1798.99.31(b)(1) -(4) , covered businesses may not:(1) Use the personal information of any child in a way that the business knows, or has reason to know, is materially detrimental to the physical health, mental health, or well-being of a child.
(2) Profile a child by default unless both of the following criteria are met:
(A) The business can demonstrate it has appropriate safeguards in place to protect children.
(B) Either of the following is true:
(i) Profiling is necessary to provide the online service, product, or feature requested and only with respect to the aspects of the online service, product, or feature with which the child is actively and knowingly engaged.
(ii) The business can demonstrate a compelling reason that profiling is in the best interests of children.
(3) Collect, sell, share, or retain any personal information that is not necessary to provide an online service, product, or feature . . . unless the business can demonstrate a compelling reason that [doing so] is in the best interests of children likely to access the online service, product, or feature.
(4) If the end user is a child, use personal information for any reason other than a reason for which that personal information was collected, unless the business can demonstrate a compelling reason that use of the personal information is in the best interests of children.
The undersigned is quite familiar with the family law and juvenile proceedings referenced
The Court finds that NetChoice has demonstrated a likelihood of success on its vagueness challenge to
c. Dark Patterns Restriction, Cal. Civ. Code § 1798.99.31(b)(7)
Under
Use dark patterns to lead or encourage children to provide personal information beyond what is reasonably expected to provide that online service, product, or feature to forego privacy protections, or to take any action that the business knows, or has reason to know, is materially detrimental to the child‘s physical health, mental health, or well-being.
The State contends that
In its reply, NetChoice acknowledges the statutory definition of dark patterns, and clarifies that it does not challenge the prohibitions on using dark patterns to lead or encourage children to
The State argues that the phrase “reason to know” is not vague, relying on United States v. Jae Gab Kim, 449 F.3d 933 (9th Cir. 2006). Kim addressed a criminal defendant‘s vagueness challenge to a statute that, in relevant part, imposes penalties on “[a]ny person who knowingly or intentionally . . . possesses or distributes a listed chemical knowing, or having reasonable cause to believe, that the listed chemical will be used to manufacture a controlled substance. . . .” Id. at 937 (quoting
The rationale set forth in Kim does not apply in the present case, where the “what” that must be proven is vague. While it may be easy to say that an individual has reason to know that a particular chemical will be used to produce illegal drugs based on the facts of a particular case, it is far more difficult to say that businesses have reason to know what effect a feature like autoplay or push notification will have on children generally. Moreover, as discussed above with respect to the Act‘s information use restrictions, reasonable minds may differ on what is “detrimental” to a child‘s “physical health, mental health, or well-being.” Those terms have no established meaning and the CAADCA provides no guidance. The State does not offer a proposed definition or means for determining how to decide what is “detrimental” to a child‘s “physical health, mental health, or well-being.” Accordingly, the Court finds that
The Court finds that NetChoice has demonstrated a likelihood of success on its vagueness
d. Age Estimation, Cal. Civ. Code § 1798.99.31(a)(5)
The State contends that
However, the Court finds that the thrust of the age estimation requirement – that a business must estimate the age of child users – is clear. A vagueness challenge will fail when “it is clear what the ordinance as a whole prohibits.” Hill, 530 U.S. at 733 (internal quotation marks, citations, and brackets omitted). The Court agrees that the provision is less than precise with respect to the degree of certainty with which age estimation must be performed. But NetChoice has not cited, and the Court has not discovered, any authority suggesting that ambiguity in the degree of precision with which a task must be performed renders a statute vague when it is clear what task must be performed.
The Court concludes that NetChoice has not shown a likelihood of success on its vagueness challenge to
4. As-Applied Challenge
After the case was remanded to this Court by the Ninth Circuit, NetChoice amended its
“An as-applied challenge contends that the law is unconstitutional as applied to the litigant‘s particular speech activity, even though the law may be capable of valid application to others.” Project Veritas, 125 F.4th at 939-40. “Where a plaintiff seeks to challenge a statute prior to enforcement, there must be a genuine threat of imminent prosecution.” Id. at 941 (internal quotation marks and citation omitted). “To determine whether a plaintiff has established such a threat, we consider: [1] whether the plaintiffs have articulated a concrete plan to violate the law in question, [2] whether the prosecuting authorities have communicated a specific warning or threat to initiate proceedings, and [3] the history of past prosecution or enforcement under the challenged statute.” Id. (internal quotation marks and citation omitted). “[T]he mere existence of a statute is insufficient to create a ripe controversy[.]” Id. (internal quotation marks and citation omitted).
NetChoice does not address any of these factors. Accordingly, it is not entitled to a preliminary injunction based on its as-applied challenge, regardless of the State‘s failure to respond.
B. Severability (Prayer for Relief)
In the FAC‘s Prayer for Relief, NetChoice asks the Court to declare that the Individual Provisions,
Where a portion of a law has been found to be unconstitutional, invalidation of the entire law may be avoided if the unconstitutional portion may be severed from the remainder. See
NetChoice contends that the CAADCA cannot be saved by severing the enjoined DPIA provisions. The enjoined provisions include the DPIA requirement as well as the 90-day notice and cure provision, which the parties also refer to as the “safe harbor.” See NetChoice, LLC v. Bonta, 113 F.4th at 1108 (identifying enjoined provisions). NetChoice argues that the DPIA provisions are neither volitionally severable nor functionally severable from the remainder of the CAADCA.
While this Court‘s order granting NetChoice‘s first motion for a preliminary injunction addressed functional severability, as did the Ninth Circuit‘s opinion, neither this Court nor the Ninth Circuit considered the issue of volitional severability. See NetChoice II, 113 F.4th at 1125; NetChoice I, 692 F. Supp. 3d at 960-61. NetChoice raises the argument that the DPIA provisions are not volitionally severable from the remainder of the CAADCA for the first time in the present motion.
1. Volitional Severability
NetChoice argues that the DPIA provisions are not volitionally severable from the rest of the Act for two reasons. First, NetChoice contends that the plain text counsels against severance. Second, NetChoice asserts that the legislative history of the Act shows that the legislature would not have passed the Act without the DPIA provisions, and in particular the 90-day notice and cure provision. The State asserts that the DPIA provisions are volitionally severable.
An invalid portion of a statute “passes the test for volitional severability if it can be said with confidence that the enacting body‘s attention was sufficiently focused upon the parts to be validated so that it would have separately considered and adopted them in the absence of the
“The issue, when assessing volitional separability, is not whether a legislative body would have preferred the whole to the part; surely it would have[.]” Matosantos, 53 Cal. 4th at 273. “Instead, the issue is whether a legislative body, knowing that only part of its enactment would be valid, would have preferred that part to nothing, or would instead have declined to enact the valid without the invalid.” Id.
“In determining whether the invalid portions of a statute can be severed, we look first to any severability clause.” Matosantos, 53 Cal. 4th at 270. “The presence of such a clause establishes a presumption in favor of severance.” Id. However, “the absence of such a clause is not conclusive.” Cnty. of Sonoma v. Superior Ct., 173 Cal. App. 4th 322, 352 (2009). In the absence of a severability clause, “courts look to the statute‘s text, the intended function of the particular statutory scheme and the effect severance has on that intended function, any express policy statement or declaration of purpose, and legislative materials[.]” Fowler Packing Co., Inc. v. Lanier, 674 F. Supp. 3d 851, 877-78 (E.D. Cal. 2023) (internal quotation marks and citations omitted). Among the legislative materials considered by California courts are a Senate floor analysis, see People v. Cornett, 53 Cal. 4th 1261, 1267 (2012), and the floor statement of the sponsoring legislator, see Dowhal v. SmithKline Beecham Consumer Healthcare, 32 Cal. 4th 910, 926 (2004); In re Marriage of Siller, 187 Cal. App. 3d 36, 46 (1986).
NetChoice argues that the plain text of the statute supports a finding that the DPIA provisions are not severable, noting that the Act does not contain a severability clause. “Although the absence of a severability clause does not raise a presumption against severability, it does suggest an intent to have all components operate together or not at all.” Matter of Reyes, 910 F.2d 611, 613 (9th Cir. 1990) (internal quotation marks and citation omitted). NetChoice also points to legislative findings directing regulators to look to the United Kingdom for guidance. See 2022 Cal. Stat. ch. 320 (A.B. 2273), §§ (1)(d)-(e). Guidance from the Information Commissioner‘s
NetChoice argues that the Act‘s legislative history shows that the CAADCA would not have passed without the DPIA safe harbor granting businesses the right to notice and a 90-day cure period before imposition of civil penalties. Assembly Bill 2273 went through five iterations before it ultimately passed and was codified as the CAADCA. See Pl.‘s Request for Judicial Notice, ECF 129.6 The first two versions of the bill, dated February 16, 2022 and April 26, 2022, are not at issue. The third version, dated June 30, 2022 (“Version 3“), was the last version without the notice and cure provision. See id. Ex. 3, A.B. 2273, 2021-2022 Leg., Reg. Sess. (Cal. June 30, 2022). The Senate Appropriations Committee referred Version 3 to the suspense file.
The bill was amended again on August 11, 2022 (“Version 4“) to make substantial changes, including the addition of a notice and cure provision with a 45-day cure period. See Pl.‘s Request for Judicial Notice Ex. 4, A.B. 2273, 2021-2022 Leg., Reg. Sess. (Cal. August 11, 2022). On August 22, 2022, the full Senate read the bill a third time and amended Version 4 to become the fifth and final version (“Version 5“). See id. Ex. 5, A.B. 2273, 2021-2022 Leg., Reg. Sess. (Cal. August 22, 2022). Version 5 increased the notice and cure period to 90 days and did not include any other significant amendments. See id. NetChoice argues that the fact that the legislature actually considered, but did not adopt, the bill without the 90-day notice and cure period is strong evidence that the legislature would not have adopted with bill without that provision.
NetChoice presents evidence that floor statements by the bill‘s co-author also support a finding that the DPIA provisions are not volitionally severable. Assemblymember Wicks highlighted the notice and cure provision when presenting the final version of the bill for a vote, explaining that the amendment ensures that businesses in substantial compliance with the Act have an opportunity to remedy violations prior to being subject to civil penalties. See Transcript, Assembly Floor Analysis, AB 2273 (Aug. 11, 2022), Gossett Decl. Ex. 9. Floor statements of the sponsoring legislator may be considered when interpreting a statute. See Dowhal v. SmithKline Beecham Consumer Healthcare, 32 Cal. 4th 910, 926 (2004); In re Marriage of Siller, 187 Cal. App. 3d 36, 46 (1986).
The Court finds persuasive NetChoice‘s showing regarding the importance of the DPIA provisions, and in particular the notice and cure provision, to the passage of the CAADCA. The State argues that the Act makes clear the depth of the legislature‘s concerns for the privacy and safety of child users. See
2. Functional Severability
NetChoice also argues that the DPIA provisions are not functionally severable from the remaining provisions of the CAADCA. The State contends that the DPIA provisions are functionally severable.
An invalid provision is functionally severable if it is not necessary to the law‘s operation and purpose. Acosta, 718 F.3d at 820. “[T]he remainder after separation of the invalid part must be complete in itself and capable of independent application.” Abbott Lab‘ys., 175 Cal. App. 4th at 1358 (internal quotation marks and citation omitted).
NetChoice argues that the enjoined DPIA provisions are not functionally severable because they are critical to what NetChoice characterizes as “a compliance-based regime enforced primarily through internal compliance bureaucracies, not strict liability.” Pl.‘s Second Mot. for Prelim. Inj. at 25. NetChoice cites extensively to interview statements made by Assemblymember Wicks, the Act‘s co-author, indicating that the purpose of the Act is to bring covered businesses into compliance with its regulations, not to impose penalties on them. NetChoice argues that stripping out the DPIA provisions would change the Act‘s function and focus.
The State responds by pointing out that under California law, “the statements of an individual legislator, including the author of a bill, are generally not considered in construing a statute, as the court‘s task is to ascertain the intent of the Legislature as a whole in adopting a piece of legislation.” Quintano v. Mercury Cas. Co., 11 Cal. 4th 1049, 1062 (1995). As noted above, statements made on the floor may be considered, as they are presented to the legislature as a whole. See Dowhal, 32 Cal. 4th at 926. However, the Court gives little weight to the statements of Assemblymember Wicks in an interview.
Considering the plain text of the CAADCA, it appears that the enjoined DPIA provisions are distinct from other provisions of the Act, such that the invalidity of the DPIA provisions does not prevent the independent application of the Act‘s remaining provisions. For example, a
The Court concludes that the DPIA provisions are functionally severable from the remainder of the statute.
C. Section 230, COPPA, and Dormant Commerce Clause (Claims 4-6)
NetChoice argues that it is likely to succeed on its claims that the CAADCA is preempted by Section 230 (Claim 6); is preempted by COPPA (Claim 5); and is facially invalid under the dormant Commerce Clause (Claim 4). The State contends that NetChoice is not likely to succeed on those claims.
1. Section 230 Preemption (Claim 6)
In Claim 6, NetChoice asserts that certain provisions of the CAADCA are preempted by Section 230 of the Communications Decency Act,
“Section 230 of the CDA immunizes providers of interactive computer services against liability arising from content created by third parties[.]” Fair Hous. Council of San Fernando Valley v. Roommates.Com, LLC, 521 F.3d 1157, 1162 (9th Cir. 2008) (footnotes omitted). “The operative section of the law, § 230(c) . . . is divided into two working parts.” Est. of Bride by & through Bride v. Yolo Techs., Inc., 112 F.4th 1168, 1175 (9th Cir. 2024).
The Ninth Circuit has emphasized “that § 230(c)(1) does not declare a general immunity from liability deriving from third-party content.” Calise v. Meta Platforms, Inc., 103 F.4th 732, 740 (9th Cir. 2024) (internal quotation marks, citation, and brackets omitted). Immunity applies only if the website operator “is not also an ‘information content provider,’ which is defined as someone who is ‘responsible, in whole or in part, for the creation or development of’ the offending content.” Roommates, 521 F.3d at 1162 (quoting
Any assertion of Section 230 immunity against enforcement of the CAADCA therefore will depend on the circumstances of the case. One business‘s publication of content may implicate Section 230 while another business‘s publication of the same content may not, depending on each business‘s role (or lack thereof) in creating the published content. Indeed, the Ninth Circuit has recognized that Section 230 immunity “is a difficult and complex issue that requires case-specific, and indeed claim-specific, analysis.” Calise, 103 F.4th at 739. Consequently, while it may be appropriate for a covered business to raise Section 230 in response to the State‘s attempted enforcement of the CAADCA in a particular case, NetChoice has not shown that it is likely to succeed on its facial challenge to the CAADCA as preempted by Section 230.
In Claim 5, NetChoice asserts that the CAADCA is preempted by COPPA, which contains a preemption clause providing, “No State or local government may impose any liability for commercial activities or actions by operators in interstate or foreign commerce in connection with an activity or action described in this chapter that is inconsistent with the treatment of those activities or actions under this section.”
NetChoice claims that the CAADCA is inconsistent with COPPA because the CAADCA‘s regulations reach more broadly to businesses providing services “likely to be accessed by children,” and because the CAADCA does not grant parents the power to decide what their children an access online, as does COPPA. The State argues that the cited provisions of the CAADCA do not contradict, and indeed supplement, COPPA.
It is not clear that the cited provisions of the CAADCA contradict those of COPPA, or would stand as an obstacle to enforcement of COPPA. A determination that there is preemption would require a careful and nuanced analysis, which is not consistent with the few paragraphs the parties have devoted to the issue. The Court finds that NetChoice has not shown it is likely to succeed on its claim of COPPA preemption.
3. Dormant Commerce Clause (Claim 4)
Finally, in Claim 4 of the FAC, NetChoice asserts that the CAADCA violates the dormant Commerce Clause. “[T]he Commerce Clause prohibits the enforcement of state laws driven by economic protectionism – that is, regulatory measures designed to benefit in-state economic interests by burdening out-of-state competitors.” Nat‘l Pork Producers Council v. Ross, 598 U.S. 356 (2023). “When a state law . . . completely bans – or even just directly affects – commercial transactions that take place entirely outside of the state‘s borders, it plainly contravenes the dormant Commerce Clause.” Nat‘l Shooting Sports Found. v. Bonta, 718 F. Supp. 3d 1244, 1256 (S.D. Cal. 2024)
NetChoice argues that, because the CAADCA applies to “residents of California,” and such residents may be out of the state, the Act runs afoul of the dormant Commerce Clause. In response, the State contends that NetChoice applies the dormant Commerce Clause too broadly, and that in any event the CAADCA has no impact on transactions occurring wholly outside of the state. The briefing on these issues, comprising approximately one page per party, and the record regarding potential extraterritorial applications of the Act, are insufficient for the careful analysis that would be required before the Court could find the Act facially invalid under the dormant Commerce Clause. The Court therefore concludes that NetChoice has not shown it is likely to succeed on the merits of this claim.
D. Conclusion Re NetChoice‘s Entitlement to a Preliminary Injunction
The Court finds that NetChoice has shown a likelihood of success on its First Amendment claim (Claim 1), as NetChoice has established that the CAADCA likely is invalid on its face. NetChoice also has shown that the previously enjoined DPIA provisions are not volitionally severable from the remainder of the Act. Consequently, NetChoice has satisfied the first of the four Winter factors, as required to obtain a preliminary injunction barring enforcement of the CAADCA. See Winter v. Nat. Res. Def. Council, Inc., 555 U.S. 7, 20 (2008) (listing factors).
In addition, NetChoice has shown a likelihood of success on its First Amendment claim (Claim 1) and its First Amendment Vagueness claim (Claim 3) as to the Act‘s Individual Provisions, as NetChoice has established that: the policy enforcement provision,
The remaining Winter factors – the likelihood of irreparable harm, the balance of equities, and the public interest – are not contested, and the Court has no difficulty finding that they are
When a plaintiff makes a sufficient showing on all four Winter factors, issuance of a preliminary injunction is warranted, even if issuance of the injunction will involve intrusion into an agency‘s administration of state law. See Baird v. Bonta, 81 F.4th 1036, 1041 (9th Cir. 2023). Accordingly, NetChoice‘s motion for a preliminary injunction will be GRANTED.
E. Security
The parties have not addressed the issue of bond in their briefing. The Court issued the first preliminary injunction without a bond and without objection from the State. The Court again finds it appropriate to issue a preliminary injunction without requiring security.
- Plaintiff NetChoice‘s motion for preliminary injunction is GRANTED as follows:
- Rob Bonta, Attorney General of the State of California, and anyone acting in concert with his office are ENJOINED from enforcing the California Age-Appropriate Design Code Act;
- This preliminary injunction shall issue without the requirement of a security bond; and
- This preliminary injunction shall take effect immediately and shall remain in effect until otherwise ordered by the Court.
- This order terminates ECF 101.
Dated: March 13, 2025
BETH LABSON FREEMAN
United States District Judge