NetChoice, a trade association of major technology companies, sued the State of California challenging the California Age-Appropriate Design Code Act (CAADCA), a law designed to protect children's privacy and safety online. The CAADCA applies to businesses providing online services likely to be accessed by children, defined by six specific indicators such as audience composition or design elements appealing to children. The Act imposes strict obligations, including prohibitions on using child data in ways that cause 'material detriment' and restrictions on 'dark patterns' that manipulate user choices. After a previous appeal, the Ninth Circuit had already enjoined the requirement for businesses to create Data Protection Impact Assessments. On remand, the district court granted a second preliminary injunction, blocking the entire statute and specific provisions regarding age estimation, data use, and dark patterns, largely relying on NetChoice's facial challenge to the coverage definition. The State appealed, arguing the lower court misapplied the standard for facial challenges and misinterpreted the statute's scope.
The panel focused on whether NetChoice was likely to succeed on the merits of its facial challenges. First, regarding the coverage definition, the court held that NetChoice failed to meet the high bar established by the Supreme Court in Moody v. NetChoice. A facial challenge requires showing that a substantial number of the law's applications are unconstitutional relative to its legitimate sweep. The court explained that the CAADCA's six indicators are not all content-based; some rely on demographic data like audience composition rather than the content of the speech itself. Because NetChoice did not develop a record cataloging the full range of applications—including non-content-based services like ride-sharing or financial apps that might be accessed by children—the court could not conclude the law was unconstitutional in a substantial majority of its applications. Second, the court addressed individual provisions. It vacated the injunction on the age estimation requirement because the record was insufficient to determine if the requirement facially violates the First Amendment, noting that businesses can opt out of age estimation by applying child privacy protections to all users. However, the court affirmed the injunction on the data use and dark patterns restrictions. The court found these provisions unconstitutionally vague because terms like 'material detriment' and 'best interests' do not provide people of ordinary intelligence with reasonable notice of what conduct is forbidden, creating a risk of arbitrary enforcement that chills protected speech. Finally, regarding severability, the court vacated the district court's conclusion that the valid remainder of the CAADCA could not stand without the enjoined notice-and-cure provision. The panel determined that at this stage of litigation, there was insufficient evidence to decide if the legislature would have enacted the remaining provisions without the safe harbor.
The CAADCA remains partially enjoined. The data use restrictions and dark patterns restrictions are blocked from enforcement due to vagueness. The coverage definition and age estimation requirement are no longer blocked, but the case is remanded to the district court to reconsider the scope of the coverage definition and the severability of the statute. The State may now attempt to enforce the valid portions of the Act, subject to further litigation on whether the remaining provisions can stand without the notice-and-cure provision.