Ninth Circuit Partially Blocks California Child Privacy Law

By: James M. Black, Esq. and Daniel J. Gershman, Esq. with contributions from Christopher Rivera and Vaughn Collopy

On August 16, 2024, the Ninth Circuit Court of Appeals issued a pivotal ruling in the case of NetChoice, LLC v. Bonta, addressing the constitutionality of California's Age-Appropriate Design Code Act (“CAADCA”), a law designed to enhance online privacy protections for minors. By way of a unanimous three-judge appellate panel, the court partially upheld and partially vacated a preliminary injunction issued by the U.S. District Court for the Northern District of California (the “District Court”) that had previously blocked the enforcement of the CAADCA.

California's Age-Appropriate Design Code Act

The CAADCA, also known as A.B. 2273, was enacted with unanimous support from the California Legislature in 2022 and was slated to go into effect on July 1, 2024. The law applies to all entities offering online services likely to be accessed by children under the age of 18 that are subject to the California Consumer Privacy Act (“CCPA”). An entity is subject to the CCPA if it (a) generates over $25,000,000 in annual revenue; (b) buys, sells, receives, or shares the personal information of 50,000 or more consumers, households, or devices annually; or (c) derives 50% or more of annual revenue from selling consumers' personal information.

The CAADCA mandates several stringent requirements aimed at protecting the online privacy and safety of minors. Among its key provisions, the law requires companies to conduct Data Protection Impact Assessments (“DPIA”) to identify and mitigate potential risks to children, configure default privacy settings to the highest level, and provide clear privacy information tailored to a child’s understanding.

The District Court's Injunction

Before the law could take effect, NetChoice, a trade group representing major tech companies such as Google, Amazon, Meta, and TikTok, filed a lawsuit challenging the CAADCA in the U.S. District Court for the Northern District of California. NetChoice’s argument focuses primarily on the First Amendment, asserting that the law's DPIA requirement is unconstitutional because it compels companies to engage in speech that they otherwise would not, effectively making them censors for the state. The group also argued that other provisions of the law were overly broad and could lead to over-moderation of online content, infringing on free speech rights.

In September of 2023, the District Court granted NetChoice's motion for a preliminary injunction, halting the enforcement of the CAADCA in its entirety. The district court found that the law likely violated the First Amendment and that the unconstitutional provisions were not severable from the rest of the law.

The Ninth Circuit's Ruling

On appeal, the Ninth Circuit partially upheld the district court's ruling but took a more nuanced approach. The appellate court agreed with the district court that the DPIA requirement likely violated the First Amendment. In a unanimous opinion written by U.S. Circuit Judge Milan D. Smith Jr., the court found that the DPIA requirement compelled speech by forcing companies to assess and report on potential content-related harms to children. This requirement, the court concluded, constituted an undue burden on free speech, as it effectively deputized private companies to censor online content on behalf of the state.

The court noted that while the state's goal of protecting children online is valid, the DPIA requirement was not the least restrictive means of achieving that goal. The court suggested that the state could have pursued less intrusive alternatives, such as enhancing online safety education for parents and children or incentivizing voluntary content moderation by companies.

However, the Ninth Circuit did not uphold the injunction against the entire law. Instead, it vacated the remainder of the district court's injunction, finding that it was unclear whether the other provisions of the CAADCA, such as those related to default privacy settings and the prohibition of using children's data in harmful ways, also violated the First Amendment. The court remanded these issues back to the district court for further consideration, leaving open the possibility that some parts of the law could still be enforced.

Conclusion

The Ninth Circuit's ruling is not likely to be the final word on the CAADCA. The case now returns to the District Court, where further proceedings will determine whether the law's remaining provisions are upheld. Falcon Rappaport & Berkman LLP will be closely monitoring the progress of NetChoice, LLC v. Bonta, as its outcome could set a significant precedent for how states can regulate online content and protect children without infringing on constitutional rights.

However, as the legal process continues, companies subject to the CAADCA should remain vigilant and prepare for the possibility that the remaining provisions of the law could still be enforced.

Our team of attorneys understand the complexities involved in navigating data privacy regulations laws and encourage you to contact us if you are in need of assistance. Falcon Rappaport & Berkman is prepared to provide counsel regarding these issues and further guide you through the data compliance process. Contact our Corporate & Securities Practice Group at 516-599-0888 or by filling out the form below.

DISCLAIMER: This summary is not legal advice and does not create any attorney-client relationship. This summary does not provide a definitive legal opinion for any factual situation. Before the firm can provide legal advice or opinion to any person or entity, the specific facts at issue must be reviewed by the firm. Before an attorney-client relationship is formed, the firm must have a signed engagement letter with a client setting forth the Firm’s scope and terms of representation. The information contained herein is based upon the law at the time of publication.