In a significant blow to state efforts to regulate online privacy for minors, constitutional challenges continue to prevail in federal courts.
As the latest step in a protracted legal battle, a federal district court in California has once again enjoined the entire California Age-Appropriate Design Code (“CAADCA” or the “Act”), halting its implementation. The court found that the plaintiff, the NetChoice trade association, demonstrated a likelihood of success on its claims that the Act violates the First Amendment rights of online service providers. The Attorney General of California has appealed the decision.
A number of states have enacted teen privacy laws that are facing similar challenges. While this ruling will not be binding in such challenges in other jurisdictions, it adds to the mounting rejection of these laws, or portions of these laws, by federal courts, many of which have already enjoined peer laws, including those in Arkansas, Mississippi, Ohio, and Utah. For example, on April 1, 2025, after a years-long legal battle, the U.S. District Court for the Western District of Arkansas granted NetChoice’s motion for summary judgment and permanently enjoined the state’s Social Media Safety Act. Further, courts that are considering NetChoice’s recent challenges to newer laws may find the California district court’s rationale to be persuasive, especially given the precedential value of CAADCA as one of the first laws of its kind in the United States. The court’s First Amendment analysis, particularly regarding the Act’s scope of applicability, and requirements related to age verification, DPIAs, dark patterns, policy enforcement, and information use, was largely aligned with federal court decisions in other states and may serve as a template for future challenges.
Background on the California Age-Appropriate Design Code
The CAADCA, signed into law by Governor Gavin Newsom in September 2022, was initially intended to take effect on July 1, 2024. It required certain businesses that provide online services, products, or features likely to be accessed by users under 18 years of age (i.e., “teenagers” or “teens”) to comply with a number of substantial requirements and prohibitions, such as configuring default privacy settings to high levels of protection, adhering to restrictions on collecting, sharing, or selling teenagers’ personal information beyond what is necessary, implementing mandatory data protection impact assessments (“DPIAs”) to identify any risk of “material detriment to children that arise from data management practices of the business,” and providing age-appropriate disclosures, such as privacy policies, among others.
CAADCA Court Challenges
The law was immediately challenged by NetChoice, and the case has ricocheted between the U.S. District Court for the Northern District of California and the Ninth Circuit Court of Appeals:
- District Court issues preliminary injunction against all provisions of CAADCA: Shortly after the introduction of the Act, NetChoice filed suit in the Northern District of California challenging the Act’s constitutionality. In 2023, the Northern District of California granted NetChoice a preliminary injunction against the CAADCA, holding that NetChoice was likely to succeed on its facial challenge to the Act under the First Amendment. The Court did not rule on NetChoice’s additional constitutional challenges to the Act. The State of California appealed.
- Court of Appeals reinstated parts of CAADCA: In August, 2024, the Ninth Circuit found that NetChoice had only met its burden of showing that the requirements in the law related to conducting DPIAs were likely unconstitutional because they compel speech by “requiring covered businesses to opine on potential harm to children” and “deputiz[e] covered businesses into serving as censors for the state.” The Ninth Circuit vacated the remainder of the preliminary injunction and remanded the case to allow NetChoice to develop the record and the lower court to determine whether the invalidated provisions were severable from the rest of the Act. To reach this conclusion, the Ninth Circuit applied Moody v. NetChoice, LLC, 603 U.S. 707 (2024), the Supreme Court case that had been decided in the interim. Moody held that the Eleventh and Fifth Circuits had not conducted a proper analysis of the facial First Amendment challenges to the Florida and Texas laws that purported to regulate teens’ use of social media and clarified that, to succeed on a facial challenge to a statute under the First Amendment, a plaintiff must demonstrate that a substantial number of the law’s applications are unconstitutional in relation to the statute’s legitimate scope. According to the Supreme Court, by focusing on specific applications, like the content moderation practices of social media platforms, rather than assessing the full range of applications, the lower courts treated the claims as if they were as-applied rather than facial ones.
District Court Again Enjoins All CAADCA Provisions
In its latest March 13, 2025 ruling, the Northern District of California found that the plaintiffs were likely to succeed on their claims that the entire Act violates the First Amendment. The court found that:
- Strict Scrutiny Standard: The Act is subject to the “strict scrutiny” level of review because it is a content-based restriction on speech. The court determined that the Act’s coverage definition, which establishes the scope of the Act’s applicability, regulates protected speech and is content-based because it applies to businesses depending on the likelihood that their content will be accessed by teenagers, therefore, subjecting the Act to strict scrutiny as a whole.
- Failure to Demonstrate Compelling State Interest: The State failed to demonstrate that the coverage definition and the regulatory provisions are narrowly tailored to serve a compelling state interest, as required under strict scrutiny.
- Facially Invalid Provisions: Specific provisions of the CAADCA are likely to be facially invalid as violations of the First Amendment, including the policy enforcement requirement (§ 1798.99.31(a)(9)), which requires covered businesses to enforce published terms, policies, and community standards, such as privacy policies and those concerning teens, and the age estimation requirement (§ 1798.99.31(a)(5)), which requires covered businesses to estimate the age of teen users with a reasonable level of certainty appropriate to the risks that arise from their data management practices or to apply the privacy and data protections afforded to teens to all consumers. The court determined that the policy enforcement requirement unconstitutionally burdens businesses’ First Amendment editorial discretion and the age estimation requirement forces businesses to determine what content is appropriate, imposes limits on that content, and could result in the restriction of all content to teenage-appropriate material. According to the court, neither provision was narrowly tailored to serve the State’s interest in protecting teenagers.
- Impermissibly Vague Provisions: Other provisions are likely to be found to be impermissibly vague, including the policy enforcement requirement (§ 1798.99.31(a)(9)), the information use restrictions (§§ 1798.99.31(b)(1)-(4)), and the dark patterns restriction (§ 1798.99.31(b)(7)) due to the CAADCA’s use of subjective, undefined terms that fail to provide businesses clear notice of prohibited conduct.
- DPIA Provisions Not Severable: The DPIA provisions, which the Ninth Circuit had exclusively enjoined, are not volitionally severable from the remainder of the CAADCA and thus cannot be separated from the rest of the Act because the provisions were critically important to the CAADCA’s enactment.
Implications for Online Service Providers
Despite ongoing successful challenges to state laws seeking to regulate companies’ interactions with teens, there are still notable implications for online service providers, including:
- Industry Standards: A number of industry players have begun implementing some CAADCA-inspired protections, such as parental controls, suggesting that best practices may be shifting regardless of the ultimate viability of these laws.
- Currently Valid State Laws: Despite the current injunction of the CAADCA and the injunctions of several similar state laws, certain others, such as those in Texas, Connecticut, and Maryland, remain in effect and impose a range of requirements on subject-businesses, including age-appropriate disclosures, default settings, and parental supervision tools and controls, as well as restrictions on targeted advertising and selling and on the collection of precise geolocation data. Additionally, a number of other states have proposed, or recently enacted, legislation designed to impose similar requirements and prohibitions.
- Attorney General Action: Further, the Texas attorney general has already filed a lawsuit against TikTok to enforce Texas’ social media law—the Scope Act—for alleged violations of the restrictions regarding disclosing personal identifying information and the requirements related to age verification and parental supervision tools.
- International Requirements: In addition, the United Kingdom Age-Appropriate Design Code, on which the CAADCA was modeled, applies to certain online services likely to be accessed by users under 18 in the UK.
The legal landscape surrounding teen privacy laws remains dynamic and will likely continue to evolve in the coming months. Companies operating online services should continue to monitor developments while considering industry best practices.