Background
California’s Age-Appropriate Design Code Act (CAADCA), Cal. Civ. Code §§ 1798.99.28–1798.99.40, was enacted unanimously in 2022 and is meant to protect the “privacy, safety, and well-being” of children who use online products and services they are “likely to access.” The Act imposes affirmative obligations on covered businesses, including a Data Protection Impact Assessment requirement, age-estimation duties, restrictions on data use and on the use of “dark patterns,” and a notice-and-cure provision. Violators face civil penalties of up to $2,500 per child per negligent violation and $7,500 per intentional violation.
NetChoice, a trade association whose members include Amazon, Google, Meta, and Netflix, brought a pre-enforcement facial challenge under the First Amendment and on federal-preemption grounds, arguing among other things that the CAADCA is preempted by Section 230 of the Communications Decency Act, by COPPA, and is invalid under the Dormant Commerce Clause. The district court initially enjoined the Act in its entirety.
On a first appeal in 2024 (NetChoice I), the same Ninth Circuit panel affirmed the injunction as to the DPIA requirement and vacated the rest of the injunction, remanding so the district court could apply the Supreme Court’s then-new facial-challenge framework from Moody v. NetChoice, 603 U.S. 707 (2024). On remand, NetChoice amended its complaint, narrowed the case to the coverage definition, age-estimation requirement, data-use restrictions, and dark-patterns restrictions, and won a second preliminary injunction enjoining the entire statute. The State again appealed, and the Ninth Circuit took the case for a second look.
The Court’s Holding
Writing for a unanimous panel, Judge Milan D. Smith, Jr. affirmed the preliminary injunction in part, vacated it in part, and remanded. Four holdings drove the result:
1. Coverage definition — injunction vacated
The CAADCA’s coverage definition turns on six enumerated indicators of whether an online service or feature is “likely to be accessed by children.” The district court had concluded that the coverage definition was content-based and that the entire statute therefore failed strict scrutiny under the First Amendment. The Ninth Circuit disagreed, but its disagreement was procedural rather than substantive: under Moody, a facial First Amendment challenger must develop a record cataloging the law’s full set of applications and showing that a substantial number of them are unconstitutional. NetChoice had not done that work. Without a developed record, the district court could not declare the coverage definition facially invalid in a substantial majority of its applications.
2. Age-estimation requirement — injunction vacated
For the same reason, the Ninth Circuit vacated the preliminary injunction with respect to the age-estimation provision. NetChoice’s facial challenge to the age-estimation requirement was not supported by a sufficient record to allow the court to weigh the law’s many possible applications. The panel emphasized that “facial challengers must clear a high bar” under Moody and Washington State Grange v. Washington State Republican Party, and that NetChoice — an experienced facial-challenge litigant — should have known what that bar required.
3. Data-use and dark-patterns restrictions — injunction affirmed on vagueness grounds
The court affirmed the injunction as to four provisions restricting how businesses may use a child’s personal information based on whether the use is “materially detrimental” to the child or contrary to the child’s “best interests,” and as to the provision prohibiting certain uses of “dark patterns.” All of these were held likely unconstitutionally vague because they do not clearly delineate the proscribed conduct. The scienter requirement built into the “knows, or has reason to know, is materially detrimental” language did not save the provision — it does not mitigate the underlying ambiguity about what counts as “materially detrimental” in the first place.
4. Severability — remainder of injunction vacated
The district court had concluded that the CAADCA’s remaining provisions were not severable from the previously enjoined notice-and-cure provision and so enjoined the entire Act. The Ninth Circuit could not determine that question on the present record and vacated the injunction over the rest of the statute, remanding for the district court to consider volitional severability.
Section 230 preemption
NetChoice had argued in the district court that the CAADCA is preempted by Section 230 of the Communications Decency Act. The district court rejected that argument largely because the parties devoted insufficient briefing to it. The Ninth Circuit did not reach the Section 230 preemption issue on appeal. Section 230 preemption therefore remains an open question on remand if NetChoice presses it.
Key Takeaways
- Moody v. NetChoice has become the structural pivot for facial First Amendment challenges to platform-regulation statutes. To get past a motion or a preliminary injunction stage, challengers now have to build an evidentiary record cataloging what the law actually regulates and showing that a substantial share of its applications are unconstitutional. Mere abstract First Amendment theory will not carry the day.
- Vagueness remains a viable backup attack on the CAADCA and similar statutes. The Ninth Circuit’s affirmance on the “materially detrimental,” “best interests of children,” and “dark patterns” provisions confirms that broad, undefined standards of harm don’t translate well into enforcement triggers.
- The Section 230 preemption argument has not been decided in this case. The Ninth Circuit’s silence on Section 230 leaves room for further litigation if NetChoice develops the argument on remand, and for platforms regulated by the CAADCA to raise the issue defensively in enforcement actions.
- The CAADCA is now, for the moment, partially enforceable in California. The DPIA requirement remains enjoined under NetChoice I; the data-use and dark-patterns provisions are enjoined under this opinion; and the rest of the statute is back in force pending the district court’s severability analysis.
Why It Matters
State legislatures across the country are looking at California’s CAADCA as a template for youth-online-safety regulation. The Ninth Circuit’s opinion tells those legislatures and the industries that have to comply with them three concrete things: First, the door to facial First Amendment invalidation of these statutes is still open, but plaintiffs need to invest in a real record. Second, vague harm standards are likely to fall on vagueness grounds even if they survive content-neutrality scrutiny. And third, the federal preemption defense — particularly under Section 230 — remains untested at the appellate level in this circuit and may become the most consequential battleground as more states pass similar laws.
For tech companies, the practical upshot is that the CAADCA is partially live again. Businesses that “likely” serve children in California should expect to defend the coverage analysis at the back end of enforcement rather than the front end of injunction.
Source
The Ninth Circuit’s published opinion is available here: NetChoice, LLC v. Bonta — Opinion (March 12, 2026).