NetChoice v. Griffin — W.D. Ark. Enjoins Arkansas Act 900 Social Media Restrictions on First Amendment Grounds

Background

This is round two of NetChoice’s challenge to Arkansas’s social-media-regulation statutes. In March 2025, Judge Timothy Brooks permanently enjoined Arkansas Act 689 of 2023 (the Social Media Safety Act) on First Amendment and vagueness grounds. The state has appealed that ruling to the Eighth Circuit, where it remains pending. While the appeal was being briefed, the Arkansas General Assembly enacted Act 900 of 2025 — a redrafted statute meant to address the constitutional defects the district court had identified in Act 689 and to layer on new substantive obligations.

Act 900 reaches platforms that meet a six-element definition (user-to-user interaction, unique identifier, profile creation, follow/connection features, revenue from user engagement, accessed by Arkansas users) and imposes four kinds of new duties on those platforms with respect to users under sixteen:

• Addictive-practices ban. Platforms must “ensure” they don’t engage in practices that “evoke any addiction or compulsive behaviors,” specifically including notifications, recommended content, an artificial sense of accomplishment, or human-seeming bots, and must conduct quarterly internal audits to confirm compliance.
• Notification curfew. Non-safety notifications must be silenced from 10 p.m. to 6 a.m. CST by default.
• Default privacy settings. Privacy and safety controls must default to “the most protective level of control . . . offered” by the platform.
• Parental dashboard. Platforms must build an online dashboard letting a parent monitor a minor’s use habits and restrict access to all or “logical portions” of the platform.

Act 900 also raised the per-violation civil penalty from $2,500 to $10,000, with each day a covered platform allows a minor to use it counting as a separate violation. NetChoice moved for a preliminary injunction before the law’s April 21, 2026 effective date.

The Court’s Holding

The court granted NetChoice’s motion and preliminarily enjoined enforcement of Act 900’s § 1402(d) operative provisions. The opinion treats this as a First Amendment case. Several aspects of the analysis are notable:

The Act regulates protected speech. Although the General Assembly redrafted Act 689’s content-based platform definition to avoid the strict-scrutiny trap, the operative restrictions in Act 900 — the addictive-practices ban, the notifications curfew, and the default privacy settings — still reach platform conduct that implicates how minors send and receive information. The court found these restrictions trigger heightened First Amendment scrutiny.

The “addictive practices” ban is unconstitutionally vague. The Act prohibits practices “to evoke any addiction or compulsive behaviors,” but offers no meaningful standard for distinguishing prohibited engagement features from ordinary product design. Platforms cannot reasonably tell where the line falls, and the strict-liability enforcement scheme amplifies the chilling effect. The court held the provision void for vagueness.

The default-privacy and notifications provisions fail tailoring. Even assuming Arkansas has a legitimate interest in shielding minors from compulsive engagement, Act 900 sweeps far more broadly than necessary — the curfew applies to all non-safety notifications regardless of whether the underlying content has any connection to minors’ wellbeing, and the “most protective” default-setting requirement forces platforms to override editorial choices that are themselves protected speech.

Internal contradictions in the user definitions. The court flagged a noteworthy structural problem: Act 900 distinguishes “account holders,” “users,” and “Arkansas users,” but uses these terms inconsistently across the operative provisions. The addictive-practices and default-settings provisions apply to all Arkansas minors regardless of whether they have an account, while the parental dashboard provision applies only to minor “users” — who are defined as people who don’t have accounts. The opinion treats this as further evidence that the statute is not narrowly tailored to its stated purpose.

The court enjoined enforcement of § 1402(d) of Act 900 pending final judgment. Act 689’s permanent injunction (and the Eighth Circuit appeal) and the December 2025 preliminary injunction against Act 901 (also on appeal) remain in effect.

Key Takeaways

• Three Arkansas social-media statutes now blocked. Act 689 is permanently enjoined (on appeal). Act 900 and Act 901 are both preliminarily enjoined (and on appeal). All three are before the Eighth Circuit, which will eventually have to address whether the redrafted definitions in Act 900 escape the content-based / strict-scrutiny holding from the 2025 Act 689 decision.
• “Addiction” as a regulatory term remains vulnerable. Statutes that prohibit platform features that “cause addiction” or “compulsive use” face a recurring vagueness problem because the medical and engineering communities don’t agree on what those terms mean in the context of consumer software. Judge Brooks’s opinion is the latest in a line that includes the California minor-protection cases and the Texas SCOPE Act litigation.
• Default settings as compelled speech. The court’s treatment of the “most protective default” requirement — finding it triggers First Amendment scrutiny because it overrides the platform’s editorial choices about its product — will be relevant to similar default-setting mandates in California, New York, and federal proposals.
• Strict-liability enforcement amplifies the chill. Act 900’s $10,000-per-day strict-liability penalty structure was treated as part of the First Amendment problem, not separate from it: the magnitude of exposure for a vague obligation drives platforms to over-comply, suppressing more speech than the statute targets on its face.
• Eighth Circuit watch. Three NetChoice-Griffin appeals will be heard together (or in close succession), making the Eighth Circuit one of the most consequential venues for state-level minor-protection laws in 2026.

Why It Matters

State legislatures across the country have been racing to enact minor-protection statutes for social media in the wake of the surgeon general’s advisory and high-profile congressional hearings, but each iteration has hit constitutional turbulence. Arkansas’s experience is illustrative: a redrafted statute that addresses the content-based-definition problem still faces challenges over vagueness, tailoring, and the line between regulating commercial conduct and regulating protected expressive design. For platforms operating nationally, the result is a patchwork of injunctions that creates de facto safe harbors in some states while statutes remain on the books in others. Watch the Eighth Circuit consolidation: if the appellate court issues a clean affirmance of Judge Brooks’s reasoning across all three statutes, it will materially constrain the design space for the next wave of state-level child-online-safety bills.

Surfaced via Eric Goldman’s Technology & Marketing Law Blog.