Opinion · Court of Appeals for the Ninth Circuit
Netchoice, LLC v. Bonta
Netchoice, LLC v. Bonta, No. 25-2366, UP11274601 (9th Cir. Mar. 12, 2026)
- Type
- Opinion
- Court
- Court of Appeals for the Ninth Circuit
- Jurisdiction
- Federal
- Date
- 2026-03-12
- Topic
- litigation
FOR PUBLICATION UNITED STATES COURT OF APPEALS FOR THE NINTH CIRCUIT NETCHOICE, LLC, No. 25-2366 D.C. No. Plaintiff - Appellee, 5:22-cv-08861- BLF v. ROB BONTA, IN HIS OFFICIAL CAPACITY AS ATTORNEY GENERAL OF OPINION THE STATE OF CALIFORNIA, Defendant - Appellant. Appeal from the United States District Court for the Northern District of California Beth Labson Freeman, District Judge, Presiding Argued and Submitted January 14, 2026 Pasadena, California Filed March 12, 2026 Before: MILAN D.
Citator
UpLaw has not yet analyzed Netchoice, LLC v. Bonta. The absence of a flag is not a finding that it is good law.
FOR PUBLICATION
UNITED STATES COURT OF APPEALS
FOR THE NINTH CIRCUIT
NETCHOICE, LLC, No. 25-2366
D.C. No.
Plaintiff - Appellee,
5:22-cv-08861-
BLF
v.
ROB BONTA, IN HIS OFFICIAL
CAPACITY AS ATTORNEY GENERAL OF OPINION
THE STATE OF CALIFORNIA,
Defendant - Appellant.
Appeal from the United States District Court
for the Northern District of California
Beth Labson Freeman, District Judge, Presiding
Argued and Submitted January 14, 2026
Pasadena, California
Filed March 12, 2026
Before: MILAN D. SMITH, JR., MARK J. BENNETT,
and ANTHONY D. JOHNSTONE, Circuit Judges.
Opinion by Judge M. Smith, Jr.
2 NETCHOICE, LLC V. BONTA
SUMMARY *
First Amendment
The panel affirmed in part and vacated in part the district
court’s preliminary injunction in an action brought by
NetChoice, a national trade association of online businesses,
challenging the California Age-Appropriate Design Code
Act (CAADCA), which was enacted to protect the privacy,
safety, and well-being of children when engaging with
online products and services that children are likely to
access.
In a prior appeal, this panel affirmed the district court’s
preliminary injunction insofar as it prevented enforcement
of the CAADCA’s requirement that covered businesses
mitigate the risk that children are exposed to harmful
material online, and the other provisions that were not
severable from it. However, the panel vacated the majority
of the district court’s preliminary injunction order and
remanded for the district court to properly consider the facial
nature of NetChoice’s other First Amendment challenges
and to reconsider whether the unconstitutional portions of
the CAADCA were severable from its remaining provisions.
On remand, NetChoice sought a second preliminary
injunction. The district court preliminarily enjoined the
entire statute, and, in the alternative, seven individual
provisions challenged by NetChoice.
This appeal concerns the CAADCA’s coverage
definition, age estimation requirement, data use provisions,
*
This summary constitutes no part of the opinion of the court. It has
been prepared by court staff for the convenience of the reader.
NETCHOICE, LLC V. BONTA 3
and dark patterns restrictions. The panel focused its analysis
on whether NetChoice was likely to succeed on the merits of
its facial challenges to the CAADCA as a whole and to its
individual provisions because the State did not meaningfully
contest the remaining preliminary injunction factors.
The panel held that NetChoice is not likely to succeed on
the merits of its facial challenge to the CAADCA’s coverage
definition, which consists of six separately enumerated
indicators enabling online businesses to determine whether
they are subject to the CAADCA. It was NetChoice’s burden
to develop a record that would allow the court to determine
the law’s full set of applications, cataloging what activities,
by what actors the law regulates. Because NetChoice did not
carry its burden, the panel vacated the preliminary injunction
with respect to the entire CAADCA.
The panel next held that NetChoice is not likely to
succeed on the merits of its facial challenge to the age
estimation requirement. On the record before it, the panel
could not say that the age estimation requirement facially
violates the First Amendment at all, much less in a
substantial majority of its applications. Because NetChoice
could not succeed on this facial attack without a developed
record, the panel vacated the preliminary injunction as to the
age estimation requirement.
The panel affirmed the district court’s injunction with
respect to the data use and dark patterns restrictions on
vagueness grounds because the challenged provisions do not
clearly delineate the proscribed conduct.
Lastly, the panel vacated the district court’s order insofar
as it enjoined the CAADCA’s valid remainder on
severability grounds because, at this stage of the litigation,
the panel could not determine whether the notice-and-cure
4 NETCHOICE, LLC V. BONTA
provision is severable from the CAADCA’s remaining
provisions.
The panel remanded to the district court for further
proceedings.
COUNSEL
David M. Gossett (argued) and Meenakshi Krishnan, Davis
Wright Tremaine LLP, Washington, D.C.; Ambika Kumar
and Bianca G. Chamusco, Davis Wright Tremaine LLP,
Seattle, Washington; Adam S. Sieff, Davis Wright Tremaine
LLP, Los Angeles, California; Robert Corn-Revere,
Foundation for Individual Rights and Expression,
Washington, D.C.; for Plaintiff-Appellee.
Kristin Liska (argued), Deputy Attorney General; Anya M.
Binsacca, Supervising Deputy Attorney General; Thomas S.
Patterson, Senior Assistant Attorney General; Rob Bonta,
California Attorney General; Office of the California
Attorney General, San Francisco, California; for Defendant-
Appellant.
Ariel F. Johnson, Digital Smarts Law & Policy LLC, Shaker
Heights, Ohio, for Common Sense Media.
Jason Harrow, Gerstein Harrow LLP, Los Angeles,
California; Meetali Jain and Melodi Dinçer, Tech Justice
Law Project, Washington, D.C.; Mihir Kshirsagar, Center
for Information Technology Policy, Princeton, New Jersey;
for Amici Curiae Design Researchers and Practitioners.
NETCHOICE, LLC V. BONTA 5
Megan Iorio and Tom McBrien, Electronic Privacy
Information Center, Washington, D.C., for Amicus Curiae
Electronic Privacy Information Center.
Aaron D. Mackey, Adam Schwartz, and David Greene,
Electronic Frontier Foundation, San Francisco, California;
Samir Jain, Eric Null, and Kate Ruane, Center for
Democracy & Technology, Washington, D.C.; for Amici
Curiae Electronic Frontier Foundation, Center for
Democracy & Technology, Internet Archive, and
Wikimedia Foundation.
Anne M. Voigts, Pillsbury Winthrop Shaw Pittman LLP,
Palo Alto, California; Stephanie A. Joyce, Computer &
Communications Industry Association, Washington, D.C.;
for Amicus Curiae Computer & Communications Industry
Association.
Gabriel Rottman, Grayson Clary, and Mara Gassmann,
Reporters Committee for Freedom of the Press, Washington,
D.C., for Amici Curiae the Reporters Committee for
Freedom of the Press, Advance Publications, Hearst
Corporation, The New York Times Company, Reuters, and
the Student Press Law Center.
Mark W. Brennan, J. Ryan Thompson, and Thomas B.
Veitch, Hogan Lovells US LLP, Washington, D.C.;
Lawrence Walters, Walters Law Group, Longwood, Florida;
Kathleen Farley, Chamber of Progress, McLean, Virginia;
for Amici Curiae Chamber of Progress and Woodhull
Freedom Foundation.
6 NETCHOICE, LLC V. BONTA
OPINION
M. SMITH, Circuit Judge:
NetChoice, LLC (NetChoice), a trade association of
online businesses, returns to our court with a renewed
challenge to the California Age-Appropriate Design Code
Act (CAADCA or Act), Cal. Civ. Code §§ 1798.99
.28– 1798.99.40. Before the CAADCA went into effect, NetChoice brought suit in the United States District Court for the Northern District of California, challenging the Act on constitutional and federal preemption grounds. The district court agreed with NetChoice that the challenged provisions likely violate the First Amendment and that they were not severable from the remainder of the CAADCA. The district therefore preliminarily enjoined the Act, preventing it from going into effect. The State appealed that ruling, and we vacated the majority of the district court’s preliminary injunction order. However, we affirmed the injunction insofar as it prevented enforcement of the CAADCA’s requirement that covered businesses mitigate the risk that children are exposed to harmful material online,Cal. Civ. Code §§ 1798.99.31
(a)(1)–(2), and provisions not
grammatically severable from it. We remanded for the
district court to properly consider the facial nature of
NetChoice’s other First Amendment challenges and to
reconsider whether the unconstitutional portions of the
CAADCA were severable from its remaining provisions.
On remand, NetChoice sought a second preliminary
injunction. The district court preliminarily enjoined the
entire statute, and, in the alternative, seven individual
provisions challenged by NetChoice. Apart from the data
use restrictions, id.
§ 1798.99.31(b)(1)–(4), and the dark
NETCHOICE, LLC V. BONTA 7
patterns restriction, id. § 1798.99.31(b)(7), we vacate the
district court’s preliminary injunction order. The district
court erroneously concluded that NetChoice met its burden
for a facial challenge to the CAADCA as a whole by way of
the statute’s coverage definition. For similar reasons, we
vacate the preliminary injunction as to the age estimation
requirement, id. § 1798.99.31(a)(5). The Supreme Court has
been clear, and our court has since emphasized, that facial
challengers must clear a high bar. See, e.g., Wash. State
Grange v. Wash. State Republican Party, 552 U.S. 442
, 449– 5 0 (2008); Project Veritas v. Schmidt,125 F.4th 929
, 939–
4 0 (9th Cir. 2025) (en banc). NetChoice has been a party to
many such cases—several before our court and the Supreme
Court—and is presumably aware of the expectations for a
facial challenge. At the risk of repetition, we offer similar
guidance to NetChoice today.
We also vacate the district court’s order insofar as it
enjoined the CAADCA’s valid remainder on severability
grounds. At this stage of the litigation, we cannot conclude
that NetChoice is likely to succeed in showing that the
CAADCA’s remaining provisions are not volitionally
severable from its enjoined notice-and-cure provision, Cal. Civ. Code § 1798.99.35
(c)(2). We remand to the district
court for further proceedings consistent with this opinion.
LEGAL BACKGROUND
In 2022, the California legislature unanimously enacted
the CAADCA, Cal. Civ. Code §§ 1798.99
.28–1798.99.40. The Act’s stated purpose is to protect the “privacy, safety, and well-being of children” when engaging with online products and services that “children are likely to access.”Id.
§ 1798.99.29. To that end, the CAADCA applies only to
those businesses that provide “an online service, product, or
8 NETCHOICE, LLC V. BONTA
feature likely to be accessed by children” under the age of
eighteen. Id. §§ 1798.99.30(b)(1), 1798.99.31(a)–(b). An
online service is “likely to be accessed by children” when “it
is reasonable to expect, based on [enumerated] indicators,
that the online service, product, or feature would be accessed
by children.” Id. § 1798.99.30(b)(4).
In service of its goals concerning children’s data privacy,
the CAADCA imposes certain affirmative obligations and
prohibitions on the businesses it regulates. For example, in
2024, this same panel of our court affirmed a preliminary
injunction as to the provision requiring covered online
businesses to create a Data Protection Impact Assessment
(DPIA) report, or a “systematic survey to assess and mitigate
risks that arise from the data management practices of
the business to children who are reasonably likely
to access the online service . . . that arises from the
provision of that online service[.]” Id. §§ 1798.99.30(b)(2),
1798.99.31(a)(1)(B); see NetChoice, LLC v. Bonta
(NetChoice I), 113 F.4th 1101
, 1116–22 (9th Cir. 2024).
That requirement remains enjoined and is not at issue in this
appeal.
This appeal concerns the CAADCA’s coverage
definition, Cal. Civ. Code § 1798.99.30
(b)(4)(A)–(F); age estimation requirement,id.
§ 1798.99.31(a)(5); and data use
and dark patterns restrictions, id. §§ 1798.99.31(b)(1)–(4),
(7). The California Attorney General has authority to
enforce the CAADCA. Id. § 1798.99.35(a). Violators face
civil penalties of up to $2,500 per child for each negligent
violation and up to $7,500 for each intentional violation. See
id.
The Act previously included a safe-harbor provision that
allowed noncompliant businesses to cure an alleged
NETCHOICE, LLC V. BONTA 9
violation within 90 days of written notice from the Attorney
General of the alleged violation. Id. § 1798.99.35(c)(2). We
affirmed a preliminary injunction enjoining that notice-and-
cure provision in NetChoice I, 113 F.4th at 1125
.
FACTUAL & PROCEDURAL BACKGROUND
NetChoice is trade association whose members consist
of large technology companies like Amazon, Google, Meta,
and Netflix. See About Us, NetChoice,
https://netchoice.org/about/ (last visited Mar. 5, 2026). In
2022, before the CAADCA took effect, NetChoice brought
suit challenging the Act on constitutional and federal
preemption grounds. It also moved for a preliminary
injunction. The district court granted that motion and
enjoined the CAADCA in full, concluding that NetChoice
was likely to succeed on the merits of at least one of its facial
theories under the First Amendment. NetChoice, LLC v.
Bonta, 692 F. Supp. 3d 924
, 965–66 (N.D. Cal. 2023).
The State appealed. While that appeal was pending, the
United States Supreme Court decided Moody v. NetChoice,
LLC, 603 U.S. 707
(2024), where it clarified the standard for a facial challenge under the First Amendment. We applied the Moody standard in NetChoice I and determined that the district court did not conduct the proper analysis for a First Amendment facial challenge. See NetChoice I,113 F.4th at 1108
, 1123–24. We therefore vacated the majority of the preliminary injunction and remanded to the district court for further proceedings.Id. at 1108
. However, we affirmed the preliminary injunction with respect to the DPIA requirement, concluding that it likely facially violates the First Amendment.Id.
We likewise affirmed the district court’s decision to enjoin the enforcement of other 10 NETCHOICE, LLC V. BONTA provisions not grammatically severable from that requirement.Id.
On remand, NetChoice filed a first amended complaint
(FAC) and a second motion for a preliminary injunction.
The FAC asserted a new facial First Amendment challenge
to the CAADCA: that the Act’s coverage provision, making
the Act applicable to online businesses that are “likely to be
accessed by children,” is content based and fails strict
scrutiny, thus rendering the CAADCA’s substantive
provisions unconstitutional in every application. The FAC
also asserted as-applied challenges to the CAADCA.
NetChoice’s second preliminary injunction motion
advanced these newly pleaded theories as additional grounds
for enjoining the CAADCA’s enforcement.
Ruling on that motion, the district court agreed with
NetChoice that the coverage provision defining “likely to be
accessed by children” is content based and triggers First
Amendment scrutiny for the entire statute. The district court
then held that the CAADCA likely fails strict scrutiny
because it “applies to all online content likely to be accessed
by consumers under the age of 18, and imposes significant
burdens on the providers of that content,” and the State had
failed to show that the CAADCA is narrowly tailored, in part
because its “interest in protecting the privacy and well-being
of children” could be advanced “by vigorous enforcement of
existing, less restrictive regulations.”
Because, as the district court noted, some courts have
construed Moody to require analyzing facial challenges
provision-by-provision, the district court also addressed
NetChoice’s challenges to individual provisions of the
CAADCA. It first concluded that all the CAADCA’s
“[p]rovisions are subject to strict scrutiny because of the
NETCHOICE, LLC V. BONTA 11
content-based coverage definition.” The district court then
determined that NetChoice was not likely to succeed on its
facial First Amendment challenge to the data use restrictions
or the dark patterns restriction but that NetChoice was likely
to succeed on its First Amendment challenge to the age
estimation requirement. However, the district court
concluded that NetChoice was likely to succeed on its
vagueness challenges to the data use restrictions and dark
patterns restriction but not to the age estimation requirement.
NetChoice also challenged, and the district court enjoined,
the CAADCA’s policy enforcement requirement, Cal. Civ. Code § 1798.99.31
(a)(9). Next, the district court turned to
severability and held that no part of the CAADCA was
volitionally separable from the enjoined notice-and-cure
provision.
The district court then addressed NetChoice’s claims that
the CAADCA is preempted by Section 230 of the
Communications Decency Act (Section 230), 47 U.S.C. § 230
(c), preempted by the Children’s Online Privacy
Protection Act (COPPA), 15 U.S.C. §§ 6501–06, and
facially invalid under the Dormant Commerce Clause. In
part because the parties dedicated insufficient briefing on
these issues, and based on the record before it, the district
court concluded that NetChoice was not likely to succeed on
the merits of any of these claims. Similarly, because
NetChoice had “devote[d] a single sentence of its
[preliminary injunction] motion to its as-applied claims” and
did not address the factors required for an as-applied
12 NETCHOICE, LLC V. BONTA
challenge, the district court denied NetChoice’s motion on
that ground. 1
Because the district court concluded that NetChoice met
the remaining preliminary injunction factors on its facial
claim as to the coverage definition, on severability grounds,
and on some of its challenges to the Act’s individual
provisions, the district court granted NetChoice’s motion for
a preliminary injunction and enjoined the CAADCA in its
entirety. The State timely appealed.
JURISDICTION & STANDARD OF REVIEW
We have jurisdiction pursuant to 28 U.S.C. § 1292
(a)(1). We “review the district court’s decision to grant a preliminary injunction for abuse of discretion.” Tucson v. City of Seattle,91 F.4th 1318, 1324
(9th Cir. 2024) (quoting Daniels Sharpsmart, Inc. v. Smith,889 F.3d 608, 613
(9th Cir. 2018)). The district court “‘abuses its discretion if it rests its decision on an erroneous legal standard or on clearly erroneous factual findings.’”Id.
(quoting Am. Beverage Ass’n v. City & Cnty. of San Francisco,916 F.3d 749, 754
(9th Cir. 2019) (en banc) (citation modified)). “A district court’s decision is based on an erroneous legal standard if: (1) the court did not employ the appropriate legal standards that govern the issuance of a preliminary injunction; or (2) in applying the appropriate standards, the court misapprehended the law with respect to the underlying issues in the litigation.” Cal. Chamber of Com. v. Council for Educ. & Rsch. on Toxics,29 F.4th 468, 475
(9th Cir. 1 NetChoice’s as-applied claims and its challenge to the CAADCA’s policy enforcement requirement,Cal. Civ. Code § 1798.99.31
(a)(9), are
not at issue in this appeal.
NETCHOICE, LLC V. BONTA 13
2022) (quoting Negrete v. Allianz Life Ins. Co. of N. Am.,
523 F.3d 1091, 1096
(9th Cir. 2008) (citation modified)).
ANALYSIS
To obtain a preliminary injunction, NetChoice must
show that (1) it is likely to succeed on the merits; (2) it is
likely to suffer irreparable harm in the absence of
preliminary relief; (3) the balance of equities tips in its favor;
and (4) an injunction is in the public interest. See Winter v.
Nat. Res. Def. Council, Inc., 555 U.S. 7, 20
(2008). The party seeking a preliminary injunction bears the burden of proving each element. See Klein v. City of San Clemente,584 F.3d 1196, 1201
(9th Cir. 2009). As in its last round before our panel, the State does not meaningfully contest the latter three preliminary injunction factors. See NetChoice I,113 F.4th at 1115
. We therefore focus our analysis on
whether NetChoice is likely to succeed on the merits of its
facial challenges to the CAADCA as a whole and to its
individual provisions.
I. NetChoice is not likely to succeed on the merits of
its facial challenge to the CAADCA’s coverage
definition.
Under the First Amendment, “[c]ontent-based laws—
those that target speech based on its communicative
content—are presumptively unconstitutional and may be
justified only if the government proves that they are
narrowly tailored to serve compelling state interests.” Reed
v. Town of Gilbert, 576 U.S. 155, 163
(2015). In turn, “[g]overnment regulation of speech is content based if a law applies to particular speech because of the topic discussed or the idea or message expressed.” Id.; see also Sorrell v. IMS Health Inc.,564 U.S. 552, 566
(2011). Courts may determine whether a regulation is content based by 14 NETCHOICE, LLC V. BONTA considering whether it “draws distinctions based on the message a speaker conveys” “on its face.” Reed,576 U.S. at 163
. Even “subtle . . . distinctions” that “defin[e] regulated speech by its function or purpose” are “subject to strict scrutiny.”Id.
at 163–64.
The Supreme Court has also recognized “a separate and
additional category of laws that, though facially content
neutral, will be considered content-based regulations of
speech: laws that cannot be justified without reference to the
content of the regulated speech.” Id. at 164
(citation modified). “Those laws, like those that are content based on their face, must also satisfy strict scrutiny.” Id.; see also Sorrell,564 U.S. at 566
(“Even if the hypothetical measure
on its face appeared neutral as to content and speaker, its
purpose to suppress speech and its unjustified burdens on
expression would render it unconstitutional.”).
Our First Amendment analysis proceeds in three steps.
“The first step . . . is to determine whether the regulation
implicates protected expression.” Recycle for Change v.
City of Oakland, 856 F.3d 666, 669
(9th Cir. 2017). Thus, “[t]he threshold question is whether conduct with a ‘significant expressive element’ drew the legal remedy or the [statute] has the inevitable effect of ‘singling out those engaged in expressive activity.’” Int’l Franchise Ass’n, Inc. v. City of Seattle,803 F.3d 389, 408
(9th Cir. 2015) (quoting Arcara v. Cloud Books, Inc.,478 U.S. 697
, 706–07 (1986)). Next, we ask “whether the [statute] is content based or content neutral.” Recycle for Change,856 F.3d at 669
. If the statute is content based, we must determine whether it withstands strict scrutiny.Id.
If it is content neutral, the
statute need only satisfy intermediate scrutiny. See Project
Veritas, 125 F.4th at 947.
NETCHOICE, LLC V. BONTA 15
But that is not all: NetChoice must also satisfy the
requirements for a facial challenge as to each challenged
provision. See Moody, 603 U.S. at 725–26. In Moody, the
Supreme Court explained that district courts evaluating a
facial challenge under the First Amendment must assess
“whether a substantial number of [the law’s] applications are
unconstitutional, judged in relation to the statute’s plainly
legitimate sweep.” 603 U.S. at 723
(alterations in original) (citation modified) (quoting Ams. for Prosperity Found. v. Bonta,594 U.S. 595, 615
(2021)). That analysis proceeds in two steps of its own. First, courts must “assess the state law[’s] scope” by asking “[w]hat activities, by what actors, do the laws prohibit or otherwise regulate?”Id. at 724
. Second, courts must “decide which of the law[’s] applications violate the First Amendment, and . . . measure them against the rest.”Id. at 725
. A facial challenge thus “demands record development on third-party speech and the full scope of a law’s potential applications.” NetChoice, LLC v. Bonta (NetChoice SB 976),152 F.4th 1002
, 1013 (9th Cir. 2025). Here, “[i]t is NetChoice’s burden to make those showings.”Id.
A. NetChoice does not carry its burden for its
facial challenge to the coverage definition
under Moody.
The CAADCA applies to any “business that provides an
online service, product, or feature likely to be accessed by
children.” Cal. Civ. Code § 1798.99.31
(a). 2 The Act 2 For terms not expressly defined in the CAADCA, the Act incorporates the definitions provided by the California Consumer Privacy Act (CCPA),Cal. Civ. Code §§ 1798
.100–1798.199.100. Seeid.
§ 1798.99.30(a). A “business” is a legal, for-profit entity that “collects
consumers’ personal information” and “determines the purposes and
16 NETCHOICE, LLC V. BONTA
defines “likely to be accessed by children” to mean that “it
is reasonable to expect, based on [enumerated] indicators,
that the online service, product, or feature would be accessed
by children.” Id. § 1798.99.30(b)(4). The definition relies
on application of the following indicators:
(A) The online service, product, or feature is
directed to children as defined by the
Children’s Online Privacy Protection Act
(15 U.S.C. Sec. 6501
et seq.).
(B) The online service, product, or feature is
determined, based on competent and
reliable evidence regarding audience
composition, to be routinely accessed by
a significant number of children.
(C) An online service, product, or feature
with advertisements marketed to
children.
(D) An online service, product, or feature that
is substantially similar or the same as an
online service, product, or feature subject
to subparagraph (B).
(E) An online service, product, or feature that
has design elements that are known to be
of interest to children, including, but not
limited to, games, cartoons, music, and
celebrities who appeal to children.
means of the processing of consumers’ personal information,” “that does
business in the State of California,” and that meets a certain threshold for
revenue or for the number of transactions involving personal
information. See id.
§§ 1798.99.30(a), 1798.140(d).
NETCHOICE, LLC V. BONTA 17
(F) A significant amount of the audience of
the online service, product, or feature is
determined, based on internal company
research, to be children.
Id.
On appeal, the State argues that this coverage definition
does not regulate protected speech; in the State’s view, “it
does not regulate anything” but rather “clarifies which
businesses are subject to the Act’s substantive regulatory
provisions.” NetChoice contends, and the district court
concluded, that by virtue of the coverage definition, the Act
“burdens speech based on content in every application.”
The district court held that “[a]pplication of [the
enumerated indicators] to determine whether a particular
business’s online offerings are likely to be accessed by
children unavoidably requires an evaluation of content.”
The district court reasoned that the coverage definition
“single[s] out particular subject matter, specifically online
content that is likely to be accessed by children” and
observed that “[a] business will be treated differently under
the CAADCA if it provides online services, products, or
features with design elements that are known to be of interest
to children, such as games, cartoons, music, or other content
that appeals to children, or the business knows that a
significant portion of its audience is children.” And because
it determined any application of the Act’s substantive
provisions “that do not implicate protected speech” “will be
substantially outweighed by the applications of the
[substantive provisions] that do implicate protected speech,”
the district court concluded that NetChoice met the standard
for a facial challenge set forth in Moody.
18 NETCHOICE, LLC V. BONTA
We disagree. Unlike the enjoined DPIA report
requirement, which “raise[d] the same First Amendment
issues” “in every application to a covered business,”
NetChoice I, 113 F.4th at 1116
, the coverage definition does not. 3 First, the State persuasively argues that whether “it is reasonable to expect” that a business’s “online service, product, or feature would be accessed by children,”Cal. Civ. Code § 1798.99.30
(b)(4), “says nothing about the nature of the business providing that service, product, or feature.” Indeed, as the State proffers, children “are capable of using ride sharing service[s] like Lyft or Waymo, electronic ticketing services such as StubHub or Ticketmaster, financial transaction services such as Paypal or Venmo, fitness products such as NFL Play 60 or Peloton, health- related services such as iHealth, or education-related products such as Wolfram Mathematica.” The CAADCA’s substantive requirements would “appl[y] evenhandedly” to any of these businesses if they are likely to be accessed by children, regardless of the content available through their online service. Heffron v. Int’l Soc’y for Krishna Consciousness, Inc.,452 U.S. 640, 649
(1981); see also Hill v. Colorado,530 U.S. 703, 723
(2000) (finding regulation
that “clearly does not prohibit . . . either a particular
viewpoint or any subject matter that may be discussed by a
speaker” content neutral and observing that “the statute
3
To the extent NetChoice argues that the coverage definition raises the
same First Amendment issues in every application because it compels
every covered business to comply with the CAADCA’s substantive
provisions, that argument fails as a challenge to the coverage definition
itself. Such a challenge is more appropriately raised against the
substantive provisions with which NetChoice finds issue—as it did in
the previous appeal with respect to the DPIA report requirement and as
it does in this appeal with respect to the age estimation requirement, data
use restrictions, and dark patterns restriction, discussed below.
NETCHOICE, LLC V. BONTA 19
applies equally to used car salesmen, animal rights activists,
fundraisers, environmentalists, and missionaries”).
The CAADCA’s coverage definition consists of six
separately enumerated indicators enabling online businesses
to determine whether or not they are subject to the Act.
Because each indicator demands different inquiries of online
businesses, the coverage definition cannot apply to every
online business in the same way. For example, an online
business is “likely to be accessed by children” pursuant to
indicator (B) where it “is determined, based on competent
and reliable evidence regarding audience composition, to be
routinely accessed by a significant number of children.” Cal. Civ. Code § 1798.99.30
(b)(4)(B). Similarly, a business meets the coverage definition under indicator (F) where “[a] significant amount of the audience of the online service, product, or feature is determined, based on internal company research, to be children.”Id.
§ 1798.99.30(b)(4)(F). Determining whether a service is “routinely accessed by a significant number of children” requires looking to demographic data concerning online traffic to the business’s product—that is data received by the business, not content the business publishes. See id. § 1798.99.30(b)(4)(B). The record establishes—and NetChoice nowhere denies—that frequently, this is data that online businesses already have. See also NetChoice SB 976, 152 F.4th at 1022 (concluding that NetChoice’s facial challenge to age-verification provisions in California’s Protecting Our Kids from Social Media Addiction Act is unripe in part because “NetChoice members can verify users’ age in the background without requiring user input”). The same is true of determining 20 NETCHOICE, LLC V. BONTA whether “[a] significant amount of the audience” is “children.”Cal. Civ. Code § 1798.99.30
(b)(4)(F). 4
However, an online business also comes within the
coverage definition if it provides “advertisements marketed
to children” or has “design elements that are known to be of
interest to children, including, but not limited to, games,
cartoons, music, and celebrities who appeal to children.” Id.
§ 1798.99.30(b)(4)(C), (E). These indicators may indeed
require online businesses to review the content that they
publish to determine whether it is directed at or otherwise
appealing to children. But that is a different question
altogether from whether a significant amount of a business’s
online patrons are children. A business that satisfies the
“significant amount” test would have no need to evaluate
whether its product is “directed to children,” “marketed to
children,” or “has design elements that are known to be of
interest to children” to determine if the CAADCA applies to
it. Id. § 1798.99.30(b)(4).
Nowhere does the definition require that all six
indicators must be present for the Act to apply, or even that
a combination of several factors is required. 5 See id. The
content and structure of the provision—listing six separate
possible indicators—confirms this reading. For example,
4
NetChoice asserts that “audience composition” “turn[s] in significant
measure on the service’s content,” but it offers no legal authority or
factual support for that contention. On the contrary, as to indicators (B)
and (F), “[t]he plain language of the statute dictates that its application
turns on” whether the online service is accessed or used by a significant
number of children, “and not the subject matter” of the business’s
content, to the extent the business is even a publisher. Project Veritas,
125 F.4th at 951.
5
In its answering brief, NetChoice itself reads the coverage indicators as
independently sufficient.
NETCHOICE, LLC V. BONTA 21
indicator (D) defines coverage by reference to businesses
“substantially similar” to those satisfying indicator (B)
alone, thus creating a derivative category that would be
superfluous unless indicator (B) is independently sufficient.
Id. § 1798.99.30(b)(4)(B), (D). Indicators (B) and (F)
likewise address the same underlying question—whether
children make up a significant share of a platform’s
audience—but through different evidentiary sources. Id.
§ 1798.99.30(b)(4)(B), (F). Reading them as cumulative
would allow a business with, for example, substantial
company evidence of child users to escape coverage simply
by contesting external demographic data, an absurd statutory
result. And indicator (A) incorporates COPPA’s “directed to
children” standard, see 15 U.S.C. § 6501
(10), which overlaps in part with indicators (C) and (E), seeCal. Civ. Code § 1798.99.30
(b)(4)(A), (C), (E); if all six indicators
were required, satisfying (A) alone could never
independently trigger coverage, rendering it surplusage. The
most natural reading of the provision is that application of
any one indicator is sufficient for the business to come
within the CAADCA’s scope. And because the question that
each indicator requires an online business to ask demands a
different answer, we cannot say that the coverage definition
likely raises the same First Amendment issues in every
possible application.
To illustrate the point, recall the State’s examples of
online services, including ride sharing services, electronic
ticketing services, and financial transaction services, all of
which may be subject to the CAADCA pursuant to
indicators (B) or (F) but which may not otherwise be directed
at or marketed to children. NetChoice does not squarely
address any of these examples. Instead, NetChoice responds
that “the Act does not ask whether minors ‘are capable of
22 NETCHOICE, LLC V. BONTA
using’ some service” but rather whether the service is likely
to be accessed by minors “pursuant to content-based
indicia.” But NetChoice misreads the coverage definition—
which, as explained, does not compel online businesses to
apply any potentially content based indicia if the business is
routinely accessed by a significant number of children.
It may well be the case that a significant number of
children do not routinely access ride sharing services,
electronic ticketing services, financial transaction services,
or any other online service the State identified. But the
district court made no factual findings on those questions,
and that information is not otherwise in the record. “The
First Amendment analysis is fact intensive and will surely
vary from platform to platform.” NetChoice SB 976, 152
F.4th at 1014 (citation modified). And it is NetChoice’s
burden to establish that factual record so that the district
court could have properly considered every conceivable
application of the CAADCA’s coverage definition.
NetChoice’s focus on applications of the CAADCA that
may implicate protected expression does not relieve it from
the burden to demonstrate that these applications
“substantially outweigh” applications that do not, as Moody
requires. NetChoice I, 113 F.4th at 1115
. As we cautioned in NetChoice I, “the focus on whether and how these provisions may impact” “social media companies,” “without considering any other potential applications, treats NetChoice’s challenges ‘more like as-applied claims than like facial ones.’”Id.
at 1123 (quoting Moody,603 U.S. at 724
). “[N]either parties nor courts can disregard the requisite inquiry into how a law works in all of its applications.” Moody,603 U.S. at 744
.
NETCHOICE, LLC V. BONTA 23
NetChoice makes the same critical error here. It focuses
only on “possible applications” of the coverage definition to
companies that publish content, “a subset of the businesses
covered by the CAADCA,” and “speculate[s] about how that
subset of applications could ultimately have a substantial
effect on those companies’” protected expression.
NetChoice I, 113 F.4th at 1123
. But in a facial challenge, NetChoice may not “treat[] the law[] as having certain heartland applications, and mostly confine[] the[] battle to that terrain.” Moody,603 U.S. at 724
. For similar reasons, NetChoice’s reliance on several cases where district courts have found that a statute’s gateway definition triggers First Amendment review and subjects the entire statute to strict scrutiny is misplaced. 6 In each of these cases, the district court interpreted statutes specifically targeting social media companies, and in each, the court found that the central coverage definition facially distinguished between types of speech. 7 These cases largely did not assess coverage 6 See NetChoice, LLC v. Carr,789 F. Supp. 3d 1200
(N.D. Ga. 2025); NetChoice, LLC v. Fitch,787 F. Supp. 3d 262
(S.D. Miss. 2025); NetChoice, LLC v. Yost,778 F. Supp. 3d 923
, 953‒54 (S.D. Ohio 2025); SEAT v. Paxton,765 F. Supp. 3d 575
(W.D. Tex. 2025); NetChoice, LLC v. Griffin,2025 WL 978607
(W.D. Ark. Mar. 31, 2025); CCIA v. Paxton,747 F. Supp. 3d 1011
, 1032–34 (W.D. Tex. 2024); NetChoice, LLC v. Reyes,748 F. Supp. 3d 1105
(D. Utah 2024). 7 See Carr, 789 F. Supp. 3d at 1222 (finding statute content based on its face because it distinguished between user-generated content and social- media-provider-generated content); but see id. (distinguishing from case where the statute defined “social media platforms,” inter alia, “by the demographics of their users,” finding this was a “key difference” between the statutes) (emphasis added); Fitch, 787 F. Supp. 3d at 275 (finding statute content based because it classifies based on whether the entity disseminates “‘social interaction’ as opposed to ‘news, sports, commerce, [or] online video games’” (alteration in original) (citation modified)); Yost, 778 F. Supp. 3d at 953–54 (exceptions to statute’s 24 NETCHOICE, LLC V. BONTA definitions based on the age demographics of a business’s user base. The one case that did so rejected the argument that such a classification was content based. See NetChoice, LLC v. Yost,716 F. Supp. 3d 539
, 556 (S.D. Ohio 2024).
Moreover, in another recent case involving NetChoice, a
different panel of our court considered the central coverage
definition in California’s Protect Our Kids from Social
Media Addiction Act, Cal. Health & Safety Code §§ 27000–
07, which made the statute applicable “to any internet
website including . . . a social media platform that
personalizes feeds based on information provided by the
user.” NetChoice SB 976, 152 F.4th at 1016 (citation
modified). NetChoice argued on appeal that “the Act’s focus
on social media makes the entire act content based.” Id. The
panel rejected that argument, explaining that the use of
“‘social media’ platform as statutory shorthand does not
render the Act content based, since it applies to websites
whether they facilitate social interaction or other forms of
content.” Id. Accordingly, the “Act as a whole” was not
coverage for “product review websites and ‘widely recognized’ media
outlets” and exceptions that “distinguish between the subset of websites
without private chat features based on their content” were content
based); Griffin, 2025 WL 978607
, at *9 (coverage definition content based on its face because whether a social media platform is covered depends on whether the platform is primarily used for interacting socially with other profiles); CCIA, 747 F. Supp. 3d at 1032 (coverage definition that distinguishes between digital service providers who host “social speech” but not “non-social interactions” was content based); SEAT, 765 F. Supp. 3d at 592–94 (reaching the same conclusion as CCIA); Reyes,748 F. Supp. 3d 1105
at 1121 (coverage definition that
“draws distinctions between websites that allow users to interact socially
and websites that serve another function or purpose, such as those that
allow users to shop, read the news, access entertainment, educate
themselves, or conduct business” was content based).
NETCHOICE, LLC V. BONTA 25
content based by way of its coverage definition. Id.
The
CAADCA’s coverage definition applies even more broadly,
regardless of whether an online business publishes content
of any kind or none at all. 8
At bottom, to properly assert a facial challenge, it is
NetChoice’s burden to establish the CAADCA’s “full
range” by way of its coverage definition. NetChoice I, 113 F.4th at 1123
. If NetChoice’s prime concern is the CAADCA’s effect on social media companies or publishers, it could have brought an as-applied challenge on behalf of some of its members. Cf. NetChoice SB 976, 152 F.4th at 1020 (“[F]acial challengers cannot focus on a law’s effect on their own platforms—they cannot even limit the inquiry to the tech giants. They must canvass ‘the full range of activities’ covered by the law and ‘measure the constitutional against the unconstitutional applications.’” (quoting Moody,603 U.S. at 724
)). Instead, NetChoice pursued a more difficult path. That strategic decision “comes at a cost.” Moody,603 U.S. at 723
. It requires NetChoice to “develop a record that would allow the court to ‘determine [the] law’s full set of applications,’ cataloging what ‘activities, by what actors’ the law regulates.” NetChoice SB 976, 152 F.4th at 1021 (alteration in original) (quoting Moody,603 U.S. at 718, 724
). We “cannot
speculate whether a law unduly burdens expression without
a developed record that explains not only how [NetChoice’s]
platforms work, but also how a wide range of third-party
8
For all of NetChoice’s focus on content, nowhere does it explain the
kind of content with which it is concerned, such as user-generated
content, content published by online businesses, or online businesses’
editorial choices. We are therefore in no position to consider whether,
or how, the CAADCA’s coverage definition might apply differently
even across different categories of online “content.”
26 NETCHOICE, LLC V. BONTA
services operate. This information is necessary to
characterize the denominator of a law’s applications.” Id. at
1020 (citation modified).
To be sure, as we observed in NetChoice SB 976,
“[d]oing so would entail the ‘daunting, if not impossible’
task of canvassing how the Act applies to an ‘ever-growing
number of apps, services, functionalities, and methods for
communication and connection.’” Id. at 1021 (first quoting
Moody, 603 U.S. at 745
(Barrett, J., concurring); and then quoting Moody, 603 U.S at 725 (majority opinion)). We recognized that “such a showing” might be “unrealistic.”Id.
But we nevertheless stated then, and maintain now, that “[i]t is a mystery how NetChoice could expect to prevail on a facial challenge without candidly disclosing the platforms that it thinks the challenged laws reach” and whether the coverage definition unduly burdens those platforms’ expression.Id.
at 1021–22 (alteration in original) (quoting Moody,603 U.S. at 787
(Alito, J., concurring)).
We need not decide today whether any of the coverage
definition’s enumerated indicators necessarily target
expressive activity. “[A]ll we recognize is that some” of the
indicators “may be expressive, while others are not, and that
inquiry is fact intensive.” Id. at 1021. Because NetChoice
stumbles at both steps of the facial analysis, we end our
analysis where we began—with Moody. Accordingly, we
vacate the preliminary injunction with respect to the entire
CAADCA and remand for the district court to consider the
scope of the CAADCA’s coverage definition anew and to
weigh any unconstitutional applications against the
constitutional ones.
NETCHOICE, LLC V. BONTA 27
II. NetChoice’s challenges to individual provisions
are likely to succeed on the merits with respect to
the data use and dark patterns restrictions but
not the age estimation requirement.
In the alternative to NetChoice’s coverage-definition
theory, the district court concluded that NetChoice was
likely to prevail on its facial challenges to seven individual
provisions on First Amendment or vagueness grounds. The
State appeals with respect to the age estimation requirement,
Cal. Civ. Code § 1798.99.31
(a)(5); the data use restrictions,id.
§ 1798.99.31(b)(1)–(4); and the dark patterns restriction,
id. § 1798.99.31(b)(7); so those are the provisions we
consider. We vacate the preliminary injunction order with
respect to the age estimation requirement and remand for
further consideration. We affirm the preliminary injunction
with respect to the four challenged data use restrictions and
the dark patterns restriction.
A. NetChoice is not likely to succeed on the
merits of its facial challenge to the age
estimation requirement.
The CAADCA requires covered businesses to
“[e]stimate the age of child users with a reasonable level of
certainty appropriate to the risks that arise from the data
management practices of the business or apply the privacy
and data protections afforded to children to all consumers.”
Id. § 1798.99.31(a)(5). Before the district court, NetChoice
challenged this requirement as facially invalid in all
applications. The district court rejected the State’s argument
that “estimating a user’s age is conduct, not expressive
activity,” finding that the requirement that businesses do so
“for the purpose of determining what content is appropriate
for [children of different] age[s] . . . imposes limits on the
28 NETCHOICE, LLC V. BONTA
content a covered business may publish and the content each
user may view.” The district court applied strict scrutiny
and, because it found that age estimation “will require
businesses to collect private information that users may not
wish to share,” concluded that the State had not “met its
burden to show that age estimation furthers its interest in the
privacy and well-being of children.” The district court
further held that the State failed to offer any evidence that
there were no less restrictive alternatives. As for the Moody
analysis, the district court found that “the provision will
impose the same barriers to speech on all covered businesses
and their audiences” and that, “because all applications of
§ 1798.99.31(a)(5) will impose barriers to protected speech,
the provision has no legitimate sweep.”
On appeal, the State maintains that the age estimation
requirement does not trigger First Amendment scrutiny and
that, though the requirement “triggers the Act’s other
substantive provisions for a particular user,” any impact on
expressive activity “is the result of the other substantive
provisions in the Act, not the age estimation requirement.”
The State further contends that even if the First Amendment
applies, the age estimation provision is not content based
and, in any event, that it furthers the State’s compelling
interest in protecting children’s privacy and is sufficiently
tailored to that goal.
On the record before us, we cannot say that the age
estimation requirement facially violates the First
Amendment at all, much less in a substantial majority of its
applications. For one, it is unclear that the age estimation
requirement prevents access to content. The provision
requires covered businesses to either “[e]stimate the age of
child users with a reasonable level of certainty” or “apply the
privacy and data protections afforded to children to all
NETCHOICE, LLC V. BONTA 29
consumers.” Id. § 1798.99.31(a)(5). On appeal, NetChoice
repeats the district court’s framing of the provision as
“requiring a business to estimate age for the purpose of
determining what content is appropriate for that age,” but the
provision says nothing about restricting content on its face.
See NetChoice I, 113 F.4th at 1122
(observing that “most of [the provisions NetChoice challenges],” including the age estimation provision, “by their plain language, do not necessarily impact protected speech in all or even most applications”). Rather, it requires covered businesses to apply the Act’s privacy and data protections—“half of which,” the State points out, “are not even challenged by NetChoice in this suit.” The provision is clear that businesses that do not wish to conduct age estimation may publish any content they would like, as long as they default to data and privacy protections for all users.Cal. Civil Code § 1798.99.31
(a)(5). We are therefore not convinced that the
age estimation provision necessarily burdens protected
expression on its face by requiring covered businesses to
determine “what content is appropriate” for children.
NetChoice’s reading of Free Speech Coalition v. Paxton,
606 U.S. 461
(2025), also does not persuade. Free Speech
Coalition considered a statute that required covered entities
to make adult website visitors submit to an age verification
system using either “government-issued identification” or “a
commercially reasonable method that relies on public or
private transactional data.” Id. at 467 (quoting Tex. Civ.
Prac. & Rem. Code § 129B.003(b)(2)). The Supreme Court
observed only that, with respect to that system, there is an
“incidental burden that age verification necessarily has on an
adult’s First Amendment right to access speech that is
obscene only to minors.” Id. at 495. The Court said nothing
about the effect of age estimation on First Amendment
30 NETCHOICE, LLC V. BONTA
burdens generally, especially where age estimation is not
required as a precondition to access content. To the contrary,
the Court observed that “adults have no First Amendment
right to avoid age verification, and the [challenged law] can
readily be understood as an effort to restrict minors’ access.”
Id. at 483.
To the extent NetChoice argues that the age estimation
requirement “require[s] consideration of content or proxies
for content,” see NetChoice I, 113 F.4th at 1118
, the age estimation requirement may impliedly regulate speech—but we cannot confidently draw that conclusion on this record, either. Recall that the age estimation provision requires “[e]stimat[ing] the age of child users with a reasonable level of certainty appropriate to the risks that arise from the data management practices of the business[.]”Cal. Civ. Code § 1798.99.31
(a)(5) (emphasis added). The DPIA report provision that we enjoined in NetChoice I also required covered businesses to assess “the risks of material detriment to children that arise from the data management practices of the business” and required DPIA reports to address several factors, “to the extent applicable,” including product design, algorithms, automatic playing of media, and harmful content on the platform.Id.
§ 1798.99.31(a)(1)(B) (emphasis
added).
We determined in NetChoice I that the “DPIA report
requirement regulates the speech of covered businesses and
thus triggers review under the First Amendment,” and we
explained that the enumerated “factors require consideration
of content or proxies for content.” 113 F.4th at 1118
. We rejected the State’s argument that the DPIA report requirement “contains no reference to content” but rather “requires a company to mitigate risks from its data management practices.”Id.
(emphases omitted). That was
NETCHOICE, LLC V. BONTA 31
because Ҥ 1798.99.31(a)(2) specifically defines data
management practices by reference to the statutory factors a
covered business must address under [the DPIA report
requirement] when assessing those risks.” Id.
To the extent the term “data management practices” in
the age estimation provision is also defined by the statutory
factors in § 1798.99.31(a)(1)(B), NetChoice may have a
reasonable argument that the age estimation provision
triggers review under the First Amendment. On the other
hand, § 1798.99.31(a)(2) specifically refers to “data
management practices of the business identified in the
[DPIA] required by [§ 1798.99.31(a)(1)],” while the age
estimation requirement does not cross reference
§ 1798.99.31(a)(1). It is therefore not certain whether “data
management practices” takes on its plain meaning with
respect to age estimation or whether it impliedly cross-
references the statutory factors in § 1798.99.31(a)(1)(B)—
which we have read to trigger First Amendment review.
The parties do not develop these arguments, and the
district court did not address this precise question.
Accordingly, we vacate the preliminary injunction as to the
age estimation provision and remand to the district court to
consider this question in the first instance. However, we also
emphasize that § 1798.99.31(a)(5) allows a covered business
to avoid age estimation altogether if it defaults to “apply[ing]
the privacy and data protections afforded to children to all
consumers.” On remand, the parties and the district court
may wish to consider the effect of that opt-out language on
any burden on expression that may arise from the age
estimation requirement.
We also remand for further consideration of the age
estimation provision in light of Moody. In what must now
32 NETCHOICE, LLC V. BONTA
sound a familiar refrain, “the record needs further
development to allow the district court to determine ‘the full
range of activities the law[] cover[s].’” NetChoice I, 113 F.4th at 1123
(alterations in original) (quoting Moody,603 U.S. at 724
). In NetChoice I, we made that clear with respect to the CAADCA’s age estimation requirement specifically. Seeid.
at 1122–23.
In this appeal, there was no detailed record that would
have allowed the district court to consider how the age
estimation provision works in “all of its applications” in
order to address its scope, including with respect to the term
“data management practices.” Moody, 603 U.S. at 744
(emphasis added); see also NetChoice SB 976, 152 F.4th at 1021–22. Courts must be able to “carefully parse not only what entities are regulated, but how the regulated activities actually function before deciding if the activity in question constitutes expression and therefore comes within the First Amendment’s ambit.” Moody,603 U.S. at 749
(Jackson, J.,
concurring in part and concurring in the judgment). Absent
a developed record on the various applications of the age
estimation requirement—including applications that do not
prevent access to content or require data collection for
compliance—NetChoice cannot succeed on this facial
attack. Likewise, the district court erred by assuming that
the only way covered businesses could comply with the
provision is by “collect[ing] private information that users
may not wish to share,” resulting in
“businesses . . . gather[ing] and creat[ing] a trove of
sensitive data regarding children.” The State put forth
evidence of methods for conducting age estimation that
would be acceptable under § 1798.99.31(a)(5) and would
require no additional data collection. The district court’s
NETCHOICE, LLC V. BONTA 33
discussion of the State’s evidence was limited and did not
address this point.
Consequently, we cannot determine, from our appellate
posture, whether the age estimation requirement facially
violates the First Amendment. We vacate the preliminary
injunction as to Cal. Civ. Code § 1798.99.31
(a)(5).
B. NetChoice is likely to succeed on the merits of
its vagueness challenges to the CAADCA’s
data use restrictions and dark patterns
restriction.
We turn next to the preliminary injunction as to the
CAADCA’s data use restrictions and the dark patterns
restriction on constitutional vagueness grounds. “A
fundamental principle in our legal system is that laws which
regulate persons or entities must give fair notice of conduct
that is forbidden or required.” FCC v. Fox Television
Stations, Inc., 567 U.S. 239, 253
(2012). That principle “requires the invalidation of laws that are impermissibly vague.”Id.
“A statute can be impermissibly vague . . . if it fails to provide people of ordinary intelligence a reasonable opportunity to understand what conduct it prohibits” or “if it authorizes or even encourages arbitrary and discriminatory enforcement.” Hill,530 U.S. at 732
; accord Matsumoto v. Labrador,122 F.4th 787, 805
(9th Cir. 2024). When “vagueness permeates the text” of a law, “it is subject to facial attack.” City of Chicago v. Morales,527 U.S. 41, 55
(1999) (plurality opinion). And “[w]hen speech is involved,
rigorous adherence to [the void for vagueness doctrine] is
necessary to ensure that ambiguity does not chill protected
speech.” Fox Television, 567 U.S. at 253–54.
34 NETCHOICE, LLC V. BONTA
1. Data Use Provisions
The challenged data use provisions restrict the ways in
which, and for what purposes, covered businesses may
use a child’s personal information. Cal. Civ. Code § 1798.99.31
(b)(1)–(4). The relevant provisions state:
(b) A business that provides an online
service, product, or feature likely to be
accessed by children shall not take any of the
following actions:
(1) Use the personal information of any child
in a way that the business knows, or has
reason to know, is materially detrimental
to the physical health, mental health, or
well-being of a child.
(2) Profile a child by default unless both of
the following criteria are met:
(A) The business can demonstrate it has
appropriate safeguards in place to
protect children.
(B) Either of the following is true:
(i) Profiling is necessary to provide
the online service, product, or
feature requested and only with
respect to the aspects of the online
service, product, or feature with
which the child is actively and
knowingly engaged.
(ii) The business can demonstrate a
compelling reason that profiling
is in the best interests of children.
NETCHOICE, LLC V. BONTA 35
(3) Collect, sell, share, or retain any personal
information that is not necessary to
provide an online service, product, or
feature . . . unless the business can
demonstrate a compelling reason that the
collecting, selling, sharing, or retaining of
the personal information is in the best
interests of children likely to access the
online service, product, or feature.
(4) If the end user is a child, use personal
information for any reason other than a
reason for which that personal
information was collected, unless the
business can demonstrate a compelling
reason that use of the personal
information is in the best interests of
children.
Id.
(emphases added).
NetChoice challenged these provisions for their reliance
on the undefined terms “material detriment,” “best
interests,” and “well-being.” The district court agreed with
NetChoice and concluded that these “terms have no
established meaning and the CAADCA provides no
guidance.” It explained that reasonable minds can disagree
on what might be detrimental to a child’s health or well-
being and rejected the State’s argument that the “best
interests” of a child should be understood similarly to the
same “legal term of art that is well-established in family
law.”
The State contends that “material detriment” and
“physical health, mental health, or well-being” each have an
36 NETCHOICE, LLC V. BONTA
accepted plain meaning such that, taken together, the phrase
means that “it causes meaningful harm to a child’s physical
state, mental state, or overall condition of health and
happiness.” The State cites examples like “using a child’s
information to connect them to a person that seeks to abuse
the child, such as through sexploitation,” or “[u]sing a
child’s information to recommend illegal products such as
tobacco, alcohol, or gambling[.]” But these are extreme
examples at the margins of what might be materially
detrimental to a child’s well-being. The more difficult
questions arise with examples like sleep loss, distraction, or
hurt feelings. As the district court reasoned, and NetChoice
argues on appeal, the CAADCA does not provide any
guidance as to the breadth of conduct that “material[]
detriment[] to the physical health, mental health, or well-
being of a child” may reach. Cal. Civ. Code § 1798.99.31
(b)(1). And NetChoice persuasively argues that the risk of subjective enforcement is particularly high because, as it contemplates “material detriment” to “a child,” the provision must be assessed as to any single child whose personal information is accessed by a covered online practice. Cf. NetChoice I,113 F.4th at 1120
(observing that
the DPIA requirement “that covered businesses opine on
whether their services risk ‘material detriment to children’”
is “vague and onerous”).
The State next maintains that the term “best interests of
children” should be understood in accordance with
California’s standard “to determine child custody
arrangements, to make guardianship decisions, and in
delinquency proceedings.” Though, as the district court
recognized, the “best interests of the child” standard is clear
for the purpose of family law proceedings, the State does not
persuasively explain why that case-by-case standard
NETCHOICE, LLC V. BONTA 37
translates to data privacy regulation. On the contrary, the
State’s reading is incompatible with the data use restrictions’
apparent goals. When evaluating the “best interests of the
child” in family law proceedings, California courts
recognize that “bright line rules in this area are
inappropriate” and that “each case must be evaluated on its
own unique facts.” In re Marriage of LaMusga, 88 P.3d 81, 91
(Cal. 2004) (citation modified). The standard operates through a specific child’s circumstances and factual record. Seeid.
The data use restrictions ask something categorically different: covered businesses must determine prospectively whether a given practice is in “the best interests of” not any one child but “children”—a class of users that includes every child anywhere who can access a covered online practice.Cal. Civ. Code § 1798.99.31
(b)(1)–(4) (emphasis added). Then covered businesses must tailor their practice accordingly. Applied at that scale, without the individualized, highly specific factual record giving the standard meaning in contexts such as a family law case, “best interests of children” cannot provide “sufficient notice of what is proscribed,” Fox Television,567 U.S. at 254
.
The State’s argument that the provision’s scienter
requirement mitigates vagueness is not persuasive. To be
sure, “a scienter requirement may mitigate a law’s
vagueness, especially with respect to the adequacy of notice
to the complainant that his conduct is proscribed.” Vill. of
Hoffman Estates v. Flipside, Hoffman Estates, Inc., 455 U.S. 489, 499
(1982); see also Hill,530 U.S. at 732
. But “[t]he degree of vagueness that the Constitution tolerates” also “depends in part on the nature of the enactment.” Vill. of Hoffman Estates,455 U.S. at 498
. The critical flaw of the restriction here is that the “what [that] must be proven is . . . vague.” United States v. Jae Gab Kim,449 F.3d 933
, 38 NETCHOICE, LLC V. BONTA 943 (9th Cir. 2006). Put another way, the “reason to know” language cannot mitigate vagueness where what is “materially detrimental” to any single child’s “well-being” is not clear.Cal. Civ. Code § 1798.99.31
(b)(1).
The State contends that “reason to know” is frequently
defined to mean “[i]nformation from which a person of
ordinary intelligence . . . would infer that the fact in question
exists or that there is a substantial enough chance of its
existence that, if the person exercises reasonable care, the
person can assume the fact exists.” Reason To Know,
BLACK’S LAW DICTIONARY (12th ed. 2024); see also, e.g.,
RESTATEMENT (SECOND) OF TORTS § 12 (1965). And
because a business of ordinary intelligence could “base [its]
behavior on [its] factual knowledge of the situation at hand
and thereby avoid violating the law,” the argument goes, the
data use prohibitions are clear as to the scope of conduct they
regulate. Jae Gab Kim, 449 F.3d at 943
. But as written, it is not sufficient for a covered business “to be aware only of the objective facts that would fairly put [it] on notice of the use for which” child user data is utilized. Cf. Stoianoff v. Montana,695 F.2d 1214, 1221
(9th Cir. 1983) (describing the effect of a “reasonably should know” mens rea element in a Montana drug paraphernalia statute); Jae Gab Kim,449 F.3d at 943
(“Whether a defendant is guilty of having ‘reasonable cause to believe’ that pseudoephedrine [in the defendant’s possession] will be used to produce illicit drugs [in violation of21 U.S.C. § 841
(c)(2)] turns on the facts actually known by the defendant in a particular case.” (citation modified)). The structure of the provision is clear: its mens rea element applies to a covered business’s knowledge that the use of the personal information of a child would cause a particular child material harm.Cal. Civ. Code § 1798.99.31
(b)(1). Absent any statutory guidance on the
NETCHOICE, LLC V. BONTA 39
meaning of “material[] detriment[],” the provision’s scienter
requirement does not solve its vagueness.
2. Dark Patterns Restriction
The parties make similar arguments respecting the
CAADCA’s dark patterns restriction. That provision
prohibits covered businesses from:
Us[ing] dark patterns to lead or encourage
children to provide personal information
beyond what is reasonably expected to
provide that online service, product, or
feature to forego privacy protections, or to
take any action that the business knows, or
has reason to know, is materially detrimental
to the child’s physical health, mental health,
or well-being.
Cal. Civ. Code § 1798.99.31
(b)(7) (emphases added).
The district court found this provision unconstitutionally
vague because it does not provide any guidance to covered
businesses regarding when they would have “reason to
know” that their user interface will have a “materially
detrimental” effect on a child’s health or well-being. On
appeal, the State argues that “dark patterns” is a defined term
in the CAADCA 9; that the phrase “materially detrimental to
the child’s physical health, mental health, or well-being” has
a clear, plain language meaning; and that the provision’s
mens rea requirement—that the business had “reason to
9
The Act incorporates a definition of a “dark pattern” as “a user interface
designed or manipulated with the substantial effect of subverting or
impairing user autonomy, decisionmaking, or choice, as further defined
by regulation.” Cal. Civ. Code § 1798.140
(l);id.
§ 1798.99.30(a).
40 NETCHOICE, LLC V. BONTA
know” its design choice would cause material harm to a
child’s well-being—mitigates against vagueness.
As with the data use restrictions, the State’s plain-
meaning argument is unconvincing where the range of harms
that could plausibly qualify as “materially detrimental” is
vast, spanning everything from financial exploitation to
sleep loss, distraction, or hurt feelings. The fact that “dark
pattern” is a defined term in the CAADCA does not help a
covered business distinguish between these harms. And the
prohibition’s use of the singular “child,” like in the data use
restrictions, suggests that it is actionable based on a single
child’s response to an online interface, meaning that a
business designing a product accessed by millions of child
users could face liability whenever any one of them
experiences a harm that a regulator deems “material.” See
Cal. Civ. Code § 1798.99.31
(b)(7). Businesses of ordinary intelligence cannot reliably determine what compliance requires. See Grayned v. City of Rockford,408 U.S. 104, 108
(1972). The “reason to know” scienter requirement also cannot cure this vagueness. The State argues that the restriction does not require a covered business “to figure out if a particular user interface will harm a child” but merely directs the covered business to “act in accordance with its existing knowledge”; in other words, “[w]hen a business lacks knowledge of any harm, the restriction does not apply.” But the “reason to know” language here applies to a covered business’s knowledge that “any action” it takes utilizing dark patterns would cause a particular child material harm. SeeCal. Civ. Code § 1798.99.31
(b)(7). Absent statutory guidance on the meaning of “material[] detriment[],” the provision remains vague. Seeid.
We therefore affirm the district court’s injunction with
respect to the data use and dark patterns restrictions on
NETCHOICE, LLC V. BONTA 41
vagueness grounds. “A fundamental requirement of due
process is that a statute must clearly delineate the conduct it
proscribes.” Foti v. City of Menlo Park, 146 F.3d 629, 638
(9th Cir. 1998) (citation modified). These provisions do not
do so.
III. It remains unclear whether the notice-and-cure
provision is severable from the CAADCA’s valid
remainder.
We turn next to severability. Specifically, the parties
dispute whether the remaining, valid provisions of the
CAADCA are separable from the notice-and-cure provision
we enjoined in NetChoice I. That provision would have
required a noncompliant business to “cure[] any noticed
violation and provide[] the Attorney General a written
statement that the alleged violations have been cured, and
sufficient measures have been taken to prevent future
violations” within 90 days of written notice of the alleged
violation from the Attorney General. Cal. Civ. Code § 1798.99.35
(c)(2). In NetChoice I, we affirmed the district court’s severability analysis to the extent that it enjoined § 1798.99.35(c) on the basis that it was not grammatically severable from the DPIA report requirement.113 F.4th at 1125
; accord NetChoice, 692 F. Supp. 3d at 960–61.
Severability of a state statute is governed by state law.
See Vivid Ent., LLC v. Fielding, 774 F.3d 566, 574
(9th Cir. 2014). Under California law, an invalid statutory provision may be severed if the invalid provision is “grammatically, functionally, and volitionally separable.” Cal. Redevelopment Ass’n v. Matosantos,267 P.3d 580, 607
(Cal. 2011) (quoting Calfarm Ins. Co. v. Deukmejian,48 Cal.3d 805, 821
(1989) (en banc)). The parties dispute only
volitional severability.
42 NETCHOICE, LLC V. BONTA
“Volitional separability depends on whether the
remainder would have been adopted by the legislative body
had the latter foreseen the partial invalidation of the statute.”
Id. at 608 (citation modified). While the presence of a
severability clause “establishes a presumption in favor of
severance,” id. at 607, “the absence of such a clause is not
conclusive,” Cnty. of Sonoma v. Superior Ct., 173 Cal. App. 4th 322, 352
(2009). The California Supreme Court has explained that “[t]he issue, when assessing volitional separability, is not whether a legislative body would have preferred the whole to the part,” but “whether a legislative body, knowing that only part of its enactment would be valid, would have preferred that part to nothing.” Matosantos,267 P.3d at 609
. Accordingly, even where “the full purpose” of a statute “cannot be realized” due to an invalid provision, courts may reasonably suppose “that those who favored the [statute] would be happy to achieve at least some substantial portion of [its] purpose.” Santa Barbara Sch. Dist. v. Superior Court,530 P.2d 605, 618
(Cal. 1975) (en banc). Thus, the question is whether the notice-and-cure provision is “so critical to the enactment of [the CAADCA] that the [statute] would not have been enacted in its absence.” Calfarm Ins.,771 P.2d at 1256
; see Acosta v. City of Costa Mesa,718 F.3d 800
, 818–19 (9th Cir. 2013) (per curiam) (concluding that invalid provision was not volitionally severable because doing so “would [] leave an ordinance that no longer prohibits the speech the City intended it to prohibit”); see also Metromedia, Inc. v. City of San Diego,649 P.2d 902, 909
(Cal. 1982) (en banc)
(declining to sever portions of a statute where severance
would “leave the city with an ordinance different than it
intended, one less effective in achieving the city’s goals”).
Put another way, the district court must consider whether
NETCHOICE, LLC V. BONTA 43
“the legislature would have wanted the benefits accorded in
[the CAADCA’s valid] provisions to remain.” Katz v.
Children’s Hosp. of Orange Cnty., 28 F.3d 1520, 1532
(9th
Cir. 1994).
The district court agreed with NetChoice that the Act’s
remaining provisions were not volitionally severable from
the enjoined DPIA provisions. The district court credited
NetChoice’s evidence of the importance of the notice-and-
cure provision to the passage of the CAADCA. It noted that
the “legislature was presented with multiple versions of the
bill omitting the notice and cure provision, and even a
version including a shorter 45-day notice and cure period”
but that the CAADCA was not passed “until the 90-day safe
harbor was included.” Thus, the district court could not
“find that the DPIA provisions, including the safe harbor
provision, were not of critical importance to the [Act’]s
enactment.”
Today, we find ourselves in much the same position as
we were in NetChoice I. That is, at this stage of the
litigation, we cannot determine whether the CAADCA’s
remaining provisions are volitionally severable from the
enjoined 90-day cure period. We therefore vacate the district
court’s preliminary injunction as to the CAADCA’s
remaining provisions.
To start, while NetChoice asserts that the CAADCA’s
omission of a severability clause “raises a presumption of
inseverability,” the California Supreme Court has repeatedly
made clear that neither the presence nor the absence of a
severability clause is conclusive. See, e.g., Gerken v. Fair
Pol. Pracs. Comm’n., 863 P.2d 694, 698
(Cal. 1993) (en banc); Santa Barbara Sch. Dist.,530 P.2d at 618
; 44 NETCHOICE, LLC V. BONTA Legislature v. Eu,816 P.2d 1309, 1335
(Cal. 1991) (en
banc).
NetChoice also fails to establish, at this preliminary
stage of the litigation, that eliminating the notice-and-cure
provision transforms the CAADCA from a regulatory
scheme focused on compliance to a “punitive, strict liability
regime.” It is unclear from the record that the CAADCA
necessarily works that way. Absent the notice-and-cure
provision, the Act imposes a civil penalty of up to $2,500
“per affected child for each negligent violation” or up to
$7,500 “per affected child for each intentional violation,”
recoverable only through a civil action brought by the
Attorney General. Cal. Civ. Code § 1798.99.35
(a). The State may thus pursue compliance by enforcing both negligent and intentional violations, each of which would ostensibly require the State to prove negligence or intent, respectively. But because the parties do not develop these arguments, we again cannot say whether “elimination of the 90-day cure period affects whether provisions concerning the Attorney General’s civil enforcement of valid sections of the CAADCA are volitionally severable.” NetChoice I,113 F.4th at 1125
.
Moreover, the district court overstates the import of the
chronology of the Act’s passage. As NetChoice notes, the
legislature referred a version of the draft bill that did not
contain a notice-and-cure provision to the “suspense file” on
August 1, 2022. The bill was amended on August 11, 2022,
to add a 45-day cure period and revised again on August 22,
2022, to include the presently enjoined 90-day cure period.
But these revisions also included amendments to other
substantive provisions, including the age estimation
requirement and dark patterns restriction at issue in this
appeal, as well as provisions exempting broadband internet
NETCHOICE, LLC V. BONTA 45
services, telecommunications services, and physical
products from the Act’s coverage. The district court itself
recognized that the bill underwent several rounds of
“substantial changes.” And, as the State argues on appeal,
NetChoice does not demonstrate that the 90-day cure period
was the reason the bill was ultimately passed.
On the other hand, the district court may have
underweighted the State’s evidence. The State argues that
the Act’s findings make clear that “companies should
prioritize the privacy, safety, and well-being of children” and
that “children should be afforded protections” by both online
services “specifically directed at them” and “all
online . . . services they are likely to access.” Cal. Civ. Code § 1798.99.29
; see also Ohio House, LLC v. City of Costa Mesa,135 F.4th 645, 677
(9th Cir. 2025) (holding invalid provision volitionally severable under California law by looking to regulation’s “purpose provision”); People v. Nguyen,222 Cal. App. 4th 1168, 1193
(2014) (looking to
ordinance’s “purpose and intent section”). The legislative
history also repeatedly emphasizes that the CAADCA is
distinct from other “[f]ederal and state efforts to protect
children online” because those statutes “permit online
platforms to treat all consumers as adults unless there is
actual knowledge that a consumer is a child” and therefore
do not “offer the highest privacy protections by design and
by default.” Cal. A.B. No. 2273, at 5 (2022) (Comm. on
Privacy & Consumer Prot. Rep.). The legislature may have
understood the CAADCA to fill that regulatory gap by
ensuring covered businesses default to the highest privacy
protections. But we are unable to determine on this record
whether the legislature considered the notice-and-cure
provision necessary to achieving that goal.
46 NETCHOICE, LLC V. BONTA
Accordingly, we vacate the district court’s determination
that the notice-and-cure provision is not volitionally
severable from the CAADCA’s valid remainder, and we
remand for further proceedings consistent with this opinion.
CONCLUSION
For the foregoing reasons, we AFFIRM the district
court’s preliminary injunction insofar as it enjoined
enforcement of California Civil Code §§ 1798.99.31(b)(1)–
( 4) and 1798.99.31(b)(7), and VACATE the remainder of
the preliminary injunction. 10 Both parties shall bear their
own costs on appeal. See Fed. R. App. P. 39(a)(4).
10
We do not reach NetChoice’s alternative grounds for affirming the
district court’s preliminary injunction. See NetChoice I, 113 F.4th at 1126
n.9.