The challenge of safeguarding children online has become a pressing issue as technology continues to advance. Governments worldwide are striving to find ways to protect minors from harmful content while also respecting essential freedoms, such as free speech. The Ninth Circuit Court of Appeals’ recent decision in NetChoice, LLC v. Rob Bonta, Attorney General of California, highlights the complexities involved in regulating the online space to achieve both child protection and the upholding of constitutional rights.

In 2022, California passed the California Age-Appropriate Design Code Act (CAADCA), a law focused on shielding minors from risks associated with online environments. This legislation was part of a broader movement, both within the United States and internationally, aimed at addressing growing concerns about the effects of digital environments on children. The CAADCA was modeled after the United Kingdom’s Age Appropriate Design Code, also known as the “Children’s Code,” which established standards for online services that children under 18 are likely to access. The CAADCA places several obligations on businesses that offer online services, products, or features likely to be accessed by minors. A key requirement is that businesses must conduct Data Protection Impact Assessments (DPIAs), which involve evaluating the risks that their digital services might pose to children, particularly concerning exposure to harmful content. The CAADCA also includes mandates for age verification, default privacy settings that prioritize child safety, and transparency in terms of service and privacy policies tailored to younger users’ understanding. However, the CAADCA’s stringent requirements raised significant concerns within the tech industry, leading to a legal challenge by NetChoice, a national trade association representing major tech companies like Google, Meta, and Amazon. NetChoice argued that the CAADCA’s provisions, particularly those related to DPIAs, infringed on the First Amendment by compelling businesses to express views that could interfere with their editorial discretion and the free flow of information online.

In response to NetChoice’s lawsuit, the United States District Court for the Northern District of California granted a preliminary injunction, halting the enforcement of the CAADCA. The district court ruled that NetChoice was likely to succeed on its claim that the CAADCA violated the First Amendment. Specifically, the court found that the Act’s DPIA requirement amounted to compelled speech, as it forced companies to articulate specific views about what content might be harmful to children—a subjective determination that could result in self-censorship. The district court’s injunction was broad, blocking not just the DPIA requirement but the entire CAADCA. The court reasoned that because the DPIA requirement was essential to the enforcement of the Act, the entire law could not stand without it. This decision sent shockwaves through both legal and tech communities, raising questions about the future of online child protection laws and how these regulations could be reconciled with constitutional protections.

On appeal, the Ninth Circuit Court of Appeals delivered a more detailed ruling. While the court agreed with the district court that the DPIA requirement likely violated the First Amendment, it vacated the broader injunction against the entire Act, concluding that the district court had overstepped by enjoining provisions of the law that did not directly implicate First Amendment concerns.

The central focus of the Ninth Circuit’s analysis was the DPIA requirement, which mandates that businesses assess and mitigate risks to children from their online services. The court found that this requirement compels speech because it forces businesses to express opinions on contentious topics, such as what constitutes harmful content for minors. The First Amendment protects not only the right to speak freely but also the right to refrain from speaking. In this context, compelling businesses to articulate specific viewpoints about online content infringes on their First Amendment rights. The court also pointed out that the DPIA requirement could lead to indirect censorship. By mandating that businesses assess and mitigate potential harms, the CAADCA effectively pressures companies to limit access to certain content or features, thereby curbing the free exchange of ideas. This type of compelled speech, particularly when it involves subjective judgments about content, triggers strict scrutiny—the highest level of judicial review. Under strict scrutiny, a law must serve a compelling state interest and be narrowly tailored to achieve that interest without infringing on constitutional rights. The Judge acknowledged that California has a compelling interest in protecting children online—a point that is hard to dispute given the growing concerns about minors’ exposure to inappropriate or harmful content. However, the court found that the DPIA requirement was not the least restrictive means to achieve this goal. The court suggested that California could have pursued alternative approaches, such as promoting the voluntary use of content filters, providing educational resources to parents and children, or enhancing existing criminal laws to address specific online harms.

The decision to apply strict scrutiny reflects the court’s careful consideration of the implications of compelled speech in the context of online regulation. While protecting children is undoubtedly important, the court emphasized that such protection cannot come at the expense of fundamental constitutional rights, particularly when less restrictive means are available. The Ninth Circuit took issue with the district court’s broad injunction against the entire CAADCA. The appellate court found that the district court had not properly analyzed whether the unconstitutional DPIA requirement could be severed from the rest of the Act. (Severability is a legal principle that allows courts to remove unconstitutional provisions from a law while leaving the rest of the statute intact.) The Court concluded that while the DPIA requirement and closely related provisions should remain enjoined, other sections of the CAADCA that did not directly implicate First Amendment concerns could still be enforced. These include provisions requiring businesses to provide clear privacy information to children, configure default privacy settings for minors, and ensure transparency in terms of service. By vacating the injunction against these provisions, the court allowed parts of the CAADCA to remain in effect, preserving the law’s broader goal of protecting children online. The court remanded the case to the district court to determine whether the remaining challenged provisions of the CAADCA could be enforced without the DPIA requirement and whether those provisions could be severed from the unconstitutional parts of the Act. This remand underscores the complexity of the case and the importance of a careful, provision-by-provision analysis when constitutional challenges are raised.

The Ninth Circuit’s decision carries significant implications for the future of online child protection laws, not just in California but across the United States. As states continue to explore legislative measures to protect children online, this ruling serves as a reminder of the constitutional limits that such laws must respect. One of the key issues highlighted by this case is the difficulty of regulating online content in a way that balances the protection of vulnerable populations with the preservation of free speech. The internet is a vast platform where content is constantly created, shared, and consumed. Laws like the CAADCA aim to impose order on this environment, particularly for children, but achieving this without infringing on constitutional rights is a complex task. The Circuit’s ruling illustrates the tension between state efforts to regulate the internet and the constitutional protections that underpin free expression. As states seek to pass similar laws, they will need to carefully consider how these regulations impact both the providers of online services and the users who rely on them for information and communication.

This case also highlights the crucial role of the judiciary in shaping online policy. Courts are increasingly called upon to evaluate the constitutionality of laws that regulate online spaces, and their decisions have significant implications for the future of internet governance. This underscores the importance of judicial oversight in ensuring that state regulations do not overreach and infringe on fundamental rights. It also raises questions about the appropriate role of state versus federal regulation in the online space. As technology continues to evolve rapidly, there is a growing need for clear and consistent legal frameworks that protect users while respecting constitutional principles. The outcome of this case could influence future legislative efforts at both the state and federal levels, as lawmakers seek to address the complex intersection of technology, privacy, and free speech.

For tech companies, the Ninth Circuit’s ruling provides some relief but also leaves open significant challenges. While the court struck down the DPIA requirement, which was one of the most burdensome aspects of the CAADCA, other provisions of the law remain in effect. Companies will need to continue to navigate these requirements, balancing compliance with the law against the potential for future legal challenges. As states continue to pass laws aimed at regulating online content, companies will need to be prepared to defend against regulations that may compel speech or restrict their editorial discretion. This case may also prompt companies to take a more active role in shaping the legal and regulatory environment, advocating for laws that protect both users and their own constitutional rights.

János Tamás Papp JD, PhD is an assistant professor at Pázmány Péter Catholic University, Hungary, and a legal expert at the Department of Online Platforms of the National Media and Infocommunications Authority of Hungary. He has taught civil and constitutional law since 2015 and became a founding member of the Media Law Research Group of the Department of Private Law. He earned his JD and PhD in Law at the Faculty of Law and Political Sciences of the Pázmány Péter Catholic University. His main research fields are freedom of speech, media law, and issues related to freedom of expression on online platforms. He has a number of publications regarding social media and the law, including a book titled „Regulation of Social Media Platforms in Protection of Democratic Discourses