In a major victory for free speech and digital rights, the 9th US Circuit Court of Appeals has ruled that key parts of California’s Age-Appropriate Design Code Act (AADC) are unconstitutional under the First Amendment.

The decision deals a significant blow to the state’s efforts to regulate online content and data collection in the name of child protection.

The AADC, signed into law by Governor Gavin Newsom in 2022, aimed to create new requirements for websites, apps, and online services that are “likely to be accessed by children.”

Among its most controversial provisions was a mandate that these companies conduct “Data Protection Impact Assessments” (DPIAs) to evaluate whether their platforms could expose minors to harmful content and then implement plans to “mitigate” those risks.

NetChoice Led the Pack to Oppose AADC

A group of companies that disagreed with these legal provisions, led by the trade group NetChoice, argued that the AADC’s DPIA requirement amounted to unconstitutional compelled speech, forcing companies to make subjective judgments about what kind of content qualifies as “harmful” to children.

They also claimed that the law would turn online platforms into “roving censors” for the state.

Also read: Marketing to Kids? Mind the New Children’s Online Privacy Protection Act (COPPA) Provisions

In its Friday ruling, the 9th Circuit panel agreed with this view, finding the DPIA provision a highly likely violation of the US Constitution’s First Amendment.

“The DPIA report requirement clearly compels speech by requiring covered businesses to opine on potential harm to children,” wrote Circuit Judge Milan Smith for the court. “It is well-established that the First Amendment protects ‘the right to refrain from speaking at all.'”

The appeals court rejected California’s argument that the DPIA reports’ confidential status meant that they did not constitute compelled speech. It also dismissed the state’s claim that the law was about regulating conduct, not speech.

“The only way to truly comply with the law was to suppress speech that politicians might later deem harmful to children,” the court concluded.

Applying the highest level of First Amendment scrutiny, the 9th Circuit determined that the DPIA mandate was not narrowly tailored to achieve California’s goal of protecting children. The judges pointed to less restrictive alternatives such as incentivizing companies to offer voluntary content filters or educating children and parents on the importance of using such tools.

“Requiring ‘the forced creation and disclosure of highly subjective opinions about content-related harms to children is unnecessary for fostering a proactive environment in which companies, the state and the general public work to protect children’s safety online,” the court wrote.

While the 9th Circuit left the rest of the AADC’s provisions open for further review by the lower court, its ruling on the DPIA requirement represents a major victory for tech companies and digital rights advocates.

“This is a victory for free expression, online security and Californian families,” said Chris Marchese, director of the NetChoice Litigation Center.

Tech Policy Experts Criticized the AADC from the Get-Go

California’s AADC was modeled after a similar law passed in the United Kingdom and was promoted as a necessary measure to shield young internet users from harmful and exploitative content.

The law’s key provisions included:

  • Requiring online services to estimate the age of their users and apply increased privacy and safety protections for anyone deemed a child (defined as individuals of ages 0 to 18).
  • Banning the collection of precise geolocation data from children without compelling reason and parental consent.
  • Prohibiting the use of “dark patterns” – deceptive user interface designs intended to manipulate users.
  • Mandating the creation of DPIAs to assess the risks that certain features could pose to children and draft plans to mitigate those risks.

Violations of the AADC could result in civil fines of up to $2,500 per child per negligent infraction or $7,500 per child for intentional violations.

Critics argued that the law was overly broad, vague, and threatened to stifle online speech and innovation. They warned that it would force companies to preemptively censor content to avoid being held liable by parents and advocacy groups despite a lack of evidence that these practices were actually targeting or harming minors intentionally.

Also read: New York Passes Bill to Protect Kids From Social Media Targeting – Here’s What’s Changing

“The Baroness and the California legislators (who seem oddly deferential to her) tried to get around the obvious First Amendment issues by insisting that the bill was about conduct and design and not about speech. But as we pointed out, that was obviously a smokescreen,” wrote tech policy expert Mike Masnick in a blog post prior to the 9th Circuit ruling.

governor gavin newsom says that the court still favors aadc

The state of California maintained that the law was a necessary and lawful measure to protect young internet users. In a statement following the 9th Circuit’s decision, Governor Newsom said the court had “largely sided” with the state and urged NetChoice to “drop this reckless lawsuit.”

Ninth Circuit’s Ruling Opens Up the Door for Alternatives to Protect Children Online

While the 9th Circuit left the rest of the AADC’s provisions open for further review, it did provide some guidance for how California could craft privacy-focused laws that may withstand constitutional challenges.

The court noted that requirements for businesses to disclose factual information about their data practices without forcing them to make subjective judgments about content may be permissible under the First Amendment.

“A DPIA report requirement that compels businesses to measure and disclose to the government certain types of risks potentially created by their services might not create a problem,” the court wrote.

“The problem here is that the risk that businesses must measure and disclose to the government is the risk that children will be exposed to disfavored speech online.”

With the DPIA requirement now blocked, the AADC cannot currently be enforced. California may still choose to appeal the 9th Circuit’s ruling and take it up all the way to the Supreme Court. In the meantime, the case will return to the district court for further proceedings on the law’s remaining provisions.