Ninth Circuit Issues Mixed Ruling on California Age-Appropriate Design Code Act

The U.S. Court of Appeals for the Ninth Circuit has issued its long-awaited decision in NetChoice v. Bonta, addressing the California Age-Appropriate Design Code Act (CAADCA) for the second time on appeal.

The court delivered a split ruling, finding the district court misapplied the U.S. Supreme Court's framework for First Amendment facial challenges from Moody v. NetChoice, LLC (2024) when enjoining the entire statute and its age-estimation requirement. However, the court upheld the injunction against certain data-use and dark-patterns restrictions on constitutional vagueness grounds.

A detailed view of the status of the obligations set forth in the CAADCA's terms is included below.

Background

The California legislature enacted the CAADCA in 2022 to protect children's "privacy, safety, and well-being" online. The law applies to businesses offering online services, products, or features "likely to be accessed by children" (under age 18).

It imposes both affirmative obligations (e.g., default privacy settings) and prohibitions (e.g., limiting collection of children's personal information to what is necessary). Many provisions turn on whether product operations could cause potential harm to children. For example, the law prohibits using personal information in ways "materially detrimental to the physical health, mental health, or well-being of a child."

NetChoice, a trade association, challenged the law, and a district court initially enjoined it on First Amendment grounds. In 2024, the Ninth Circuit affirmed the injunction as to the law's requirement that in-scope businesses conduct data protection impact assessments (DPIAs) but vacated the remainder, remanding for further analysis under the Moody framework.

On remand, the district court again issued a preliminary injunction applicable to the statute in full based on the scope of the CAADCA's coverage definition. In the alternative, it enjoined seven specific provisions of the CAADCA: the age estimation requirement,  certain data use restrictions and dark patterns restriction. California appealed, leading to the March 12, 2026, Ninth Circuit decision.

The Court's Analysis

In its most recent decision, the Ninth Circuit vacated the district court's injunction as applied to the entire statute and, specifically, its age-estimation feature:

• Coverage Definition (Cal. Civ. Code § 1798.99.30(b)(4)). NetChoice argued the CAADCA's definition of covered businesses (those providing services "likely to be accessed by children") inherently requires content evaluation, rendering the entire law unconstitutional. The Ninth Circuit disagreed. The court found that the definition uses six separate indicators, some of which, like audience demographic data, do not require examining content at all. Importantly, only one indicator needs to be satisfied for coverage, and the law can apply to ride-sharing services, ticketing platforms, financial apps and other noncontent businesses. It further found that NetChoice failed to develop the factual record required by Moody to show how the law applies across its full range of applications.
• Age Estimation (Cal. Civ. Code § 1798.99.31(a)(5)). This provision requires businesses to either estimate user ages "with a reasonable level of certainty" or apply CAADCA protections to all users. The court found NetChoice was unlikely to succeed on its facial challenge because the provision does not clearly restrict content or speech – businesses can simply default to child-protective settings for everyone. However, the court noted the provision could prove unconstitutional if it requires evaluating "data management practices" similar to those in the previously struck-down DPIAs.
• Severability. The court also held that the district court's severability determination – which would have invalidated the entire statute – was premature.

While lifting the injunction against the statute as a whole, the court affirmed the injunction as it applies to data use restrictions (Section 1798.99.31(b)(1)-(4)) and dark patterns restrictions (Section 1798.99.31(b)(7)).

The court found that key statutory terms at issue in these provisions – "materially detrimental," "best interests" and "well-being" – are unconstitutionally vague because they fail to give businesses fair notice of what conduct is prohibited.

The court also concluded that definitions for terms such as the "best interest" of a child could not be imported from family law proceedings, which were "incompatible" with the statute's "apparent goals."

Impact on Other Efforts to Regulate Kids' Safety Online

The CAADCA is one of several recently enacted age-appropriate design code laws (AADC) and other statutes intended to protect children online, many of which are subject to First Amendment-based challenges.

NetChoice itself has brought actions against three AADC, including laws in Maryland and most recently South Carolina. Some of these laws include terms similar to those enjoined by the Ninth Circuit, and so the Ninth Circuit's holding is likely to provide persuasive authority.

The Maryland AADC, for example, requires that covered online services ensure the "best interests of children" users of the products, a phrase determined to be unconstitutionally vague by the Ninth Circuit.

What's Next

This litigation is far from over. If NetChoice chooses to proceed, the Ninth Circuit left open several avenues for further challenge:

• develop the factual record around how the CAADCA applies across all covered businesses, as instructed by Moody
• argue that the enjoined terms are not severable from the rest of the statute
• assert that age estimation would require the business to evaluate content-based factors similar to those considered impermissible for DPIAs due to the law's requirement to take into account "the risks that arise from the data management practices of the business"

The following table outlines the legal status of the CAADCA's substantive requirements under Section 1798.99.31 at present:

Subject to Preliminary Injunction

Not Subject to Preliminary Injunction

For more information or questions, please contact the authors.

Information contained in this alert is for the general education and knowledge of our readers. It is not designed to be, and should not be used as, the sole source of information when analyzing and resolving a legal problem, and it should not be substituted for legal advice, which relies on a specific factual analysis. Moreover, the laws of each jurisdiction are different and are constantly changing. This information is not intended to create, and receipt of it does not constitute, an attorney-client relationship. If you have specific questions regarding a particular fact situation, we urge you to consult the authors of this publication, your Holland & Knight representative or other competent legal counsel.