Internet trade group wins new injunction against California's kids privacy law

(CN) — A federal judge on Thursday issued a new preliminary injunction blocking California’s Age-Appropriate Design Code Act, which aims to protect children’s privacy and safety online, in a lawsuit brought by a trade organization that represents internet companies including Amazon, Google, Meta and Netflix.

U.S. District Judge Beth Labson Freeman, a Barack Obama appointee, agreed that NetChoice was likely to succeed on the merits of its claims that the statute’s prohibitions and requirements violate the online companies’ expressive rights under the First Amendment of the U.S. Constitution.

“Even if the court were to accept that the act advances a compelling state interest in protecting the privacy and well-being of children, the state has not shown that the CAADCA is narrowly tailored to serve that interest,” Freeman said. “The act applies to all online content likely to be accessed by consumers under the age of 18, and imposes significant burdens on the providers of that content.”

The act, which was modeled after a similar United Kingdom law, prevents companies from collecting or selling minors’ data, estimating their age, profiling them for advertising, or engaging in “dark patterns” to negatively influence their behavior.

NetChoice has criticized the law for heavy-handedly addressing what other privacy laws, like the Children’s Online Privacy Protection Rule and the California Privacy Rights Act, already do.

Freeman first granted an injunction against the law in September 2023, stating it “likely violates the First Amendment," but the Ninth Circuit was not so generous on appeal.

In a mixed-bag ruling, the Ninth Circuit upheld parts of her original order but vacated the remainder of Freeman’s injunction, ruling that it was unclear from the record whether all elements of the law were unconstitutional. The case was returned to Freeman to determine if the remaining parts of the act should also be prohibited by an injunction.

“Today’s ruling reaffirms — for the third time in California — that the government cannot control what lawful speech Americans see, say, or share online,” Chris Marchese, NetChoice’s director of litigation, said in a statement. “While protecting children online is a goal we all share, California’s Speech Code is a trojan horse for censoring constitutionally protected but politically disfavored speech.”

In her decision, Freeman noted that by requiring a business to estimate users’ age to determine what content is appropriate for that age, the California law imposes limits on the content a covered business may publish and the content each user may view.

In the alternative, she said, all content must be sanitized to comport with the highest risk level, which presumably is the youngest children. But imposing such restrictions concerning content published to — and accessed by — both children and adults triggers the highest level of judicial review on whether a law is sufficiently narrowly tailored to meet its purpose.

“If a business chooses not to estimate the age of its users, it must apply the privacy and data protections afforded to children to all consumers,” the judge said. “However, the Supreme Court has made clear that under the First Amendment, a state could not reduce the adult population to reading only what is fit for children.”

A representative for California Attorney General Bonta, who is defending the lawsuit on the state’s behalf, said they were reviewing the ruling and would respond appropriately in court.

The Age-Appropriate Design Code Act requires businesses that trade in consumers’ personal information and offer products, services, and features likely to be accessed by children to proactively protect their young users’ information and prohibits certain actions that involve the collection and use of that information.

The act, signed into law by Governor Gavin Newsom on Sept. 15, 2022, was modeled after the United Kingdom’s Age Appropriate Design Code, which similarly requires websites likely to be accessed by children to provide privacy protections by default.

Follow @edpettersson