NetChoice v. Bonta (CAADCA litigation)

NetChoice v. Bonta is a First Amendment challenge to California's Age-Appropriate Design Code Act (CAADCA, AB 2273, signed 2022), filed December 14, 2022. The same three-judge Ninth Circuit panel has issued two opinions in the case: NetChoice I (August 16, 2024), which blocked the Act's data protection impact assessment requirement under strict scrutiny, and NetChoice II (March 12, 2026), which blocked the data-use restrictions and dark-patterns provision on vagueness grounds while allowing the coverage definition and the age-estimation requirement to proceed.

Case information

Docket, district-court number, argument and filing dates, panel composition and publication status are taken from the slip opinion itself, retrieved from the Ninth Circuit's opinion datastore (Source: cdn.ca9.uscourts.gov), and corroborated by the Justia docket entry for the same case (Source: law.justia.com).

Background

CAADCA imposed several requirements on online services "likely to be accessed by children":

1. A pre-launch Data Protection Impact Assessment (DPIA) report identifying risks to children.
2. Mitigation of identified risks, including from "potentially harmful content."
3. Age estimation, or application of child-level protections to all users.
4. Highest-privacy settings by default for child users.
5. A prohibition on profiling children by default.
6. Restrictions on data use "materially detrimental" to children's well-being or against their "best interests."
7. A dark-patterns prohibition for design features detrimental to child well-being.
8. Civil penalties of $2,500 per child per negligent violation and $7,500 per child for intentional violations.

Claims

NetChoice argued that CAADCA's requirements compelled or restricted protected speech in violation of the First Amendment. The challenge proceeded in two phases before the same Ninth Circuit panel, addressing different provisions and producing different outcomes under different doctrinal tests.

Procedural history

NetChoice I (9th Cir., August 16, 2024)

The panel affirmed the preliminary injunction as to the DPIA requirement, Cal. Civ. Code § 1798.99.31(a)(1)(B), under strict scrutiny, along with provisions not grammatically severable from it, and vacated the majority of the injunction, remanding for the district court to apply the Moody facial-challenge standard and to reconsider severability (NetChoice, LLC v. Bonta — Ninth Circuit opinion (No. 25-2366, March 12, 2026)). It reasoned that the DPIA compelled non-commercial speech on matters of public controversy, triggering strict scrutiny; that the "potentially harmful content" standard was too broad, sweeping in mental-health communities, school-shooting coverage, climate reporting, and teen grief posts; and that less restrictive alternatives, including voluntary content filters and parental education, were available, so the requirement failed the least-restrictive-means test.

Treating voluntary content filters as a less restrictive alternative implicitly accepted the content theory of social-media harm. Whether voluntary filters are in fact less restrictive depends on whether the harm is content-based, in which case they are, or architectural, in which case they are not — the distinction described on content-vs-architecture.

NetChoice II (9th Cir., March 12, 2026)

The same three-judge panel returned to four further questions 18 months later, on the State's appeal from a second preliminary injunction that had enjoined the CAADCA in its entirety and, in the alternative, seven individual provisions. The disposition line affirms the injunction "insofar as it enjoined enforcement of California Civil Code §§ 1798.99.31(b)(1)–(4) and 1798.99.31(b)(7)," and vacates the remainder (NetChoice, LLC v. Bonta — Ninth Circuit opinion (No. 25-2366, March 12, 2026)). Because California did not meaningfully contest the other Winter factors, the opinion turns entirely on likelihood of success on the merits.

The DPIA requirement enjoined in NetChoice I remains enjoined and was not at issue. NetChoice's as-applied claims and its challenge to the policy enforcement requirement, § 1798.99.31(a)(9), were also not at issue, and the panel did not reach NetChoice's alternative grounds for affirmance.

On the coverage definition, the district court had held that applying the six indicators "unavoidably requires an evaluation of content." The panel's disagreement rests on the indicators being disjunctive: indicators (B) and (F) turn on demographic traffic data "received by the business, not content the business publishes," which businesses frequently already hold, while indicators (C) and (E) — advertisements marketed to children, and design elements "known to be of interest to children" — "may indeed require online businesses to review the content that they publish." A business qualifying under the audience-share test "would have no need to evaluate whether its product is 'directed to children.'" The panel adopted California's example set of covered non-publishers — ride-sharing, ticketing, payments, fitness, health and education services — to show the substantive requirements "appl[y] evenhandedly" (NetChoice, LLC v. Bonta — Ninth Circuit opinion (No. 25-2366, March 12, 2026)).

On age estimation, the holding is narrower than a ruling for the State. The panel found the provision "says nothing about restricting content on its face," since a business may decline age estimation entirely so long as it defaults to applying child-level privacy and data protections to all consumers, and distinguished Free Speech Coalition v. Paxton, 606 U.S. 461 (2025), on the ground that the age-verification system there was "required as a precondition to access content." But it identified an unresolved question it declined to answer: whether "data management practices" in § 1798.99.31(a)(5) carries its plain meaning or impliedly cross-references the § 1798.99.31(a)(1)(B) factors that NetChoice I held "require consideration of content or proxies for content." Section 1798.99.31(a)(2) expressly cross-references the DPIA provision; § 1798.99.31(a)(5) does not. If the cross-reference is implied, the panel wrote, "NetChoice may have a reasonable argument that the age estimation provision triggers review under the First Amendment." The parties did not brief it and the district court did not reach it, so it was remanded along with a direction to develop the Moody record and to address California's evidence of age-estimation methods requiring no additional data collection (NetChoice, LLC v. Bonta — Ninth Circuit opinion (No. 25-2366, March 12, 2026)).

On vagueness, the panel accepted that California's examples of material detriment — connecting a child to an abuser, recommending tobacco, alcohol or gambling — are clear, but treated them as "extreme examples at the margins," with the difficulty arising at "sleep loss, distraction, or hurt feelings." It rejected the analogy to the family-law "best interests of the child" standard on the ground that the family-law test "operates through a specific child's circumstances and factual record" whereas the data use restrictions demand a prospective, class-wide judgment about "children—a class of users that includes every child anywhere who can access a covered online practice." Both provisions' use of the singular "child" was read to mean that "a business designing a product accessed by millions of child users could face liability whenever any one of them experiences a harm that a regulator deems 'material'" (NetChoice, LLC v. Bonta — Ninth Circuit opinion (No. 25-2366, March 12, 2026)).

On severability, the panel found error on both sides without resolving the question. The district court "overstates the import of the chronology of the Act's passage," because the August 2022 amendments that added a 45-day and then a 90-day cure period also amended the age estimation requirement, the dark patterns restriction and the broadband, telecommunications and physical-product exemptions, and NetChoice did not show the cure period "was the reason the bill was ultimately passed." It also "may have underweighted" California's evidence from the Act's purpose provision, § 1798.99.29, and legislative history distinguishing the CAADCA from statutes that "permit online platforms to treat all consumers as adults unless there is actual knowledge that a consumer is a child" (NetChoice, LLC v. Bonta — Ninth Circuit opinion (No. 25-2366, March 12, 2026)).

Across both opinions, the provisions that survived regulated settings, defaults, and enumerated data practices, governing commerce or conduct with at most incidental speech effects. The provisions that failed required platforms to exercise content judgment under vague statutory standards backed by severe penalties. The Attorney General enforces the Act under § 1798.99.35(a), with civil penalties up to $2,500 per child per negligent violation and up to $7,500 per intentional violation.

Contemporaneous practitioner accounts map the outcome section by section and agree with the opinion except as to one subsection. Holland & Knight records the injunction as affirmed on vagueness grounds as to §§ 1798.99.31(b)(1), (b)(3), (b)(4) and (b)(7), omitting (b)(2), the prohibition on profiling a child by default; the opinion's own disposition line covers the range "(b)(1)–(4)" and so includes (b)(2), and the vagueness analysis treats the "best interests" language that appears in (b)(2)(B)(ii) as part of the defect. Holland & Knight also records the injunction as lifted, and the underlying provisions never individually challenged, as to §§ 1798.99.31(a)(6) (highest-level privacy settings by default), (a)(8) (a signal where an adult can monitor a child's activity), (a)(10) (tools for exercising privacy rights and reporting concerns) and (b)(8) (minimisation and purpose limitation for information collected for age estimation) (Source: hklaw.com). Cooley agrees on the disposition and adds that the case returns to the Northern District of California for further proceedings on age estimation and severability (Source: jdsupra.com).

Current status

NetChoice II vacated parts of the district-court injunction and remanded the affected provisions to N.D. Cal. for further proceedings. The district court must build a complete record on the coverage definition, covering all affected entities rather than only social media, and reconsider age estimation in light of the appellate panel's findings.

NetChoice has indicated it will continue to litigate. California Attorney General Rob Bonta called NetChoice II "a critical win," while NetChoice's lawyer called the same ruling "a death knell for California's online speech code"; each characterization describes a different part of the outcome. Holland & Knight noted in March 2026 that whether NetChoice would renew its challenge on remand was not then known, and that when it did so previously the state agreed to a temporary stay of enforcement, so the CAADCA might remain unenforceable for some time (Source: hklaw.com). As of September 4, 2026 no further appellate disposition had been located.

The CAADCA provisions left unenjoined by the March 2026 disposition include default high-privacy settings for child users (§ 1798.99.31(a)(6)), the adult-monitoring signal (§ 1798.99.31(a)(8)), tools for exercising privacy rights and reporting concerns (§ 1798.99.31(a)(10)), minimisation and purpose limitation for age-estimation data (§ 1798.99.31(b)(8)), age-appropriate privacy disclosures, and the Children's Data Protection Working Group. The default-profiling prohibition, § 1798.99.31(b)(2), falls inside the affirmed "(b)(1)–(4)" range and remains enjoined, as does the DPIA requirement from NetChoice I (NetChoice, LLC v. Bonta — Ninth Circuit opinion (No. 25-2366, March 12, 2026)).

Relationships

• surfaced-in: Inside My Advanced Topics Class 8.3: What the Law Is Trying to Do About It (Farahany, March 2026), Inside My Advanced Topics Class 9.2: The Law That Kept Getting Blocked (Farahany, March 2026), Inside My Advanced Topics Class 9.3: The Ninth Circuit Told California How to Fix the Law (Farahany, March 2026)
• related: Algorithmic Speech Doctrine, Content vs Architecture Theory of Social Media Harm, Three Theories of Consent Failure (Information / Capacity / Design)
• litigates: NetChoice — the plaintiff trade association.
• depends-on: NetChoice, LLC v. Bonta — Ninth Circuit opinion (No. 25-2366, March 12, 2026) — the March 12, 2026 slip opinion; primary authority for the section-level disposition
• related: Moody v. NetChoice, LLC — the Supreme Court facial-challenge standard the panel applied.
• related: Age Verification, AI and Children — the doctrinal areas the age-estimation holding bears on.