NetChoice v. Bonta is a First Amendment challenge to California's Age-Appropriate Design Code Act (CAADCA, AB 2273, signed 2022), filed December 14, 2022. The same three-judge Ninth Circuit panel has issued two opinions in the case: NetChoice I (August 16, 2024), which blocked the Act's data protection impact assessment requirement under strict scrutiny, and NetChoice II (March 12, 2026), which blocked the data-use restrictions and dark-patterns provision on vagueness grounds while allowing the coverage definition and the age-estimation requirement to proceed.
Case information
| Field | Detail |
|---|---|
| Plaintiff | NetChoice, LLC — a trade association representing Google, Meta, Amazon, Netflix, X, and other major platforms |
| Defendant | Rob Bonta, California Attorney General (sued in official capacity) |
| Court | 9th Cir. (on appeal from N.D. Cal.) |
| Filed | December 14, 2022 |
| Status | Active |
Background
CAADCA imposed several requirements on online services "likely to be accessed by children":
- A pre-launch Data Protection Impact Assessment (DPIA) report identifying risks to children.
- Mitigation of identified risks, including from "potentially harmful content."
- Age estimation, or application of child-level protections to all users.
- Highest-privacy settings by default for child users.
- A prohibition on profiling children by default.
- Restrictions on data use "materially detrimental" to children's well-being or against their "best interests."
- A dark-patterns prohibition for design features detrimental to child well-being.
- Civil penalties of $2,500 per child per negligent violation and $7,500 per child for intentional violations.
Claims
NetChoice argued that CAADCA's requirements compelled or restricted protected speech in violation of the First Amendment. The challenge proceeded in two phases before the same Ninth Circuit panel, addressing different provisions and producing different outcomes under different doctrinal tests.
Procedural history
NetChoice I (9th Cir., August 16, 2024)
The panel permanently blocked the DPIA requirement under strict scrutiny. It reasoned that the DPIA compelled non-commercial speech on matters of public controversy, triggering strict scrutiny; that the "potentially harmful content" standard was too broad, sweeping in mental-health communities, school-shooting coverage, climate reporting, and teen grief posts; and that less restrictive alternatives, including voluntary content filters and parental education, were available, so the requirement failed the least-restrictive-means test.
Treating voluntary content filters as a less restrictive alternative implicitly accepted the content theory of social-media harm. Whether voluntary filters are in fact less restrictive depends on whether the harm is content-based, in which case they are, or architectural, in which case they are not — the distinction described on content-vs-architecture.
NetChoice II (9th Cir., March 12, 2026)
The same three-judge panel returned to four further questions 18 months later, with varying outcomes:
| Provision | Outcome | Reasoning |
|---|---|---|
| Coverage definition ("likely to be accessed by children") | California wins; returned to district court | Demographic, not content-based; NetChoice failed the Moody facial-challenge burden by focusing only on social media |
| Age estimation requirement | Vacated and remanded | Provision has an opt-out (apply child-level protections to all users); does not compel content restriction; Free Speech Coalition v. Paxton (2025) inapplicable on two grounds |
| Data-use restrictions ("materially detrimental"; "best interests") | Blocked on vagueness grounds | Standard too vague at platform scale; a redrafted provision with enumerated specific prohibited uses would have a different constitutional profile |
| Dark-patterns provision | Blocked on vagueness grounds | Same reasoning |
Across both opinions, the provisions that survived regulated settings, defaults, and enumerated data practices, governing commerce or conduct with at most incidental speech effects. The provisions that failed required platforms to exercise content judgment under vague statutory standards backed by severe penalties.
Current status
NetChoice II vacated parts of the district-court injunction and remanded the affected provisions to N.D. Cal. for further proceedings. The district court must build a complete record on the coverage definition, covering all affected entities rather than only social media, and reconsider age estimation in light of the appellate panel's findings.
NetChoice has indicated it will continue to litigate. California Attorney General Rob Bonta called NetChoice II "a critical win," while NetChoice's lawyer called the same ruling "a death knell for California's online speech code"; each characterization describes a different part of the outcome.
The following CAADCA provisions remain operative: default high-privacy settings for child users; a prohibition on default profiling of children; precise geolocation protections; age-appropriate privacy disclosures; and the Children's Data Protection Working Group.
Relationships
- surfaced-in: Inside My Advanced Topics Class 8.3: What the Law Is Trying to Do About It (Farahany, March 2026), Inside My Advanced Topics Class 9.2: The Law That Kept Getting Blocked (Farahany, March 2026), Inside My Advanced Topics Class 9.3: The Ninth Circuit Told California How to Fix the Law (Farahany, March 2026)
- related: Algorithmic Speech Doctrine, Content vs Architecture Theory of Social Media Harm, Three Theories of Consent Failure (Information / Capacity / Design)
- plaintiff: NetChoice (planned entity page)