A published opinion of the United States Court of Appeals for the Ninth Circuit, filed March 12, 2026, on California's appeal from a second preliminary injunction against the California Age-Appropriate Design Code Act (CAADCA), Cal. Civ. Code §§ 1798.99.28–1798.99.40. The case is D.C. No. 5:22-cv-08861-BLF (N.D. Cal., Judge Beth Labson Freeman); it was argued and submitted January 14, 2026 in Pasadena before Judges Milan D. Smith, Jr., Mark J. Bennett and Anthony D. Johnstone, with the opinion by Judge M. Smith. It is the same panel that decided NetChoice I, 113 F.4th 1101 (9th Cir. 2024).
The disposition line is narrow: the panel affirms the preliminary injunction "insofar as it enjoined enforcement of California Civil Code §§ 1798.99.31(b)(1)–(4) and 1798.99.31(b)(7), and VACATE[s] the remainder of the preliminary injunction." Both parties bear their own costs.
Disposition by provision
| Provision | Cal. Civ. Code | Outcome | Ground |
|---|---|---|---|
| Data use restrictions | § 1798.99.31(b)(1)–(4) | Injunction affirmed | Unconstitutional vagueness |
| Dark patterns restriction | § 1798.99.31(b)(7) | Injunction affirmed | Unconstitutional vagueness |
| Coverage definition ("likely to be accessed by children") | § 1798.99.30(b)(4)(A)–(F) | Injunction vacated, as to the entire CAADCA | NetChoice did not carry its Moody facial-challenge burden |
| Age estimation requirement | § 1798.99.31(a)(5) | Injunction vacated, remanded | Record insufficient to find a facial First Amendment violation |
| Severability of the notice-and-cure provision | § 1798.99.35(c)(2) | Determination vacated, remanded | Volitional severability undeterminable at this stage |
The DPIA report requirement enjoined in NetChoice I, § 1798.99.31(a)(1)(B), "remains enjoined and is not at issue in this appeal." NetChoice's as-applied claims and its challenge to the policy enforcement requirement, § 1798.99.31(a)(9), were likewise not at issue. The panel did not reach NetChoice's alternative grounds for affirmance.
Because the State did not meaningfully contest the remaining Winter factors, the opinion turns entirely on likelihood of success on the merits.
The coverage definition
The CAADCA applies to a business providing "an online service, product, or feature likely to be accessed by children," which § 1798.99.30(b)(4) defines through six enumerated indicators: (A) direction to children as defined by COPPA; (B) routine access by a significant number of children on competent and reliable audience-composition evidence; (C) advertisements marketed to children; (D) substantial similarity to a service covered by (B); (E) design elements known to be of interest to children, "including, but not limited to, games, cartoons, music, and celebrities who appeal to children"; and (F) a significant amount of the audience determined to be children based on internal company research.
The district court had held the definition content based, reasoning that applying the indicators "unavoidably requires an evaluation of content," and had therefore applied strict scrutiny to the whole statute. The panel disagreed. Its reasoning is that the six indicators are separate and disjunctive — "Nowhere does the definition require that all six indicators must be present for the Act to apply" — so the definition "cannot apply to every online business in the same way." Indicators (B) and (F) turn on demographic traffic data "received by the business, not content the business publishes," and the panel noted that this is data online businesses frequently already have. Indicators (C) and (E) "may indeed require online businesses to review the content that they publish," but a business qualifying under the "significant amount" test "would have no need to evaluate whether its product is 'directed to children.'"
The panel adopted the State's example set of covered non-publishers — ride-sharing services, electronic ticketing, payment services, fitness products, health services and education products — to show that the substantive requirements "appl[y] evenhandedly." A footnote adds that an argument that the coverage definition compels compliance with the substantive provisions "fails as a challenge to the coverage definition itself," and belongs against the substantive provisions instead.
Because NetChoice bore the burden under Moody v. NetChoice, 603 U.S. 707 (2024), of cataloguing "[w]hat activities, by what actors, do the laws prohibit or otherwise regulate," and did not, the panel vacated the injunction as to the entire CAADCA. The opinion notes pointedly that NetChoice "has been a party to many such cases—several before our court and the Supreme Court—and is presumably aware of the expectations for a facial challenge."
Age estimation
Section 1798.99.31(a)(5) requires covered businesses to "[e]stimate the age of child users with a reasonable level of certainty appropriate to the risks that arise from the data management practices of the business or apply the privacy and data protections afforded to children to all consumers."
The panel held that "we cannot say that the age estimation requirement facially violates the First Amendment at all, much less in a substantial majority of its applications." Two reasons are given. First, the provision "says nothing about restricting content on its face," and its disjunctive structure means a business that declines age estimation "may publish any content they would like, as long as they default to data and privacy protections for all users." Second, the panel distinguished Free Speech Coalition v. Paxton, 606 U.S. 461 (2025), on the ground that the Supreme Court there addressed an age-verification system that was "required as a precondition to access content," and "said nothing about the effect of age estimation on First Amendment burdens generally."
The panel did not, however, hold the provision constitutional. It identified an unresolved statutory question: whether "data management practices" in § 1798.99.31(a)(5) carries its plain meaning or impliedly cross-references the § 1798.99.31(a)(1)(B) factors — product design, algorithms, automatic playing of media, and harmful content — which NetChoice I held "require consideration of content or proxies for content" and therefore trigger First Amendment review. Section 1798.99.31(a)(2) expressly cross-references the DPIA provision; § 1798.99.31(a)(5) does not. The panel observed that if the cross-reference is implied, "NetChoice may have a reasonable argument that the age estimation provision triggers review under the First Amendment." Because "[t]he parties do not develop these arguments, and the district court did not address this precise question," the panel vacated and remanded for the district court to decide it in the first instance, suggesting the parties also consider the effect of the opt-out language.
A second remand ground is record development under Moody: there was "no detailed record that would have allowed the district court to consider how the age estimation provision works in 'all of its applications.'" The panel also faulted the district court for assuming the only compliance path was collecting private information users may not wish to share, noting that "[t]he State put forth evidence of methods for conducting age estimation that would be acceptable under § 1798.99.31(a)(5) and would require no additional data collection," which the district court's discussion "did not address."
Vagueness: data use and dark patterns
The panel affirmed the injunction as to § 1798.99.31(b)(1)–(4) — restricting use of a child's personal information the business knows or has reason to know is "materially detrimental" to physical health, mental health or well-being; default profiling; collection, sale, sharing or retention beyond what is necessary; and secondary use — and as to the dark patterns restriction at § 1798.99.31(b)(7).
The vagueness holding turns on three undefined terms: "material detriment," "best interests," and "well-being." On "materially detrimental," the panel accepted that the State's examples — connecting a child to an abuser, recommending tobacco, alcohol or gambling — are clear, but held them "extreme examples at the margins," while "[t]he more difficult questions arise with examples like sleep loss, distraction, or hurt feelings."
On "best interests of children," the panel rejected the State's analogy to California family law, holding that the family-law standard "operates through a specific child's circumstances and factual record" whereas "[t]he data use restrictions ask something categorically different": a prospective, class-wide judgment about "children—a class of users that includes every child anywhere who can access a covered online practice."
On scienter, the panel held that "the 'reason to know' language cannot mitigate vagueness where what is 'materially detrimental' to any single child's 'well-being' is not clear" — the flaw being that "the 'what [that] must be proven is... vague.'" The panel also read both provisions' use of the singular "child" as making liability turn on a single user's response, so that "a business designing a product accessed by millions of child users could face liability whenever any one of them experiences a harm that a regulator deems 'material.'" That the CAADCA incorporates a definition of "dark pattern" from Cal. Civ. Code § 1798.140(l) "does not help a covered business distinguish between these harms."
Severability
The notice-and-cure provision, § 1798.99.35(c)(2), gave a noncompliant business 90 days from written notice by the Attorney General to cure. NetChoice I affirmed enjoining it as not grammatically severable from the DPIA requirement. The district court then held that no part of the CAADCA was volitionally severable from it.
The panel vacated that determination without resolving it, finding error on both sides of the ledger. The district court "overstates the import of the chronology of the Act's passage": the August 11 and August 22, 2022 amendments that added a 45-day and then a 90-day cure period also amended the age estimation requirement, the dark patterns restriction, and exemptions for broadband, telecommunications and physical products, and "NetChoice does not demonstrate that the 90-day cure period was the reason the bill was ultimately passed." The district court "may have underweighted the State's evidence" from the Act's purpose provision, § 1798.99.29, and from legislative history distinguishing the CAADCA from statutes that "permit online platforms to treat all consumers as adults unless there is actual knowledge that a consumer is a child." The panel concluded it was "unable to determine on this record whether the legislature considered the notice-and-cure provision necessary."
Enforcement context recited
The Attorney General enforces the CAADCA under § 1798.99.35(a), with civil penalties up to $2,500 per child for each negligent violation and up to $7,500 for each intentional violation.
Provenance
Captured September 4, 2026 from the Ninth Circuit's own opinion datastore. The published slip opinion runs 46 pages and carries the court-staff summary, full counsel listing, and ten footnotes.
Relationships
- supersedes: practitioner accounts of the section-level disposition previously relied on by NetChoice v. Bonta (CAADCA litigation)
- depends-on: Moody v. NetChoice, LLC — supplies the facial-challenge standard the panel applies
- supports: NetChoice v. Bonta (CAADCA litigation)
- related: Age Verification — the age-estimation holding and the Free Speech Coalition v. Paxton distinction
- related: AI and Children
- related: Algorithmic Speech Doctrine, Content vs Architecture Theory of Social Media Harm
- related: NetChoice