Page 3
Ninth Circuit:
Child Online Privacy Act Likely Violates Free Speech
Judge Milan D. Smith Jr. Says Requirement That Businesses Providing Online Services Tell of Risk to Children in Report to the State Is Unlikely to Survive Strict Scrutiny; Declares Preliminary Injunction Was Properly Issued
By Kimber Cooley, Associate Editor
The Ninth U.S. Circuit Court of Appeals held yesterday that portions of recent legislation that require Internet content providers to prepare a report, for review by the state, which identifies any risk of “material detriment to children that arise from [its] data management practices” is likely to be found to unconstitutionally compel speech, justifying a preliminary injunction.
The dispute arose after the Legislature in 2022 passed the California Age-Appropriate Design Code Act, codified at §1798.99.28 et seq. (“CAADA”) with the stated goal of protecting children.
CAADCA imposes several affirmative obligations on “business[es] that provide[] an online service, product, or feature likely to be accessed by children.” One obligation is that covered businesses must create a Data Protection Impact Assessment (“DPIA”) report for each offered online service, product, or feature likely to be accessed by minors.
In creating those reports, the companies must assess factors—such as whether the design of the product may expose children to harmful or potentially detrimental content and whether it may permit children to witness inappropriate conduct—prior to offering a new online service, product, or feature that is likely to be accessed by minors.
The platforms must provide a list of every DPIA report it has completed, or copies of the reports themselves, to the Office of the Attorney General upon written request. The statute authorizes the attorney general to bring a civil enforcement action for failure to comply with the act’s requirements.
Constitutional Challenge
On Dec. 14, 2022, plaintiff NetChoice LLC—a national trade association the members of which include Amazon.com Inc., Meta Platforms Inc., Netflix Inc., and X Corp.—filed suit against Attorney General Rob Bonta asserting that the CAADA on its face violates the First Amendment and other constitutional protections.
In September 2023, District Court Judge Beth Labson Freeman of the Northern District of California granted the plaintiff’s motion for a preliminary injunction enjoining the enforcement of the act, finding that the report-generation requirements are likely to be found unconstitutional and that the remainder of the act was not severable from those provisions.
Circuit Judge Milan D. Smith Jr. wrote the opinion affirming the preliminary injunction as to the enjoinment of the report provisions, but reversing as to the remainder of the act due to insufficient analysis.
In finding that the First Amendment analysis is triggered by the portions of the act requiring the businesses to create a report, Smith said:
“[T]he…report requirement invites First Amendment scrutiny because it deputizes covered businesses into serving as censors for the State. The Supreme Court has previously applied First Amendment scrutiny to laws that deputize private actors into determining whether material is suitable for kids.”
Circuit Judges Mark J. Bennett and Anthony D. Johnstone joined in the opinion.
Speech Implications
The state asserts that NetChoice’s request to enjoin enforcement should fail as the organization is unlikely to succeed on the merits of its First Amendment challenge as it governs only “data management practices” and the bulk of the legislation does not implicate speech.
Unpersuaded, Smith agreed with NetChoice that the report requirement triggers review under the First Amendment and said:
“[T]he DPIA report requirement clearly compels speech by requiring covered businesses to opine on potential harm to children. It is well-established that the First Amendment protects ‘the right to refrain from speaking at all.’….It is also well-established that the forced disclosure of information, even purely commercial information, triggers First Amendment scrutiny.”
He continued:
“While it is certainly possible that in some applications, a covered business will ultimately conclude that it need not address certain risks in its DPIA report because its new service to be offered does not create such risks,… there is no question that a covered business at the threshold would still have to inquire into whether the risk exists before it can decline to address it in its DPIA report. Therefore, in every circumstance in which a covered business creates a DPIA report for a particular service, the business must ask whether the new service may lead to children viewing or receiving harmful or potentially harmful materials.”
Level of Scrutiny
Having found that the First Amendment is triggered, Smith turned to the appropriate level of scrutiny in assessing whether NetChoice would be likely to succeed in its constitutional challenge and concluded that “there is no question that strict scrutiny, as opposed to mere commercial speech scrutiny, governs our review of the DPIA report requirement.”
He wrote:
“The DPIA report requirement—in requiring covered businesses to opine on and mitigate the risk that children are exposed to harmful content online—regulates far more than mere commercial speech….businesses covered by the CAADCA must opine on potential speech-based harms to children, including harms resulting from the speech of third parties, disconnected from any economic transaction….And the DPIA requirement goes further, because it not only requires businesses to identify harmful or potentially harmful content but also requires businesses to take steps to protect children from such content.”
Smith added:
“There should be no doubt that the speech children might encounter online while using covered businesses’ services is not mere commercial speech. Further, a business’s opinion about how its services might expose children to harmful content online is not ‘purely factual and uncontroversial.’….We therefore conclude that the subjective opinions compelled by the CAADCA are best classified as non-commercial speech.”
Likely Failure
Smith noted that Freeman incorrectly applied intermediate commercial scrutiny, but still came to the correct “ultimate conclusion that the DPIA report requirement is likely to fail First Amendment scrutiny.” He said “[a]ssuming arguendo that the State has a compelling interest in protecting children” from certain online material, it is unlikely to be able to show that the DPIA report is the “least restrictive means” to accomplish that goal.
He reasoned that “[t]he State could have easily employed less restrictive means to accomplish its protective goals, such as by (1) incentivizing companies to offer voluntary content filters or application blockers, (2) educating children and parents on the importance of using such tools, and (3) relying on existing criminal laws that prohibit related unlawful conduct.”
Taking issue with the “high level of generality” of the wording of the act, he said that the provisions “provide little help to businesses in identifying which of those practices or designs may actually harm children.” Smith remarked:
“[A] disclosure regime that requires the forced creation and disclosure of highly subjective opinions about content-related harms to children is unnecessary for fostering a proactive environment in which companies, the State, and the general public work to protect children’s safety online…. [T]he State attempts to indirectly censor the material available to children online, by delegating the controversial question of what content may “harm to children” to the companies themselves, thereby raising further questions about the onerous DPIA report requirement’s efficacy in achieving its goals.”
He declared that “the DPIA report requirement falls well short of satisfying strict First Amendment scrutiny.”
Remaining Provisions
As to the remaining provisions which are unrelated to the DPIA report, Smith said:
“Whether NetChoice is likely to succeed on its facial challenge as to the remaining provisions it challenges is less certain….[M]ost of those provisions, by their plain language, do not necessarily impact protected speech in all or even most applications.”
He commented that Freeman “sustained facial attacks on several other provisions that, on their face, do not necessarily impact protected speech” and concluded that “[b]ecause it is unclear to us whether NetChoice is likely to succeed in its facial challenges” to the unrelated provisions, “it is premature for us to consider as a whole whether the invalid portions of the CAADCA are severable from the valid remainder of the statute.”
The case is NetChoice, LLC v. Bonta, 23-2969.
The CAADCA was authored by Assembly members Buffy Wicks, D-Oakland, and Jordan Cunningham, R-San Luis Obispo.
Copyright 2024, Metropolitan News Company