Amicus Briefs
NetChoice v. Bonta
US Court of Appeals for the Ninth Circuit
Question Presented
Whether California’s Age-Appropriate Design Code, a new law that requires tech companies to design their services with children’s privacy in mind, violates tech companies’ First Amendment rights.
Background
There is a growing recognition that children can be harmed online. Children regularly have their data extracted and used to target them with ads, serve them inappropriate content such as pro-eating-disorder or pro-suicide messages, and other harms. Children are especially vulnerable to these risks because they lack the experience and critical thinking skills required to mitigate these risks.
To address the issue, many states around the world—including some in the United States—have begun drafting and passing child-specific platform design laws. These laws have taken very different forms and exist on a range of restrictiveness. For example, a relatively restrictive law is Utah’s Social Media Regulation Act, which requires social media platforms to obtain parental consent for any child under 18 to use the site and requires the platforms to proactively verify the age of every user.
California recently passed a child safety law modeled off of a law from the United Kingdom that is relatively more relaxed that the Utah version. Starting in July 2024, California’s Age-Appropriate Design Code (AADC) will require tech companies to assess how their services collect and use children’s data and to refrain from certain harmful uses of that data.
The law uses a few tools to achieve this goal. For example, it requires covered businesses to conduct a Data Protection Impact Assessment (DPIA) before offering a new service, product, or feature to the public that is likely to be used by children. The DPIA must identify the purpose of the online service, product, or feature; how it uses children’s personal information; and how/whether the business’s data management practices impact the risks of material detriment to children. Businesses must generate a mitigation strategy for any risks they have identified.
The Case
NetChoice, whose members include Google, Meta, Amazon, Twitter, and TikTok, has sued California to try to block the AADC’s implementation. NetChoice argues that the law restricts what content a company can show on its website and, consequently, the law violates the First Amendment and is inconsistent with Section 230 of the Communications Decency Act, which prevents tech companies from being treated as the publishers of third-party content.
After EPIC submitted an amicus brief at the district court level, the court ruled that the AADC violates the Constitution. You can read EPIC’s analysis of that decision here.
EPIC’s Brief
EPIC submitted amicus briefs at both the district and circuit court levels in this case. EPIC’s district court brief, joined by a coalition of civil society groups, lawmakers, and tech experts, argues that the AADC should be understood as a common-sense regulation of business conduct, not a restriction on speech or unfair imposition on tech companies. The AADC, like many business regulations across economic sectors, seeks to address market incentives that the legislature believes currently encourage businesses to design and produce harmful products. The AADC “does not require companies to remove or even demote any specific content—as long as they do not use children’s data in a way that violates the law, companies can show users whatever information they like.” The coalition pointed out that courts have “increasing rejected” tech companies’ attempts to use Section 230 to immunize themselves from their own harmful conduct, such as when they use personal information about users to deny them access to information in violation of anti-discrimination laws or when the design of an app feature causes foreseeable harm. Since California’s new law regulates similar platform conduct, Section 230 does not apply. The coalition also argued that “the impact assessments required by the AADC are common in regulatory frameworks across the United States and the world.” The coalition wrote that NetChoice’s and its supporters’ “argument that generally applicable privacy regulations, targeted specifically at mitigating harms to children’s privacy, are unconstitutional would undermine numerous federal and state laws and undermine the state’s compelling interest in protecting the privacy of children.”
EPIC’s circuit court brief focused on a few key misunderstandings that the district court’s opinion showed about what the AADC requires and what its likely effects would be. The brief addressed two major misconceptions in the district court’s opinion: that the AADC would penalize companies for showing children harmful content and that the AADC would require companies to implement “hard,” privacy-invasive age verification techniques. EPIC’s brief went carefully through the AADC’s provisions, showing that they require two things from companies: privacy protections for children and transparency measures such as completing a data protection impact assessment. None of these provisions forces companies to gate off content from children. EPIC’s brief then explains how the law allows companies to either grant full privacy protections to all users or, instead, to only grant these protections to users that the companies estimate are children. Age estimation is not as privacy invasive as age verification because it allows companies to guess as to users’ ages instead of requiring them to know users’ ages. And companies may forego estimating age altogether if they simply extend the same privacy protections to all users or redesign their services to avoid the privacy harms the companies identified in their DPIAs. To demonstrate the AADC’s light-touch, flexible approach, EPIC’s brief compared it to other recently passed laws in states such as Utah, Arkansas, and Texas that impose much more onerous and privacy-invasive requirements on companies. EPIC’s brief also compares the AADC to the Communications Decency Act, a federal law the Supreme Court ruled to be unconstitutional in Reno v. ACLU, to show why the AADC lacks many of the concerning traits found in other kids safety statutes.
EPIC’s second amicus brief in the Northern District of California on remand explained that NetChoice’s amended motion for a preliminary injunction still failed to meet the Moody/Paxton standard and failed to explain why the AADC’s data protection provisions implicated any expressive activity.
Legal Documents
-
Design Researchers and Practitioners Amicus Supporting California
(Dec. 13, 2024)
-
Common Sense Media Amicus Supporting California
(Dec. 13, 2024)
-
EPIC Amicus Supporting California
(Dec. 13, 2024)
-
California’s Opposition to NetChoice’s Second Motion for a Preliminary Injunction
(Dec. 6, 2024)
-
NetChoice’s Second Motion for a Preliminary Injunction
(Nov. 1, 2024)
-
Ninth Circuit’s Opinion
(Aug. 16, 2024)
- Bonta Reply Brief
-
Appellee NetChoice’s Response Brief
(Feb. 7, 2024)
-
EPIC’s Amicus Brief Supporting Bonta
(Dec. 20, 2023)
-
Amicus Brief of the American Academy of Pediatrics and the American Psychological Association Supporting Bonta
(Dec. 20, 2023)
-
Amicus Brief of the Center for Humane Technology Supporting Bonta
(Dec. 20, 2023)
-
Amicus Brief of Elizabeth Denham CBE and Stephen Wood Supporting of Bonta
(Dec. 20, 2023)
-
Amicus Brief of Design Scholars Supporting Bonta
(Dec. 20, 2023)
-
Amicus Brief of FTC Commissioner Alvaro Bedoya Supporting Bonta
(Dec. 20, 2023)
-
Amicus Brief of Fairplay et al. Supporting Bonta
(Dec. 20, 2023)
-
Amicus Brief of the Lawyers’ Committee for Civil Rights Under the Law Supporting Bonta
(Dec. 20, 2023)
-
Amicus Brief of 21 State Attorneys General Supporting Bonta
(Dec. 20, 2023)
-
Amicus Brief of Privacy Scholars Supporting Bonta
(Dec. 20, 2023)
-
Amicus Brief of the Princeton University Center for Information Technology Policy’s Tech Policy Clinic Supporting Bonta
(Dec. 20, 2023)
-
Appellant Bonta’s Opening Brief
(Dec. 13, 2023)
-
EPIC’s Amicus Brief
(May 2, 2023)
- California’s Response to NetChoice’s Motion for a Preliminary Injunction
-
NetChoice’s Motion for a Preliminary Injunction
(Feb. 17, 2023)
-
NetChoice’s Complaint
(Dec. 14, 2022)
-
District Court’s Order
(Sep. 18, 2023)

Support Our Work
EPIC's work is funded by the support of individuals like you, who allow us to continue to protect privacy, open government, and democratic values in the information age.
Donate