On September 18, 2023, a California federal court granted a request to block enforcement of the California Age-Appropriate Design Code Act ("CAADCA"), a law with the stated goal of protecting children when they are online.
The CAADCA
The CAADCA, which was set to take effect on July 1, 2024,1 imposes a number of obligations on any businesses that provide an online service, product, or feature (collectively, "Online Platforms") that is likely to be accessed by children under 18.2
Among its provision, the CAADCA affirmatively requires that businesses:
- complete Data Protection Impact Assessments ("DPIA") reports, assessing an Online Platform's potential risk to children;3 and
- create a risk mitigation plan before launching an Online Platform.4
Businesses that violate the CAADCA may be liable for damages of $2,500 per affected child for each negligent violation and $7,500 for each intentional violation.5
NetChoice v. Bonta
In December 2022, Netchoice, LLC ("NetChoice"), a national trade association of online businesses, filed a lawsuit challenging the CAADCA.6 The lawsuit, NetChoice, LLC v. Bonta, No. 22-cv-08861 (N.D. Cal.), alleged that the CAADCA is both facially unconstitutional and preempted by federal statute. And in February 2023, NetChoice moved for preliminary injunction on those grounds.7
On September 18, 2023, the court granted NetChoice's motions for preliminary injunction.8 The court found that even though California has a substantial interest in protecting children, the CAADCA did not appropriately address that interest.9
Notably, the court found that even through the CAADCA requires businesses to create a DPIA report and mitigation plan, "there is no actual requirement to adhere to such a plan." Thus, court reasoned, California did not show that the DPIA provision would "in fact alleviate the identified harms to a material degree."10
On October 18, 2023, the State of California appealed the preliminary injunction decision to the Ninth Circuit.
Going Forward
If the CAADCA were not enjoined, businesses would need to complete the required DPIA reports and satisfy related requirements by July 1, 2024. While the CAADCA is enjoined, businesses need not meet these requirements, but it is unclear if the Ninth Circuit will overturn the lower court decision.
With that in mind, at minimum, businesses should consider whether they would have to comply with the law if implemented as well as gain an understanding of how its requirements may affect them.
Footnotes
1. Cal. Civ. Code §§ 1798.99.31(d), 1798.99.33(b).
2. Cal. Civ. Code § 1798.99.29.
3. Cal. Civ. Code §§ 1798.99.30(b)(2), 1798.99.31(a)(1)(B).
4. Cal. Civ. Code § 1798.99.31(a)(2).
5. Cal. Civ. Code § 1798.99.35(a).
6. Compl., Netchoice, LLC v. Bonta, No. 22-cv-08861, ECF No. 1 (N.D. Cal. Dec. 14, 2022)
7. See generally Notice of Motion and Motion for Preliminary Injunction, Netchoice, LLC v. Bonta, No. 22-cv-08861, ECF No. 29 (N.D. Cal. Feb. 17, 2023)
8. Order Granting Motion for Preliminary Injunction at 5, Netchoice, LLC v. Bonta, No. 22-cv-08861-BLF, ECF No. 74 (N.D. Cal. Sep. 18, 2023)
9. See Id. at *33-64
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.