Privacy & Cybersecurity Law Blog

On August 16, 2024, a Ninth Circuit panel partially upheld an injunction halting implementation of the California Age-Appropriate Design Code Act (the “Act”). In particular, the Ninth Circuit affirmed the district court’s ruling that NetChoice, a technology trade group, was likely to succeed in showing that the Act’s data protection impact assessment (“DPIA”) requirements violate the First Amendment. Under the DPIA requirements, covered businesses would have been required to identify material risks to children under the age of 18, document and mitigate those risks before such children access an online service, product or feature, and provide the DPIA to the California Attorney General upon written request.

The Ninth Circuit vacated the remainder of the district court’s ruling and remanded the case to the district court to assess other provisions of the Act in more detail and consider whether the Act’s unconstitutional provisions are severable from the remainder of the law. Our earlier post provides a summary of the Act’s requirements and restrictions.

The Act is enforceable by the California Attorney General and does not include a private right of action. Whether the California Attorney General will seek to enforce applicable portions of the Act before the district court has had the opportunity to further evaluate the case remains to be seen.