NetChoice Sues to Prevent Enforcement of California Age-Appropriate Design Code Act

Background: California Age-Appropriate Design Code Act

In August 2022, California Legislature unanimously passed the California Age-Appropriate Design Code Act (AADCA), AB 2273. AADCA will take effect in July 2024. AADCA aims to provide greater online privacy protection and control to minors and their guardians. The Act is modeled after a similar code that took effect in the United Kingdom in September 2021.

Below are some key AADCA provisions:

Age of Protected Users: AADCA provides online protection to users younger than 18 years old. In contrast, Children’s Online Privacy Protection Act (COPPA) only covers users 13 years old or younger.

Applicable Businesses: AADCA is applicable to an online service or product that is “likely to be accessed by a child,” which is defined, in turn, to mean a consumer under the age of 18.

Determining Age: Businesses covered by AADCA required to estimate the age or age range of users with a “reasonable level of certainty” that is appropriate to the risk of the collected data.

Default Settings: Businesses covered by the AADCA must configure default privacy settings to those that offer a high level of privacy, unless the business can demonstrate a compelling reason that a different setting is in the best interests of children.

Data Protection Impact Assessment (DPIA): Before any new online service, product or feature that is likely to be accessed by children is offered to the public, complete a DPIA.

Tracking: If the online service, product, or feature allows the child’s parent, guardian or any other consumer to monitor the child’s online activity or track the child’s location, provide an obvious signal to the child when the child is being monitored or tracked.

NetChoice Sues California Attorney General to Enjoin and Invalidate AADCA

NetChoice is a non-profit trade group that advocates on behalf of a coalition of big tech companies, such as Meta, Amazon, and Twitter. On December 14, 2022, NetChoice filed a lawsuit in the Northern District Court of California against California Attorney General Rob Bonta to enjoin the enforcement of the AADCA and to declare the Act invalid.

In NetChoice’s press release and filed complaint, the trade group characterizes the AADCA as “a content-based restriction on speech that will subject a global communications medium to state supervision” rather than genuine online privacy protection for children. They allege that the AADCA infringes on the First Amendment rights of online users and will chill free digital free speech. NetChoice also alleges the AADCA is facially unconstitutional because it violates the Commerce Clause, Due Process Clause, the Fourth Amendment, and the California Constitution. The trade group argues that California is attempting to overreach its state powers and the Act is preempted by federal regulations, such as COPPA and Section 230 of the Communications Decency Act.

In addition, NetChoice outlines its claims that numerous AADCA provisions are too vague or may lead to more harm than protection. For example, NetChoice states the “likely to be accessed by a child” standard is content-based regulation that is “vague and potentially limitless.” Enforcement of the provision would result in an impermissible burden on a vast majority of companies, including websites that are not aimed at young users. The trade group alleges the required “reasonable level of certainty” of users’ age is too vague and is unclear how covered entities are meant to comply. This allegation echoes the critique of consumer privacy advocates who worry that various age verification methods would lead to increased data collection rather than less.

Looking Ahead

Children’s online privacy will remain a topic of concern for legislators going into 2023. While Congress failed to pass the federal Kids Online Safety Act (KOSA) and the amendment to COPPA failed to pass before adjourning in December 2022, several state legislatures appear poised to advance their own children’s privacy protection bills. In the meantime, it remains to be seen how NetChoice’s lawsuit to enjoin AADCA may impact the broader privacy landscape.

Resources

• California Age-Appropriate Design Code Act
• NetChoice Sues California to Protect Families & Free Speech Online (Press Release)
• NetChoice v. Bonta Complaint (Case No: 5:22cv8861)
• State legislators aren't waiting for Congress to regulate children's online privacy
• California’s New Child Privacy Law Could Become National Standard