As MSK reported last year, there was a distinct possibility of legal, including constitutional, challenges to the new California Age-Appropriate Design Code Act (the “CAADCA"), a law aimed at protecting children online. Such predictions proved accurate and have now culminated in a ruling. On September 18, 2023, Judge Beth Labson Freeman of the U.S. District Court for the Northern District of California issued a preliminary injunction halting implementation or enforcement of the law, which was originally scheduled to go into effect on July 1, 2024.
In December 2022, the industry group NetChoice—whose members include Google, Amazon, Meta, and TikTok—filed its complaint against California’s Attorney General in the district court to stop implementation of the CAADCA. In its request for a preliminary injunction, NetChoice argued that the CAADCA infringed upon several constitutional provisions, including the First and Fourth Amendments, as well as the Due Process and Commerce Clauses of the U.S. Constitution. Furthermore, the group contended that the Act was preempted by both the federal Children's Online Privacy Protection Act ("COPPA") and Section 230 of the Communications Decency Act.
As enacted, the CAADCA would require any business offering online services, products, or features “likely to be accessed by children” to comply with age verification requirements and to prepare so-called Data Protection Impact Assessment reports ("DPIA Reports") aimed at identifying risks of harm to children arising from a business's data management practices. The DPIA Report requirement is substantial, as these reports must assess whether the design of an online service, product, or feature could potentially harm children and must establish plans to mitigate or eliminate identified risks prior to release. Moreover, DPIA Reports were to be provided to the state attorney general upon written request.
