NetChoice, LLC v. Bonta

692 F.Supp.3d 924

NETCHOICE, LLC, d/b/a NetChoice Plaintiff, v. Rob BONTA, Attorney General of the State of California,in his official capacity, Defendant.

Case No. 22-cv-08861-BLF

United States District Court, N.D. California, San Jose Division

Signed September 18, 2023

Ambika Kumar, Pro Hac Vice, Davis Wright Tremaine LLP, Seattle, WA, David Morris Gossett, Pro Hac Vice, Meenakshi Krishnan, Pro Hac Vice, Davis Wright Tremaine LLP, Washington, DC, Robert Corn-Revere, Pro Hac Vice, Foundation for Individual Rights and Expression, Washington, DC, Adam Stanley Sieff, Davis Wright Tremaine LLP, Los Angeles, CA, for Plaintiff.

Elizabeth K. Watson, California Attorney General's Office California Department of Justice, San Francisco, CA, Nicole Juliet Kau, Office of the California Attorney General Department of Justice, Los Angeles, CA, for Defendant.

Megan Leef Brown, Pro Hac Vice, Boyd Garriott, Pro Hac Vice, Wiley Rein LLP, Washington, DC, Kathleen Scott, Pro Hac Vice, Washington, DC, Robert Edward Dunn, Eimer Stahl LLP, San Jose, CA, for Amicus Chamber of Commerce of the United States of America.

Lindsay C. Harrison, Jenner and Block LLP, Washington, DC, for Amicus Eric Goldman.

Christopher Patrick Eby, Pro Hac Vice, King & Spalding, Atlanta, GA, Tamra Moore, King & Spalding, Washington, DC, for Amici Chamber of Progress, IP Justice, LGBT Tech Institute.

Lauren Gallo White, Wilson Sonsini Goodrich and Rosati, PC, San Francisco, CA, for Amicus Computer & Communications Industry Association.

Alan Jay Butler, Electronic Privacy Information Center, Washington, DC, for Amici Electronic Privacy Information Center, Reset Tech.

Laura R. Garrett, Social Media Victims Law Center, Seattle, WA, for Amici Fairplay, The Public Health Advocacy Institute, Childrens Advocacy Institute, Center for Humane Technology, Spark and Stitch, Accountable Tech, Center for Digital Democracy, Design It For US, North Carolina Young Peoples Alliance, Encode Justice, Civics Unplugged, Archewell Foundation, 5 Rights Foundation, EK, Common Sense Media, Ultraviolet.

Dana R. Green, Pro Hac Vice, Legal Department, New York, NY, Samantha Chariz Hamilton, Pro Hac Vice, University of Georgia School of Law, Athens, GA, for Amici The New York Times Company, Student Press Law Center.

ORDER GRANTING MOTION FOR PRELIMINARY INJUNCTION

[Re: ECF 29]

BETH LABSON FREEMAN, United States District Judge

This suit challenges the enforceability of the California Age-Appropriate Design Code Act ("the CAADCA" or "the Act"), which was recently enacted for the stated purpose of affording protections to children when they access the internet. See Cal. Civ. Code § 1798.99.29.¹ The Act applies to for-profit businesses that collect consumers' personal information and satisfy other criteria relating to business size and revenue. See CAADCA § 30; Cal. Civ. Code § 1798.140. Effective July 1, 2024, the Act imposes a number of requirements on any covered business that "provides an online service, product, or feature likely to be accessed by children." CAADCA § 31.

Plaintiff NetChoice, LLC ("NetChoice") "is a national trade association of online businesses that share the goal of promoting free speech and free enterprise on the Internet." Compl. ¶ 5, ECF 1. NetChoice's members include Google, Amazon, Meta, TikTok and many other companies with strong online presences. NetChoice sues Defendant Rob Bonta, Attorney General of the State of California ("the State"), for declaratory and injunctive relief related to the CAADCA, which it asserts is both facially unconstitutional and preempted by federal statute.

NetChoice moves for preliminary injunction based on its claims that the CAADCA violates the First Amendment and the dormant Commerce Clause of the United States Constitution, and is preempted by both the Children's Online Privacy Protection Act ("COPPA"), 15 U.S.C. §§ 6501-6506, and Section 230 of the Communications Decency Act, 47 U.S.C. § 230. See Mot., ECF 29. The State opposes the motion, arguing that the CAADCA regulates conduct—the collection and use of children's personal information—that does not implicate the First Amendment. See Opp'n, ECF 51. The State also contends that the CAADCA does not violate the dormant Commerce Clause and is not preempted by either COPPA or Section 230. See id.

Mindful that the CAADCA was enacted with the unanimous support of California's Legislature and Governor, the Court has given careful consideration to the motion, the State's opposition, NetChoice's reply, the supplemental briefs filed by both parties, the briefs filed by seven sets of amici curiae, and the oral arguments presented at the hearing on July 27, 2023. The Court finds that although the stated purpose of the Act—protecting children when they are online—clearly is important, NetChoice has shown that it is likely to succeed on the merits of its argument that the provisions of the CAADCA intended to achieve that purpose do not pass constitutional muster. Specifically, the Court finds that the CAADCA likely violates the First Amendment. The motion for preliminary injunction is GRANTED on that basis.

I. BACKGROUND

The internet has become indispensable to the exchange of information. Many online providers allow users to view content and access services without creating an account, while others require the creation of a free account to access services, and still others require users to pay fees. See Cairella Decl. ¶¶ 4-8, ECF 22; Masnick Decl. ¶¶ 5-6, ECF 29; Roin Decl. ¶¶ 7-9, ECF 25; Paolucci Decl. ¶ 2, ECF 28. Online providers generally rely on advertising to earn revenue that supports the content and services they offer. See Cairella Decl. ¶¶ 4, 21; Roin Decl. ¶ 10. Advertisements are targeted to users based on their interests, which are gleaned from data collected from the users while they are online. See Egelman Decl. ¶¶ 13-14, ECF 51-1. Such data also is used by online providers to tailor content to individual users. See Cairella Decl. ¶ 8; Roin Decl. ¶¶ 2-6. In addition, online providers may sell user data to third parties. See Egelman Decl. ¶ 11.

Users can manage their online privacy by reading privacy policies before engaging with the provider's services. See Egelman Decl. ¶ 24. Users also may change their privacy settings to block or delete "cookies," which are data that websites store in consumers' web browsers, which are then transmitted back to websites when visited again. See id. ¶ 29. However, privacy policies can be difficult to understand and privacy settings are not always user friendly. See id. ¶¶ 24-30.

These privacy concerns have become increasingly relevant to children, because their internet use has grown dramatically in recent years. See Radesky Decl. ¶¶ 21-25, ECF 51-5. During the COVID-19 pandemic, children's access to digital technology and time online went up significantly. See id. ¶ 26. Children's time online increased approximately 52% during the pandemic, and heavier technology use habits have persisted. See id. Children depend on the internet for both educational and entertainment purposes. See id. ¶¶ 26-29. Unplugging is not a viable option. See id. ¶ 29.

A federal child privacy law, COPPA, limits the ability of online providers to collect personal information from children. See 15 U.S.C.A. §§ 6501-06. COPPA makes it "unlawful for an operator of a website or online service directed to children, or any operator that has actual knowledge that it is collecting personal information from a child, to collect personal information from a child in a manner that violates the regulations prescribed" under the statute. 15 U.S.C. § 6502(a)(1). "Child" is defined as an individual under the age of 13. 15 U.S.C. § 6501(1). The applicable regulations require the operator to obtain parental consent prior to any collection, use, or disclosure of personal information from children. See 16 C.F.R. § 312.3(b).

The California Consumer Privacy Act ("CCPA") imposes limits on the collection of personal information from users generally, requiring among other things that online providers inform users of the categories of personal information to be collected and the purposes of such collection. See Cal. Civ. Code § 1798.100(a)(1). The CCPA defines "personal information" to include any information that "relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household." Cal. Civ. Code § 1798.140(v).

It is against this backdrop that the CAADCA was enacted. The CAADCA goes far beyond the scope of protections offered by COPPA and the CCPA. Whereas COPPA limits the collection of user data by operators of websites and services "directed to children," 15 U.S.C. § 6502(a)(1), the CAADCA "declares that children should be afforded protections not only by online products and services specifically directed at them but by all online products and services they are likely to access," CAADCA § 29. COPPA protects children under the age of 13, see 15 U.S.C. § 6501(1), while the CAADCA protects children under the age of 18, see CAADCA § 30(b)(1). COPPA gives parents authority to make decisions about use of their children's personal information, see 16 C.F.R. § 312.3(b), and the CCPA gives users authority to make decisions about their own personal information, see Cal. Civ. Code § 1798.135. In contrast, the CAADCA requires online providers to create a Data Protection Impact Assessment ("DPIA") report identifying, for each offered online service, product, or feature likely to be accessed by children, any risk of material detriment to children arising from the provider's data management practices. See CAADCA § 30(a)(1). Providers must create a "timed plan to mitigate or eliminate" the risks identified in the DPIA "before the online service, product, or feature is accessed by children," id. § 30(a)(2), and must provide the DPIA reports to the California Attorney General upon written request, see id. § 30(a)(2). The...