Netchoice LLC v. Bonta - California Age-Appropriate Design Code Act

FOR PUBLICATION UNITED STATES COURT OF APPEALS FOR THE NINTH CIRCUIT NETCHOICE, LLC, Plaintiff - Appellee, v. ROB BONTA, IN HIS OFFICIAL CAPACITY AS ATTORNEY GENERAL OF THE STATE OF CALIFORNIA, Defendant - Appellant. No. 25-2366 D.C. No. 5:22-cv-08861-BLF OPINION Appeal from the United States District Court for the Northern District of California Beth Labson Freeman, District Judge, Presiding Argued and Submitted January 14, 2026 Pasadena, California Filed March 12, 2026 Before: MILAN D. SMITH, JR., MARK J. BENNETT, and ANTHONY D. JOHNSTONE, Circuit Judges. Opinion by Judge M. Smith, Jr.

2 NETCHOICE, LLC V. BONTA SUMMARY* First Amendment The panel affirmed in part and vacated in part the district court’s preliminary injunction in an action brought by NetChoice, a national trade association of online businesses, challenging the California Age-Appropriate Design Code Act (CAADCA), which was enacted to protect the privacy, safety, and well-being of children when engaging with online products and services that children are likely to access. In a prior appeal, this panel affirmed the district court’s preliminary injunction insofar as it prevented enforcement of the CAADCA’s requirement that covered businesses mitigate the risk that children are exposed to harmful material online, and the other provisions that were not severable from it. However, the panel vacated the majority of the district court’s preliminary injunction order and remanded for the district court to properly consider the facial nature of NetChoice’s other First Amendment challenges and to reconsider whether the unconstitutional portions of the CAADCA were severable from its remaining provisions. On remand, NetChoice sought a second preliminary injunction. The district court preliminarily enjoined the entire statute, and, in the alternative, seven individual provisions challenged by NetChoice. This appeal concerns the CAADCA’s coverage definition, age estimation requirement, data use provisions, * This summary constitutes no part of the opinion of the court. It has been prepared by court staff for the convenience of the reader.

NETCHOICE, LLC V. BONTA 3 and dark patterns restrictions. The panel focused its analysis on whether NetChoice was likely to succeed on the merits of its facial challenges to the CAADCA as a whole and to its individual provisions because the State did not meaningfully contest the remaining preliminary injunction factors. The panel held that NetChoice is not likely to succeed on the merits of its facial challenge to the CAADCA’s coverage definition, which consists of six separately enumerated indicators enabling online businesses to determine whether they are subject to the CAADCA. It was NetChoice’s burden to develop a record that would allow the court to determine the law’s full set of applications, cataloging what activities, by what actors the law regulates. Because NetChoice did not carry its burden, the panel vacated the preliminary injunction with respect to the entire CAADCA. The panel next held that NetChoice is not likely to succeed on the merits of its facial challenge to the age estimation requirement. On the record before it, the panel could not say that the age estimation requirement facially violates the First Amendment at all, much less in a substantial majority of its applications. Because NetChoice could not succeed on this facial attack without a developed record, the panel vacated the preliminary injunction as to the age estimation requirement. The panel affirmed the district court’s injunction with respect to the data use and dark patterns restrictions on vagueness grounds because the challenged provisions do not clearly delineate the proscribed conduct. Lastly, the panel vacated the district court’s order insofar as it enjoined the CAADCA’s valid remainder on severability grounds because, at this stage of the litigation, the panel could not determine whether the notice-and-cure

4 NETCHOICE, LLC V. BONTA provision is severable from the CAADCA’s remaining provisions. The panel remanded to the district court for further proceedings. COUNSEL David M. Gossett (argued) and Meenakshi Krishnan, Davis Wright Tremaine LLP, Washington, D.C.; Ambika Kumar and Bianca G. Chamusco, Davis Wright Tremaine LLP, Seattle, Washington; Adam S. Sieff, Davis Wright Tremaine LLP, Los Angeles, California; Robert Corn-Revere, Foundation for Individual Rights and Expression, Washington, D.C.; for Plaintiff-Appellee. Kristin Liska (argued), Deputy Attorney General; Anya M. Binsacca, Supervising Deputy Attorney General; Thomas S. Patterson, Senior Assistant Attorney General; Rob Bonta, California Attorney General; Office of the California Attorney General, San Francisco, California; for Defendant- Appellant. Ariel F. Johnson, Digital Smarts Law & Policy LLC, Shaker Heights, Ohio, for Common Sense Media. Jason Harrow, Gerstein Harrow LLP, Los Angeles, California; Meetali Jain and Melodi Dinçer, Tech Justice Law Project, Washington, D.C.; Mihir Kshirsagar, Center for Information Technology Policy, Princeton, New Jersey; for Amici Curiae Design Researchers and Practitioners.

NETCHOICE, LLC V. BONTA 5 Megan Iorio and Tom McBrien, Electronic Privacy Information Center, Washington, D.C., for Amicus Curiae Electronic Privacy Information Center. Aaron D. Mackey, Adam Schwartz, and David Greene, Electronic Frontier Foundation, San Francisco, California; Samir Jain, Eric Null, and Kate Ruane, Center for Democracy & Technology, Washington, D.C.; for Amici Curiae Electronic Frontier Foundation, Center for Democracy & Technology, Internet Archive, and Wikimedia Foundation. Anne M. Voigts, Pillsbury Winthrop Shaw Pittman LLP, Palo Alto, California; Stephanie A. Joyce, Computer & Communications Industry Association, Washington, D.C.; for Amicus Curiae Computer & Communications Industry Association. Gabriel Rottman, Grayson Clary, and Mara Gassmann, Reporters Committee for Freedom of the Press, Washington, D.C., for Amici Curiae the Reporters Committee for Freedom of the Press, Advance Publications, Hearst Corporation, The New York Times Company, Reuters, and the Student Press Law Center. Mark W. Brennan, J. Ryan Thompson, and Thomas B. Veitch, Hogan Lovells US LLP, Washington, D.C.; Lawrence Walters, Walters Law Group, Longwood, Florida; Kathleen Farley, Chamber of Progress, McLean, Virginia; for Amici Curiae Chamber of Progress and Woodhull Freedom Foundation.

6 NETCHOICE, LLC V. BONTA OPINION M. SMITH, Circuit Judge: NetChoice, LLC (NetChoice), a trade association of online businesses, returns to our court with a renewed challenge to the California Age-Appropriate Design Code Act (CAADCA or Act), Cal. Civ. Code §§ 1798.99.28– 1798.99.40. Before the CAADCA went into effect, NetChoice brought suit in the United States District Court for the Northern District of California, challenging the Act on constitutional and federal preemption grounds. The district court agreed with NetChoice that the challenged provisions likely violate the First Amendment and that they were not severable from the remainder of the CAADCA. The district therefore preliminarily enjoined the Act, preventing it from going into effect. The State appealed that ruling, and we vacated the majority of the district court’s preliminary injunction order. However, we affirmed the injunction insofar as it prevented enforcement of the CAADCA’s requirement that covered businesses mitigate the risk that children are exposed to harmful material online, Cal. Civ. Code §§ 1798.99.31(a)(1)–(2), and provisions not grammatically severable from it. We remanded for the district court to properly consider the facial nature of NetChoice’s other First Amendment challenges and to reconsider whether the unconstitutional portions of the CAADCA were severable from its remaining provisions. On remand, NetChoice sought a second preliminary injunction. The district court preliminarily enjoined the entire statute, and, in the alternative, seven individual provisions challenged by NetChoice. Apart from the data use restrictions, id. § 1798.99.31(b)(1)–(4), and the dark

NETCHOICE, LLC V. BONTA 7 patterns restriction, id. § 1798.99.31(b)(7), we vacate the district court’s preliminary injunction order. The district court erroneously concluded that NetChoice met its burden for a facial challenge to the CAADCA as a whole by way of the statute’s coverage definition. For similar reasons, we vacate the preliminary injunction as to the age estimation requirement, id. § 1798.99.31(a)(5). The Supreme Court has been clear, and our court has since emphasized, that facial challengers must clear a high bar. See, e.g., Wash. State Grange v. Wash. State Republican Party, 552 U.S. 442, 449⁠– ⁠50 (2008); Project Veritas v. Schmidt, 125 F.4th 929, 939⁠– ⁠40 (9th Cir. 2025) (en banc). NetChoice has been a party to many such cases—several before our court and the Supreme Court—and is presumably aware of the expectations for a facial challenge. At the risk of repetition, we offer similar guidance to NetChoice today. We also vacate the district court’s order insofar as it enjoined the CAADCA’s valid remainder on severability grounds. At this stage of the litigation, we cannot conclude that NetChoice is likely to succeed in showing that the CAADCA’s remaining provisions are not volitionally severable from its enjoined notice-and-cure provision, Cal. Civ. Code § 1798.99.35(c)(2). We remand to the district court for further proceedings consistent with this opinion. LEGAL BACKGROUND In 2022, the California legislature unanimously enacted the CAADCA, Cal. Civ. Code §§ 1798.99.28–1798.99.40. The Act’s stated purpose is to protect the “privacy, safety, and well-being of children” when engaging with online products and services that “children are likely to access.” Id. § 1798.99.29. To that end, the CAADCA applies only to those businesses that provide “an online service, product, or

8 NETCHOICE, LLC V. BONTA feature likely to be accessed by children” under the age of eighteen. Id. §§ 1798.99.30(b)(1), 1798.99.31(a)–(b). An online service is “likely to be accessed by children” when “it is reasonable to expect, based on [enumerated] indicators, that the online service, product, or feature would be accessed by children.” Id. § 1798.99.30(b)(4). In service of its goals concerning children’s data privacy, the CAADCA imposes certain affirmative obligations and prohibitions on the businesses it regulates. For example, in 2024, this same panel of our court affirmed a preliminary injunction as to the provision requiring covered online businesses to create a Data Protection Impact Assessment (DPIA) report, or a “systematic survey to assess and mitigate risks that arise from the data management practices of the business to children who are reasonably likely to access the online service . . . that arises from the provision of that online service[.]” Id. §§ 1798.99.30(b)(2), 1798.99.31(a)(1)(B); see NetChoice, LLC v. Bonta (NetChoice I), 113 F.4th 1101, 1116–22 (9th Cir. 2024). That requirement remains enjoined and is not at issue in this appeal. This appeal concerns the CAADCA’s coverage definition, Cal. Civ. Code § 1798.99.30(b)(4)(A)–(F); age estimation requirement, id. § 1798.99.31(a)(5); and data use and dark patterns restrictions, id. §§ 1798.99.31(b)(1)–(4), (7). The California Attorney General has authority to enforce the CAADCA. Id. § 1798.99.35(a). Violators face civil penalties of up to $2,500 per child for each negligent violation and up to $7,500 for each intentional violation. See id. The Act previously included a safe-harbor provision that allowed noncompliant businesses to cure an alleged

NETCHOICE, LLC V. BONTA 9 violation within 90 days of written notice from the Attorney General of the alleged violation. Id. § 1798.99.35(c)(2). We affirmed a preliminary injunction enjoining that notice-and- cure provision in NetChoice I, 113 F.4th at 1125. FACTUAL & PROCEDURAL BACKGROUND NetChoice is trade association whose members consist of large technology companies like Amazon, Google, Meta, and Netflix. See About Us, NetChoice, https://netchoice.org/about/ (last visited Mar. 5, 2026). In 2022, before the CAADCA took effect, NetChoice brought suit challenging the Act on constitutional and federal preemption grounds. It also moved for a preliminary injunction. The district court granted that motion and enjoined the CAADCA in full, concluding that NetChoice was likely to succeed on the merits of at least one of its facial theories under the First Amendment. NetChoice, LLC v. Bonta, 692 F. Supp. 3d 924, 965–66 (N.D. Cal. 2023). The State appealed. While that appeal was pending, the United States Supreme Court decided Moody v. NetChoice, LLC, 603 U.S. 707 (2024), where it clarified the standard for a facial challenge under the First Amendment. We applied the Moody standard in NetChoice I and determined that the district court did not conduct the proper analysis for a First Amendment facial challenge. See NetChoice I, 113 F.4th at 1108, 1123–24. We therefore vacated the majority of the preliminary injunction and remanded to the district court for further proceedings. Id. at 1108. However, we affirmed the preliminary injunction with respect to the DPIA requirement, concluding that it likely facially violates the First Amendment. Id. We likewise affirmed the district court’s decision to enjoin the enforcement of other

10 NETCHOICE, LLC V. BONTA provisions not grammatically severable from that requirement. Id. On remand, NetChoice filed a first amended complaint (FAC) and a second motion for a preliminary injunction. The FAC asserted a new facial First Amendment challenge to the CAADCA: that the Act’s coverage provision, making the Act applicable to online businesses that are “likely to be accessed by children,” is content based and fails strict scrutiny, thus rendering the CAADCA’s substantive provisions unconstitutional in every application. The FAC also asserted as-applied challenges to the CAADCA. NetChoice’s second preliminary injunction motion advanced these newly pleaded theories as additional grounds for enjoining the CAADCA’s enforcement. Ruling on that motion, the district court agreed with NetChoice that the coverage provision defining “likely to be accessed by children” is content based and triggers First Amendment scrutiny for the entire statute. The district court then held that the CAADCA likely fails strict scrutiny because it “applies to all online content likely to be accessed by consumers under the age of 18, and imposes significant burdens on the providers of that content,” and the State had failed to show that the CAADCA is narrowly tailored, in part because its “interest in protecting the privacy and well-being of children” could be advanced “by vigorous enforcement of existing, less restrictive regulations.” Because, as the district court noted, some courts have construed Moody to require analyzing facial challenges provision-by-provision, the district court also addressed NetChoice’s challenges to individual provisions of the CAADCA. It first concluded that all the CAADCA’s “[p]rovisions are subject to strict scrutiny because of the

NETCHOICE, LLC V. BONTA 11 content-based coverage definition.” The district court then determined that NetChoice was not likely to succeed on its facial First Amendment challenge to the data use restrictions or the dark patterns restriction but that NetChoice was likely to succeed on its First Amendment challenge to the age estimation requirement. However, the district court concluded that NetChoice was likely to succeed on its vagueness challenges to the data use restrictions and dark patterns restriction but not to the age estimation requirement. NetChoice also challenged, and the district court enjoined, the CAADCA’s policy enforcement requirement, Cal. Civ. Code § 1798.99.31(a)(9). Next, the district court turned to severability and held that no part of the CAADCA was volitionally separable from the enjoined notice-and-cure provision. The district court then addressed NetChoice’s claims that the CAADCA is preempted by Section 230 of the Communications Decency Act (Section 230), 47 U.S.C. § 230(c), preempted by the Children’s Online Privacy Protection Act (COPPA), 15 U.S.C. §§ 6501–06, and facially invalid under the Dormant Commerce Clause. In part because the parties dedicated insufficient briefing on these issues, and based on the record before it, the district court concluded that NetChoice was not likely to succeed on the merits of any of these claims. Similarly, because NetChoice had “devote[d] a single sentence of its [preliminary injunction] motion to its as-applied claims” and did not address the factors required for an as-applied

12 NETCHOICE, LLC V. BONTA challenge, the district court denied NetChoice’s motion on that ground. Because the district court concluded that NetChoice met the remaining preliminary injunction factors on its facial claim as to the coverage definition, on severability grounds, and on some of its challenges to the Act’s individual provisions, the district court granted NetChoice’s motion for a preliminary injunction and enjoined the CAADCA in its entirety. The State timely appealed. JURISDICTION & STANDARD OF REVIEW We have jurisdiction pursuant to 28 U.S.C. § 1292(a)(1). We “review the district court’s decision to grant a preliminary injunction for abuse of discretion.” Tucson v. City of Seattle, 91 F.4th 1318, 1324 (9th Cir. 2024) (quoting Daniels Sharpsmart, Inc. v. Smith, 889 F.3d 608, 613 (9th Cir. 2018)). The district court “‘abuses its discretion if it rests its decision on an erroneous legal standard or on clearly erroneous factual findings.’” Id. (quoting Am. Beverage Ass’n v. City & Cnty. of San Francisco, 916 F.3d 749, 754 (9th Cir. 2019) (en banc) (citation modified)). “A district court’s decision is based on an erroneous legal standard if: (1) the court did not employ the appropriate legal standards that govern the issuance of a preliminary injunction; or (2) in applying the appropriate standards, the court misapprehended the law with respect to the underlying issues in the litigation.” Cal. Chamber of Com. v. Council for Educ. & Rsch. on Toxics, 29 F.4th 468, 475 (9th Cir. NetChoice’s as-applied claims and its challenge to the CAADCA’s policy enforcement requirement, Cal. Civ. Code § 1798.99.31(a)(9), are not at issue in this appeal.

NETCHOICE, LLC V. BONTA 13 2022) (quoting Negrete v. Allianz Life Ins. Co. of N. Am., 523 F.3d 1091, 1096 (9th Cir. 2008) (citation modified)). ANALYSIS To obtain a preliminary injunction, NetChoice must show that (1) it is likely to succeed on the merits; (2) it is likely to suffer irreparable harm in the absence of preliminary relief; (3) the balance of equities tips in its favor; and (4) an injunction is in the public interest. See Winter v. Nat. Res. Def. Council, Inc., 555 U.S. 7, 20 (2008). The party seeking a preliminary injunction bears the burden of proving each element. See Klein v. City of San Clemente, 584 F.3d 1196, 1201 (9th Cir. 2009). As in its last round before our panel, the State does not meaningfully contest the latter three preliminary injunction factors. See NetChoice I, 113 F.4th at 1115. We therefore focus our analysis on whether NetChoice is likely to succeed on the merits of its facial challenges to the CAADCA as a whole and to its individual provisions. I. NetChoice is not likely to succeed on the merits of its facial challenge to the CAADCA’s coverage definition. Under the First Amendment, “[c]ontent-based laws— those that target speech based on its communicative content—are presumptively unconstitutional and may be justified only if the government proves that they are narrowly tailored to serve compelling state interests.” Reed v. Town of Gilbert, 576 U.S. 155, 163 (2015). In turn, “[g]overnment regulation of speech is content based if a law applies to particular speech because of the topic discussed or the idea or message expressed.” Id.; see also Sorrell v. IMS Health Inc., 564 U.S. 552, 566 (2011). Courts may determine whether a regulation is content based by

14 NETCHOICE, LLC V. BONTA considering whether it “draws distinctions based on the message a speaker conveys” “on its face.” Reed, 576 U.S. at 163. Even “subtle . . . distinctions” that “defin[e] regulated speech by its function or purpose” are “subject to strict scrutiny.” Id. at 163–64. The Supreme Court has also recognized “a separate and additional category of laws that, though facially content neutral, will be considered content-based regulations of speech: laws that cannot be justified without reference to the content of the regulated speech.” Id. at 164 (citation modified). “Those laws, like those that are content based on their face, must also satisfy strict scrutiny.” Id.; see also Sorrell, 564 U.S. at 566 (“Even if the hypothetical measure on its face appeared neutral as to content and speaker, its purpose to suppress speech and its unjustified burdens on expression would render it unconstitutional.”). Our First Amendment analysis proceeds in three steps. “The first step . . . is to determine whether the regulation implicates protected expression.” Recycle for Change v. City of Oakland, 856 F.3d 666, 669 (9th Cir. 2017). Thus, “[t]he threshold question is whether conduct with a ‘significant expressive element’ drew the legal remedy or the [statute] has the inevitable effect of ‘singling out those engaged in expressive activity.’” Int’l Franchise Ass’n, Inc. v. City of Seattle, 803 F.3d 389, 408 (9th Cir. 2015) (quoting Arcara v. Cloud Books, Inc., 478 U.S. 697, 706–07 (1986)). Next, we ask “whether the [statute] is content based or content neutral.” Recycle for Change, 856 F.3d at 669. If the statute is content based, we must determine whether it withstands strict scrutiny. Id. If it is content neutral, the statute need only satisfy intermediate scrutiny. See Project Veritas, 125 F.4th at 947.

NETCHOICE, LLC V. BONTA 15 But that is not all: NetChoice must also satisfy the requirements for a facial challenge as to each challenged provision. See Moody, 603 U.S. at 725⁠–⁠26. In Moody, the Supreme Court explained that district courts evaluating a facial challenge under the First Amendment must assess “whether a substantial number of [the law’s] applications are unconstitutional, judged in relation to the statute’s plainly legitimate sweep.” 603 U.S. at 723 (alterations in original) (citation modified) (quoting Ams. for Prosperity Found. v. Bonta, 594 U.S. 595, 615 (2021)). That analysis proceeds in two steps of its own. First, courts must “assess the state law[’s] scope” by asking “[w]hat activities, by what actors, do the laws prohibit or otherwise regulate?” Id. at 724. Second, courts must “decide which of the law[’s] applications violate the First Amendment, and . . . measure them against the rest.” Id. at 725. A facial challenge thus “demands record development on third-party speech and the full scope of a law’s potential applications.” NetChoice, LLC v. Bonta (NetChoice SB 976), 152 F.4th 1002, 1013 (9th Cir. 2025). Here, “[i]t is NetChoice’s burden to make those showings.” Id. A. NetChoice does not carry its burden for its facial challenge to the coverage definition under Moody. The CAADCA applies to any “business that provides an online service, product, or feature likely to be accessed by children.” Cal. Civ. Code § 1798.99.31(a). The Act For terms not expressly defined in the CAADCA, the Act incorporates the definitions provided by the California Consumer Privacy Act (CCPA), Cal. Civ. Code §§ 1798.100–1798.199.100. See id. § 1798.99.30(a). A “business” is a legal, for-profit entity that “collects consumers’ personal information” and “determines the purposes and

16 NETCHOICE, LLC V. BONTA defines “likely to be accessed by children” to mean that “it is reasonable to expect, based on [enumerated] indicators, that the online service, product, or feature would be accessed by children.” Id. § 1798.99.30(b)(4). The definition relies on application of the following indicators: (A) The online service, product, or feature is directed to children as defined by the Children’s Online Privacy Protection Act (15 U.S.C. Sec. 6501 et seq.). (B) The online service, product, or feature is determined, based on competent and reliable evidence regarding audience composition, to be routinely accessed by a significant number of children. (C) An online service, product, or feature with advertisements marketed to children. (D) An online service, product, or feature that is substantially similar or the same as an online service, product, or feature subject to subparagraph (B). (E) An online service, product, or feature that has design elements that are known to be of interest to children, including, but not limited to, games, cartoons, music, and celebrities who appeal to children. means of the processing of consumers’ personal information,” “that does business in the State of California,” and that meets a certain threshold for revenue or for the number of transactions involving personal information. See id. §§ 1798.99.30(a), 1798.140(d).

NETCHOICE, LLC V. BONTA 17 (F) A significant amount of the audience of the online service, product, or feature is determined, based on internal company research, to be children. Id. On appeal, the State argues that this coverage definition does not regulate protected speech; in the State’s view, “it does not regulate anything” but rather “clarifies which businesses are subject to the Act’s substantive regulatory provisions.” NetChoice contends, and the district court concluded, that by virtue of the coverage definition, the Act “burdens speech based on content in every application.” The district court held that “[a]pplication of [the enumerated indicators] to determine whether a particular business’s online offerings are likely to be accessed by children unavoidably requires an evaluation of content.” The district court reasoned that the coverage definition “single[s] out particular subject matter, specifically online content that is likely to be accessed by children” and observed that “[a] business will be treated differently under the CAADCA if it provides online services, products, or features with design elements that are known to be of interest to children, such as games, cartoons, music, or other content that appeals to children, or the business knows that a significant portion of its audience is children.” And because it determined any application of the Act’s substantive provisions “that do not implicate protected speech” “will be substantially outweighed by the applications of the [substantive provisions] that do implicate protected speech,” the district court concluded that NetChoice met the standard for a facial challenge set forth in Moody.

18 NETCHOICE, LLC V. BONTA We disagree. Unlike the enjoined DPIA report requirement, which “raise[d] the same First Amendment issues” “in every application to a covered business,” NetChoice I, 113 F.4th at 1116, the coverage definition does not. First, the State persuasively argues that whether “it is reasonable to expect” that a business’s “online service, product, or feature would be accessed by children,” Cal. Civ. Code § 1798.99.30(b)(4), “says nothing about the nature of the business providing that service, product, or feature.” Indeed, as the State proffers, children “are capable of using ride sharing service[s] like Lyft or Waymo, electronic ticketing services such as StubHub or Ticketmaster, financial transaction services such as Paypal or Venmo, fitness products such as NFL Play 60 or Peloton, health- related services such as iHealth, or education-related products such as Wolfram Mathematica.” The CAADCA’s substantive requirements would “appl[y] evenhandedly” to any of these businesses if they are likely to be accessed by children, regardless of the content available through their online service. Heffron v. Int’l Soc’y for Krishna Consciousness, Inc., 452 U.S. 640, 649 (1981); see also Hill v. Colorado, 530 U.S. 703, 723 (2000) (finding regulation that “clearly does not prohibit . . . either a particular viewpoint or any subject matter that may be discussed by a speaker” content neutral and observing that “the statute To the extent NetChoice argues that the coverage definition raises the same First Amendment issues in every application because it compels every covered business to comply with the CAADCA’s substantive provisions, that argument fails as a challenge to the coverage definition itself. Such a challenge is more appropriately raised against the substantive provisions with which NetChoice finds issue—as it did in the previous appeal with respect to the DPIA report requirement and as it does in this appeal with respect to the age estimation requirement, data use restrictions, and dark patterns restriction, discussed below.

NETCHOICE, LLC V. BONTA 19 applies equally to used car salesmen, animal rights activists, fundraisers, environmentalists, and missionaries”). The CAADCA’s coverage definition consists of six separately enumerated indicators enabling online businesses to determine whether or not they are subject to the Act. Because each indicator demands different inquiries of online businesses, the coverage definition cannot apply to every online business in the same way. For example, an online business is “likely to be accessed by children” pursuant to indicator (B) where it “is determined, based on competent and reliable evidence regarding audience composition, to be routinely accessed by a significant number of children.” Cal. Civ. Code § 1798.99.30(b)(4)(B). Similarly, a business meets the coverage definition under indicator (F) where “[a] significant amount of the audience of the online service, product, or feature is determined, based on internal company research, to be children.” Id. § 1798.99.30(b)(4)(F). Determining whether a service is “routinely accessed by a significant number of children” requires looking to demographic data concerning online traffic to the business’s product—that is data received by the business, not content the business publishes. See id. § 1798.99.30(b)(4)(B). The record establishes—and NetChoice nowhere denies—that frequently, this is data that online businesses already have. See also NetChoice SB 976, 152 F.4th at 1022 (concluding that NetChoice’s facial challenge to age-verification provisions in California’s Protecting Our Kids from Social Media Addiction Act is unripe in part because “NetChoice members can verify users’ age in the background without requiring user input”). The same is true of determining

20 NETCHOICE, LLC V. BONTA whether “[a] significant amount of the audience” is “children.” Cal. Civ. Code § 1798.99.30(b)(4)(F). However, an online business also comes within the coverage definition if it provides “advertisements marketed to children” or has “design elements that are known to be of interest to children, including, but not limited to, games, cartoons, music, and celebrities who appeal to children.” Id. § 1798.99.30(b)(4)(C), (E). These indicators may indeed require online businesses to review the content that they publish to determine whether it is directed at or otherwise appealing to children. But that is a different question altogether from whether a significant amount of a business’s online patrons are children. A business that satisfies the “significant amount” test would have no need to evaluate whether its product is “directed to children,” “marketed to children,” or “has design elements that are known to be of interest to children” to determine if the CAADCA applies to it. Id. § 1798.99.30(b)(4). Nowhere does the definition require that all six indicators must be present for the Act to apply, or even that a combination of several factors is required. See id. The content and structure of the provision—listing six separate possible indicators—confirms this reading. For example, NetChoice asserts that “audience composition” “turn[s] in significant measure on the service’s content,” but it offers no legal authority or factual support for that contention. On the contrary, as to indicators (B) and (F), “[t]he plain language of the statute dictates that its application turns on” whether the online service is accessed or used by a significant number of children, “and not the subject matter” of the business’s content, to the extent the business is even a publisher. Project Veritas, 125 F.4th at 951. In its answering brief, NetChoice itself reads the coverage indicators as independently sufficient.

NETCHOICE, LLC V. BONTA 21 indicator (D) defines coverage by reference to businesses “substantially similar” to those satisfying indicator (B) alone, thus creating a derivative category that would be superfluous unless indicator (B) is independently sufficient. Id. § 1798.99.30(b)(4)(B), (D). Indicators (B) and (F) likewise address the same underlying question—whether children make up a significant share of a platform’s audience—but through different evidentiary sources. Id. § 1798.99.30(b)(4)(B), (F). Reading them as cumulative would allow a business with, for example, substantial company evidence of child users to escape coverage simply by contesting external demographic data, an absurd statutory result. And indicator (A) incorporates COPPA’s “directed to children” standard, see 15 U.S.C. § 6501(10), which overlaps in part with indicators (C) and (E), see Cal. Civ. Code § 1798.99.30(b)(4)(A), (C), (E); if all six indicators were required, satisfying (A) alone could never independently trigger coverage, rendering it surplusage. The most natural reading of the provision is that application of any one indicator is sufficient for the business to come within the CAADCA’s scope. And because the question that each indicator requires an online business to ask demands a different answer, we cannot say that the coverage definition likely raises the same First Amendment issues in every possible application. To illustrate the point, recall the State’s examples of online services, including ride sharing services, electronic ticketing services, and financial transaction services, all of which may be subject to the CAADCA pursuant to indicators (B) or (F) but which may not otherwise be directed at or marketed to children. NetChoice does not squarely address any of these examples. Instead, NetChoice responds that “the Act does not ask whether minors ‘are capable of

22 NETCHOICE, LLC V. BONTA using’ some service” but rather whether the service is likely to be accessed by minors “pursuant to content-based indicia.” But NetChoice misreads the coverage definition— which, as explained, does not compel online businesses to apply any potentially content based indicia if the business is routinely accessed by a significant number of children. It may well be the case that a significant number of children do not routinely access ride sharing services, electronic ticketing services, financial transaction services, or any other online service the State identified. But the district court made no factual findings on those questions, and that information is not otherwise in the record. “The First Amendment analysis is fact intensive and will surely vary from platform to platform.” NetChoice SB 976, 152 F.4th at 1014 (citation modified). And it is NetChoice’s burden to establish that factual record so that the district court could have properly considered every conceivable application of the CAADCA’s coverage definition. NetChoice’s focus on applications of the CAADCA that may implicate protected expression does not relieve it from the burden to demonstrate that these applications “substantially outweigh” applications that do not, as Moody requires. NetChoice I, 113 F.4th at 1115. As we cautioned in NetChoice I, “the focus on whether and how these provisions may impact” “social media companies,” “without considering any other potential applications, treats NetChoice’s challenges ‘more like as-applied claims than like facial ones.’” Id. at 1123 (quoting Moody, 603 U.S. at 724). “[N]either parties nor courts can disregard the requisite inquiry into how a law works in all of its applications.” Moody, 603 U.S. at 744.

NETCHOICE, LLC V. BONTA 23 NetChoice makes the same critical error here. It focuses only on “possible applications” of the coverage definition to companies that publish content, “a subset of the businesses covered by the CAADCA,” and “speculate[s] about how that subset of applications could ultimately have a substantial effect on those companies’” protected expression. NetChoice I, 113 F.4th at 1123. But in a facial challenge, NetChoice may not “treat[] the law[] as having certain heartland applications, and mostly confine[] the[] battle to that terrain.” Moody, 603 U.S. at 724. For similar reasons, NetChoice’s reliance on several cases where district courts have found that a statute’s gateway definition triggers First Amendment review and subjects the entire statute to strict scrutiny is misplaced. In each of these cases, the district court interpreted statutes specifically targeting social media companies, and in each, the court found that the central coverage definition facially distinguished between types of speech. These cases largely did not assess coverage See NetChoice, LLC v. Carr, 789 F. Supp. 3d 1200 (N.D. Ga. 2025); NetChoice, LLC v. Fitch, 787 F. Supp. 3d 262 (S.D. Miss. 2025); NetChoice, LLC v. Yost, 778 F. Supp. 3d 923, 953‒54 (S.D. Ohio 2025); SEAT v. Paxton, 765 F. Supp. 3d 575 (W.D. Tex. 2025); NetChoice, LLC v. Griffin, 2025 WL 978607 (W.D. Ark. Mar. 31, 2025); CCIA v. Paxton, 747 F. Supp. 3d 1011, 1032–34 (W.D. Tex. 2024); NetChoice, LLC v. Reyes, 748 F. Supp. 3d 1105 (D. Utah 2024). See Carr, 789 F. Supp. 3d at 1222 (finding statute content based on its face because it distinguished between user-generated content and social- media-provider-generated content); but see id. (distinguishing from case where the statute defined “social media platforms,” inter alia, “by the demographics of their users,” finding this was a “key difference” between the statutes) (emphasis added); Fitch, 787 F. Supp. 3d at 275 (finding statute content based because it classifies based on whether the entity disseminates “‘social interaction’ as opposed to ‘news, sports, commerce, [or] online video games’” (alteration in original) (citation modified)); Yost, 778 F. Supp. 3d at 953–54 (exceptions to statute’s

24 NETCHOICE, LLC V. BONTA definitions based on the age demographics of a business’s user base. The one case that did so rejected the argument that such a classification was content based. See NetChoice, LLC v. Yost, 716 F. Supp. 3d 539, 556 (S.D. Ohio 2024). Moreover, in another recent case involving NetChoice, a different panel of our court considered the central coverage definition in California’s Protect Our Kids from Social Media Addiction Act, Cal. Health & Safety Code §§ 27000– 07, which made the statute applicable “to any internet website including . . . a social media platform that personalizes feeds based on information provided by the user.” NetChoice SB 976, 152 F.4th at 1016 (citation modified). NetChoice argued on appeal that “the Act’s focus on social media makes the entire act content based.” Id. The panel rejected that argument, explaining that the use of “‘social media’ platform as statutory shorthand does not render the Act content based, since it applies to websites whether they facilitate social interaction or other forms of content.” Id. Accordingly, the “Act as a whole” was not coverage for “product review websites and ‘widely recognized’ media outlets” and exceptions that “distinguish between the subset of websites without private chat features based on their content” were content based); Griffin, 2025 WL 978607, at *9 (coverage definition content based on its face because whether a social media platform is covered depends on whether the platform is primarily used for interacting socially with other profiles); CCIA, 747 F. Supp. 3d at 1032 (coverage definition that distinguishes between digital service providers who host “social speech” but not “non-social interactions” was content based); SEAT, 765 F. Supp. 3d at 592–94 (reaching the same conclusion as CCIA); Reyes, 748 F. Supp. 3d 1105 at 1121 (coverage definition that “draws distinctions between websites that allow users to interact socially and websites that serve another function or purpose, such as those that allow users to shop, read the news, access entertainment, educate themselves, or conduct business” was content based).

NETCHOICE, LLC V. BONTA 25 content based by way of its coverage definition. Id. The CAADCA’s coverage definition applies even more broadly, regardless of whether an online business publishes content of any kind or none at all. At bottom, to properly assert a facial challenge, it is NetChoice’s burden to establish the CAADCA’s “full range” by way of its coverage definition. NetChoice I, 113 F.4th at 1123. If NetChoice’s prime concern is the CAADCA’s effect on social media companies or publishers, it could have brought an as-applied challenge on behalf of some of its members. Cf. NetChoice SB 976, 152 F.4th at 1020 (“[F]acial challengers cannot focus on a law’s effect on their own platforms—they cannot even limit the inquiry to the tech giants. They must canvass ‘the full range of activities’ covered by the law and ‘measure the constitutional against the unconstitutional applications.’” (quoting Moody, 603 U.S. at 724)). Instead, NetChoice pursued a more difficult path. That strategic decision “comes at a cost.” Moody, 603 U.S. at 723. It requires NetChoice to “develop a record that would allow the court to ‘determine [the] law’s full set of applications,’ cataloging what ‘activities, by what actors’ the law regulates.” NetChoice SB 976, 152 F.4th at 1021 (alteration in original) (quoting Moody, 603 U.S. at 718, 724). We “cannot speculate whether a law unduly burdens expression without a developed record that explains not only how [NetChoice’s] platforms work, but also how a wide range of third-party For all of NetChoice’s focus on content, nowhere does it explain the kind of content with which it is concerned, such as user-generated content, content published by online businesses, or online businesses’ editorial choices. We are therefore in no position to consider whether, or how, the CAADCA’s coverage definition might apply differently even across different categories of online “content.”

26 NETCHOICE, LLC V. BONTA services operate. This information is necessary to characterize the denominator of a law’s applications.” Id. at 1020 (citation modified). To be sure, as we observed in NetChoice SB 976, “[d]oing so would entail the ‘daunting, if not impossible’ task of canvassing how the Act applies to an ‘ever-growing number of apps, services, functionalities, and methods for communication and connection.’” Id. at 1021 (first quoting Moody, 603 U.S. at 745 (Barrett, J., concurring); and then quoting Moody, 603 U.S at 725 (majority opinion)). We recognized that “such a showing” might be “unrealistic.” Id. But we nevertheless stated then, and maintain now, that “[i]t is a mystery how NetChoice could expect to prevail on a facial challenge without candidly disclosing the platforms that it thinks the challenged laws reach” and whether the coverage definition unduly burdens those platforms’ expression. Id. at 1021–22 (alteration in original) (quoting Moody, 603 U.S. at 787 (Alito, J., concurring)). We need not decide today whether any of the coverage definition’s enumerated indicators necessarily target expressive activity. “[A]ll we recognize is that some” of the indicators “may be expressive, while others are not, and that inquiry is fact intensive.” Id. at 1021. Because NetChoice stumbles at both steps of the facial analysis, we end our analysis where we began—with Moody. Accordingly, we vacate the preliminary injunction with respect to the entire CAADCA and remand for the district court to consider the scope of the CAADCA’s coverage definition anew and to weigh any unconstitutional applications against the constitutional ones.

NETCHOICE, LLC V. BONTA 27 II. NetChoice’s challenges to individual provisions are likely to succeed on the merits with respect to the data use and dark patterns restrictions but not the age estimation requirement. In the alternative to NetChoice’s coverage-definition theory, the district court concluded that NetChoice was likely to prevail on its facial challenges to seven individual provisions on First Amendment or vagueness grounds. The State appeals with respect to the age estimation requirement, Cal. Civ. Code § 1798.99.31(a)(5); the data use restrictions, id. § 1798.99.31(b)(1)⁠–⁠(4); and the dark patterns restriction, id. § 1798.99.31(b)(7); so those are the provisions we consider. We vacate the preliminary injunction order with respect to the age estimation requirement and remand for further consideration. We affirm the preliminary injunction with respect to the four challenged data use restrictions and the dark patterns restriction. A. NetChoice is not likely to succeed on the merits of its facial challenge to the age estimation requirement. The CAADCA requires covered businesses to “[e]stimate the age of child users with a reasonable level of certainty appropriate to the risks that arise from the data management practices of the business or apply the privacy and data protections afforded to children to all consumers.” Id. § 1798.99.31(a)(5). Before the district court, NetChoice challenged this requirement as facially invalid in all applications. The district court rejected the State’s argument that “estimating a user’s age is conduct, not expressive activity,” finding that the requirement that businesses do so “for the purpose of determining what content is appropriate for [children of different] age[s] . . . imposes limits on the

28 NETCHOICE, LLC V. BONTA content a covered business may publish and the content each user may view.” The district court applied strict scrutiny and, because it found that age estimation “will require businesses to collect private information that users may not wish to share,” concluded that the State had not “met its burden to show that age estimation furthers its interest in the privacy and well-being of children.” The district court further held that the State failed to offer any evidence that there were no less restrictive alternatives. As for the Moody analysis, the district court found that “the provision will impose the same barriers to speech on all covered businesses and their audiences” and that, “because all applications of § 1798.99.31(a)(5) will impose barriers to protected speech, the provision has no legitimate sweep.” On appeal, the State maintains that the age estimation requirement does not trigger First Amendment scrutiny and that, though the requirement “triggers the Act’s other substantive provisions for a particular user,” any impact on expressive activity “is the result of the other substantive provisions in the Act, not the age estimation requirement.” The State further contends that even if the First Amendment applies, the age estimation provision is not content based and, in any event, that it furthers the State’s compelling interest in protecting children’s privacy and is sufficiently tailored to that goal. On the record before us, we cannot say that the age estimation requirement facially violates the First Amendment at all, much less in a substantial majority of its applications. For one, it is unclear that the age estimation requirement prevents access to content. The provision requires covered businesses to either “[e]stimate the age of child users with a reasonable level of certainty” or “apply the privacy and data protections afforded to children to all

NETCHOICE, LLC V. BONTA 29 consumers.” Id. § 1798.99.31(a)(5). On appeal, NetChoice repeats the district court’s framing of the provision as “requiring a business to estimate age for the purpose of determining what content is appropriate for that age,” but the provision says nothing about restricting content on its face. See NetChoice I, 113 F.4th at 1122 (observing that “most of [the provisions NetChoice challenges],” including the age estimation provision, “by their plain language, do not necessarily impact protected speech in all or even most applications”). Rather, it requires covered businesses to apply the Act’s privacy and data protections—“half of which,” the State points out, “are not even challenged by NetChoice in this suit.” The provision is clear that businesses that do not wish to conduct age estimation may publish any content they would like, as long as they default to data and privacy protections for all users. Cal. Civil Code § 1798.99.31(a)(5). We are therefore not convinced that the age estimation provision necessarily burdens protected expression on its face by requiring covered businesses to determine “what content is appropriate” for children. NetChoice’s reading of Free Speech Coalition v. Paxton, 606 U.S. 461 (2025), also does not persuade. Free Speech Coalition considered a statute that required covered entities to make adult website visitors submit to an age verification system using either “government-issued identification” or “a commercially reasonable method that relies on public or private transactional data.” Id. at 467 (quoting Tex. Civ. Prac. & Rem. Code § 129B.003(b)(2)). The Supreme Court observed only that, with respect to that system, there is an “incidental burden that age verification necessarily has on an adult’s First Amendment right to access speech that is obscene only to minors.” Id. at 495. The Court said nothing about the effect of age estimation on First Amendment

30 NETCHOICE, LLC V. BONTA burdens generally, especially where age estimation is not required as a precondition to access content. To the contrary, the Court observed that “adults have no First Amendment right to avoid age verification, and the [challenged law] can readily be understood as an effort to restrict minors’ access.” Id. at 483. To the extent NetChoice argues that the age estimation requirement “require[s] consideration of content or proxies for content,” see NetChoice I, 113 F.4th at 1118, the age estimation requirement may impliedly regulate speech—but we cannot confidently draw that conclusion on this record, either. Recall that the age estimation provision requires “[e]stimat[ing] the age of child users with a reasonable level of certainty appropriate to the risks that arise from the data management practices of the business[.]” Cal. Civ. Code § 1798.99.31(a)(5) (emphasis added). The DPIA report provision that we enjoined in NetChoice I also required covered businesses to assess “the risks of material detriment to children that arise from the data management practices of the business” and required DPIA reports to address several factors, “to the extent applicable,” including product design, algorithms, automatic playing of media, and harmful content on the platform. Id. § 1798.99.31(a)(1)(B) (emphasis added). We determined in NetChoice I that the “DPIA report requirement regulates the speech of covered businesses and thus triggers review under the First Amendment,” and we explained that the enumerated “factors require consideration of content or proxies for content.” 113 F.4th at 1118. We rejected the State’s argument that the DPIA report requirement “contains no reference to content” but rather “requires a company to mitigate risks from its data management practices.” Id. (emphases omitted). That was

NETCHOICE, LLC V. BONTA 31 because “§ 1798.99.31(a)(2) specifically defines data management practices by reference to the statutory factors a covered business must address under [the DPIA report requirement] when assessing those risks.” Id. To the extent the term “data management practices” in the age estimation provision is also defined by the statutory factors in § 1798.99.31(a)(1)(B), NetChoice may have a reasonable argument that the age estimation provision triggers review under the First Amendment. On the other hand, § 1798.99.31(a)(2) specifically refers to “data management practices of the business identified in the [DPIA] required by [§ 1798.99.31(a)(1)],” while the age estimation requirement does not cross reference § 1798.99.31(a)(1). It is therefore not certain whether “data management practices” takes on its plain meaning with respect to age estimation or whether it impliedly cross- references the statutory factors in § 1798.99.31(a)(1)(B)— which we have read to trigger First Amendment review. The parties do not develop these arguments, and the district court did not address this precise question. Accordingly, we vacate the preliminary injunction as to the age estimation provision and remand to the district court to consider this question in the first instance. However, we also emphasize that § 1798.99.31(a)(5) allows a covered business to avoid age estimation altogether if it defaults to “apply[ing] the privacy and data protections afforded to children to all consumers.” On remand, the parties and the district court may wish to consider the effect of that opt-out language on any burden on expression that may arise from the age estimation requirement. We also remand for further consideration of the age estimation provision in light of Moody. In what must now

32 NETCHOICE, LLC V. BONTA sound a familiar refrain, “the record needs further development to allow the district court to determine ‘the full range of activities the law[] cover[s].’” NetChoice I, 113 F.4th at 1123 (alterations in original) (quoting Moody, 603 U.S. at 724). In NetChoice I, we made that clear with respect to the CAADCA’s age estimation requirement specifically. See id. at 1122–23. In this appeal, there was no detailed record that would have allowed the district court to consider how the age estimation provision works in “all of its applications” in order to address its scope, including with respect to the term “data management practices.” Moody, 603 U.S. at 744 (emphasis added); see also NetChoice SB 976, 152 F.4th at 1021–22. Courts must be able to “carefully parse not only what entities are regulated, but how the regulated activities actually function before deciding if the activity in question constitutes expression and therefore comes within the First Amendment’s ambit.” Moody, 603 U.S. at 749 (Jackson, J., concurring in part and concurring in the judgment). Absent a developed record on the various applications of the age estimation requirement—including applications that do not prevent access to content or require data collection for compliance—NetChoice cannot succeed on this facial attack. Likewise, the district court erred by assuming that the only way covered businesses could comply with the provision is by “collect[ing] private information that users may not wish to share,” resulting in “businesses . . . gather[ing] and creat[ing] a trove of sensitive data regarding children.” The State put forth evidence of methods for conducting age estimation that would be acceptable under § 1798.99.31(a)(5) and would require no additional data collection. The district court’s

NETCHOICE, LLC V. BONTA 33 discussion of the State’s evidence was limited and did not address this point. Consequently, we cannot determine, from our appellate posture, whether the age estimation requirement facially violates the First Amendment. We vacate the preliminary injunction as to Cal. Civ. Code § 1798.99.31(a)(5). B. NetChoice is likely to succeed on the merits of its vagueness challenges to the CAADCA’s data use restrictions and dark patterns restriction. We turn next to the preliminary injunction as to the CAADCA’s data use restrictions and the dark patterns restriction on constitutional vagueness grounds. “A fundamental principle in our legal system is that laws which regulate persons or entities must give fair notice of conduct that is forbidden or required.” FCC v. Fox Television Stations, Inc., 567 U.S. 239, 253 (2012). That principle “requires the invalidation of laws that are impermissibly vague.” Id. “A statute can be impermissibly vague . . . if it fails to provide people of ordinary intelligence a reasonable opportunity to understand what conduct it prohibits” or “if it authorizes or even encourages arbitrary and discriminatory enforcement.” Hill, 530 U.S. at 732; accord Matsumoto v. Labrador, 122 F.4th 787, 805 (9th Cir. 2024). When “vagueness permeates the text” of a law, “it is subject to facial attack.” City of Chicago v. Morales, 527 U.S. 41, 55 (1999) (plurality opinion). And “[w]hen speech is involved, rigorous adherence to [the void for vagueness doctrine] is necessary to ensure that ambiguity does not chill protected speech.” Fox Television, 567 U.S. at 253–54.

34 NETCHOICE, LLC V. BONTA 1. Data Use Provisions The challenged data use provisions restrict the ways in which, and for what purposes, covered businesses may use a child’s personal information. Cal. Civ. Code § 1798.99.31(b)(1)⁠–⁠(4). The relevant provisions state: (b) A business that provides an online service, product, or feature likely to be accessed by children shall not take any of the following actions: (1) Use the personal information of any child in a way that the business knows, or has reason to know, is materially detrimental to the physical health, mental health, or well-being of a child. (2) Profile a child by default unless both of the following criteria are met: (A) The business can demonstrate it has appropriate safeguards in place to protect children. (B) Either of the following is true: (i) Profiling is necessary to provide the online service, product, or feature requested and only with respect to the aspects of the online service, product, or feature with which the child is actively and knowingly engaged. (ii) The business can demonstrate a compelling reason that profiling is in the best interests of children.

NETCHOICE, LLC V. BONTA 35 (3) Collect, sell, share, or retain any personal information that is not necessary to provide an online service, product, or feature . . . unless the business can demonstrate a compelling reason that the collecting, selling, sharing, or retaining of the personal information is in the best interests of children likely to access the online service, product, or feature. (4) If the end user is a child, use personal information for any reason other than a reason for which that personal information was collected, unless the business can demonstrate a compelling reason that use of the personal information is in the best interests of children. Id. (emphases added). NetChoice challenged these provisions for their reliance on the undefined terms “material detriment,” “best interests,” and “well-being.” The district court agreed with NetChoice and concluded that these “terms have no established meaning and the CAADCA provides no guidance.” It explained that reasonable minds can disagree on what might be detrimental to a child’s health or well- being and rejected the State’s argument that the “best interests” of a child should be understood similarly to the same “legal term of art that is well-established in family law.” The State contends that “material detriment” and “physical health, mental health, or well-being” each have an

36 NETCHOICE, LLC V. BONTA accepted plain meaning such that, taken together, the phrase means that “it causes meaningful harm to a child’s physical state, mental state, or overall condition of health and happiness.” The State cites examples like “using a child’s information to connect them to a person that seeks to abuse the child, such as through sexploitation,” or “[u]sing a child’s information to recommend illegal products such as tobacco, alcohol, or gambling[.]” But these are extreme examples at the margins of what might be materially detrimental to a child’s well-being. The more difficult questions arise with examples like sleep loss, distraction, or hurt feelings. As the district court reasoned, and NetChoice argues on appeal, the CAADCA does not provide any guidance as to the breadth of conduct that “material[] detriment[] to the physical health, mental health, or well- being of a child” may reach. Cal. Civ. Code § 1798.99.31(b)(1). And NetChoice persuasively argues that the risk of subjective enforcement is particularly high because, as it contemplates “material detriment” to “a child,” the provision must be assessed as to any single child whose personal information is accessed by a covered online practice. Cf. NetChoice I, 113 F.4th at 1120 (observing that the DPIA requirement “that covered businesses opine on whether their services risk ‘material detriment to children’” is “vague and onerous”). The State next maintains that the term “best interests of children” should be understood in accordance with California’s standard “to determine child custody arrangements, to make guardianship decisions, and in delinquency proceedings.” Though, as the district court recognized, the “best interests of the child” standard is clear for the purpose of family law proceedings, the State does not persuasively explain why that case-by-case standard

NETCHOICE, LLC V. BONTA 37 translates to data privacy regulation. On the contrary, the State’s reading is incompatible with the data use restrictions’ apparent goals. When evaluating the “best interests of the child” in family law proceedings, California courts recognize that “bright line rules in this area are inappropriate” and that “each case must be evaluated on its own unique facts.” In re Marriage of LaMusga, 88 P.3d 81, 91 (Cal. 2004) (citation modified). The standard operates through a specific child’s circumstances and factual record. See id. The data use restrictions ask something categorically different: covered businesses must determine prospectively whether a given practice is in “the best interests of” not any one child but “children”—a class of users that includes every child anywhere who can access a covered online practice. Cal. Civ. Code § 1798.99.31(b)(1)⁠–⁠(4) (emphasis added). Then covered businesses must tailor their practice accordingly. Applied at that scale, without the individualized, highly specific factual record giving the standard meaning in contexts such as a family law case, “best interests of children” cannot provide “sufficient notice of what is proscribed,” Fox Television, 567 U.S. at 254. The State’s argument that the provision’s scienter requirement mitigates vagueness is not persuasive. To be sure, “a scienter requirement may mitigate a law’s vagueness, especially with respect to the adequacy of notice to the complainant that his conduct is proscribed.” Vill. of Hoffman Estates v. Flipside, Hoffman Estates, Inc., 455 U.S. 489, 499 (1982); see also Hill, 530 U.S. at 732. But “[t]he degree of vagueness that the Constitution tolerates” also “depends in part on the nature of the enactment.” Vill. of Hoffman Estates, 455 U.S. at 498. The critical flaw of the restriction here is that the “what [that] must be proven is . . . vague.” United States v. Jae Gab Kim, 449 F.3d 933,

38 NETCHOICE, LLC V. BONTA 943 (9th Cir. 2006). Put another way, the “reason to know” language cannot mitigate vagueness where what is “materially detrimental” to any single child’s “well-being” is not clear. Cal. Civ. Code § 1798.99.31(b)(1). The State contends that “reason to know” is frequently defined to mean “[i]nformation from which a person of ordinary intelligence . . . would infer that the fact in question exists or that there is a substantial enough chance of its existence that, if the person exercises reasonable care, the person can assume the fact exists.” Reason To Know, BLACK’S LAW DICTIONARY (12th ed. 2024); see also, e.g., RESTATEMENT (SECOND) OF TORTS § 12 (1965). And because a business of ordinary intelligence could “base [its] behavior on [its] factual knowledge of the situation at hand and thereby avoid violating the law,” the argument goes, the data use prohibitions are clear as to the scope of conduct they regulate. Jae Gab Kim, 449 F.3d at 943. But as written, it is not sufficient for a covered business “to be aware only of the objective facts that would fairly put [it] on notice of the use for which” child user data is utilized. Cf. Stoianoff v. Montana, 695 F.2d 1214, 1221 (9th Cir. 1983) (describing the effect of a “reasonably should know” mens rea element in a Montana drug paraphernalia statute); Jae Gab Kim, 449 F.3d at 943 (“Whether a defendant is guilty of having ‘reasonable cause to believe’ that pseudoephedrine [in the defendant’s possession] will be used to produce illicit drugs [in violation of 21 U.S.C. § 841(c)(2)] turns on the facts actually known by the defendant in a particular case.” (citation modified)). The structure of the provision is clear: its mens rea element applies to a covered business’s knowledge that the use of the personal information of a child would cause a particular child material harm. Cal. Civ. Code § 1798.99.31(b)(1). Absent any statutory guidance on the

NETCHOICE, LLC V. BONTA 39 meaning of “material[] detriment[],” the provision’s scienter requirement does not solve its vagueness. 2. Dark Patterns Restriction The parties make similar arguments respecting the CAADCA’s dark patterns restriction. That provision prohibits covered businesses from: Us[ing] dark patterns to lead or encourage children to provide personal information beyond what is reasonably expected to provide that online service, product, or feature to forego privacy protections, or to take any action that the business knows, or has reason to know, is materially detrimental to the child’s physical health, mental health, or well-being. Cal. Civ. Code § 1798.99.31(b)(7) (emphases added). The district court found this provision unconstitutionally vague because it does not provide any guidance to covered businesses regarding when they would have “reason to know” that their user interface will have a “materially detrimental” effect on a child’s health or well-being. On appeal, the State argues that “dark patterns” is a defined term in the CAADCA ; that the phrase “materially detrimental to the child’s physical health, mental health, or well-being” has a clear, plain language meaning; and that the provision’s mens rea requirement—that the business had “reason to The Act incorporates a definition of a “dark pattern” as “a user interface designed or manipulated with the substantial effect of subverting or impairing user autonomy, decisionmaking, or choice, as further defined by regulation.” Cal. Civ. Code § 1798.140(l); id. § 1798.99.30(a).

40 NETCHOICE, LLC V. BONTA know” its design choice would cause material harm to a child’s well-being—mitigates against vagueness. As with the data use restrictions, the State’s plain- meaning argument is unconvincing where the range of harms that could plausibly qualify as “materially detrimental” is vast, spanning everything from financial exploitation to sleep loss, distraction, or hurt feelings. The fact that “dark pattern” is a defined term in the CAADCA does not help a covered business distinguish between these harms. And the prohibition’s use of the singular “child,” like in the data use restrictions, suggests that it is actionable based on a single child’s response to an online interface, meaning that a business designing a product accessed by millions of child users could face liability whenever any one of them experiences a harm that a regulator deems “material.” See Cal. Civ. Code § 1798.99.31(b)(7). Businesses of ordinary intelligence cannot reliably determine what compliance requires. See Grayned v. City of Rockford, 408 U.S. 104, 108 (1972). The “reason to know” scienter requirement also cannot cure this vagueness. The State argues that the restriction does not require a covered business “to figure out if a particular user interface will harm a child” but merely directs the covered business to “act in accordance with its existing knowledge”; in other words, “[w]hen a business lacks knowledge of any harm, the restriction does not apply.” But the “reason to know” language here applies to a covered business’s knowledge that “any action” it takes utilizing dark patterns would cause a particular child material harm. See Cal. Civ. Code § 1798.99.31(b)(7). Absent statutory guidance on the meaning of “material[] detriment[],” the provision remains vague. See id. We therefore affirm the district court’s injunction with respect to the data use and dark patterns restrictions on

NETCHOICE, LLC V. BONTA 41 vagueness grounds. “A fundamental requirement of due process is that a statute must clearly delineate the conduct it proscribes.” Foti v. City of Menlo Park, 146 F.3d 629, 638 (9th Cir. 1998) (citation modified). These provisions do not do so. III. It remains unclear whether the notice-and-cure provision is severable from the CAADCA’s valid remainder. We turn next to severability. Specifically, the parties dispute whether the remaining, valid provisions of the CAADCA are separable from the notice-and-cure provision we enjoined in NetChoice I. That provision would have required a noncompliant business to “cure[] any noticed violation and provide[] the Attorney General a written statement that the alleged violations have been cured, and sufficient measures have been taken to prevent future violations” within 90 days of written notice of the alleged violation from the Attorney General. Cal. Civ. Code § 1798.99.35(c)(2). In NetChoice I, we affirmed the district court’s severability analysis to the extent that it enjoined § 1798.99.35(c) on the basis that it was not grammatically severable from the DPIA report requirement. 113 F.4th at 1125; accord NetChoice, 692 F. Supp. 3d at 960–61. Severability of a state statute is governed by state law. See Vivid Ent., LLC v. Fielding, 774 F.3d 566, 574 (9th Cir. 2014). Under California law, an invalid statutory provision may be severed if the invalid provision is “grammatically, functionally, and volitionally separable.” Cal. Redevelopment Ass’n v. Matosantos, 267 P.3d 580, 607 (Cal. 2011) (quoting Calfarm Ins. Co. v. Deukmejian, 48 Cal.3d 805, 821 (1989) (en banc)). The parties dispute only volitional severability.

42 NETCHOICE, LLC V. BONTA “Volitional separability depends on whether the remainder would have been adopted by the legislative body had the latter foreseen the partial invalidation of the statute.” Id. at 608 (citation modified). While the presence of a severability clause “establishes a presumption in favor of severance,” id. at 607, “the absence of such a clause is not conclusive,” Cnty. of Sonoma v. Superior Ct., 173 Cal. App. 4th 322, 352 (2009). The California Supreme Court has explained that “[t]he issue, when assessing volitional separability, is not whether a legislative body would have preferred the whole to the part,” but “whether a legislative body, knowing that only part of its enactment would be valid, would have preferred that part to nothing.” Matosantos, 267 P.3d at 609. Accordingly, even where “the full purpose” of a statute “cannot be realized” due to an invalid provision, courts may reasonably suppose “that those who favored the [statute] would be happy to achieve at least some substantial portion of [its] purpose.” Santa Barbara Sch. Dist. v. Superior Court, 530 P.2d 605, 618 (Cal. 1975) (en banc). Thus, the question is whether the notice-and-cure provision is “so critical to the enactment of [the CAADCA] that the [statute] would not have been enacted in its absence.” Calfarm Ins., 771 P.2d at 1256; see Acosta v. City of Costa Mesa, 718 F.3d 800, 818–19 (9th Cir. 2013) (per curiam) (concluding that invalid provision was not volitionally severable because doing so “would [] leave an ordinance that no longer prohibits the speech the City intended it to prohibit”); see also Metromedia, Inc. v. City of San Diego, 649 P.2d 902, 909 (Cal. 1982) (en banc) (declining to sever portions of a statute where severance would “leave the city with an ordinance different than it intended, one less effective in achieving the city’s goals”). Put another way, the district court must consider whether

NETCHOICE, LLC V. BONTA 43 “the legislature would have wanted the benefits accorded in [the CAADCA’s valid] provisions to remain.” Katz v. Children’s Hosp. of Orange Cnty., 28 F.3d 1520, 1532 (9th Cir. 1994). The district court agreed with NetChoice that the Act’s remaining provisions were not volitionally severable from the enjoined DPIA provisions. The district court credited NetChoice’s evidence of the importance of the notice-and- cure provision to the passage of the CAADCA. It noted that the “legislature was presented with multiple versions of the bill omitting the notice and cure provision, and even a version including a shorter 45-day notice and cure period” but that the CAADCA was not passed “until the 90-day safe harbor was included.” Thus, the district court could not “find that the DPIA provisions, including the safe harbor provision, were not of critical importance to the [Act’]s enactment.” Today, we find ourselves in much the same position as we were in NetChoice I. That is, at this stage of the litigation, we cannot determine whether the CAADCA’s remaining provisions are volitionally severable from the enjoined 90-day cure period. We therefore vacate the district court’s preliminary injunction as to the CAADCA’s remaining provisions. To start, while NetChoice asserts that the CAADCA’s omission of a severability clause “raises a presumption of inseverability,” the California Supreme Court has repeatedly made clear that neither the presence nor the absence of a severability clause is conclusive. See, e.g., Gerken v. Fair Pol. Pracs. Comm’n., 863 P.2d 694, 698 (Cal. 1993) (en banc); Santa Barbara Sch. Dist., 530 P.2d at 618;

44 NETCHOICE, LLC V. BONTA Legislature v. Eu, 816 P.2d 1309, 1335 (Cal. 1991) (en banc). NetChoice also fails to establish, at this preliminary stage of the litigation, that eliminating the notice-and-cure provision transforms the CAADCA from a regulatory scheme focused on compliance to a “punitive, strict liability regime.” It is unclear from the record that the CAADCA necessarily works that way. Absent the notice-and-cure provision, the Act imposes a civil penalty of up to $2,500 “per affected child for each negligent violation” or up to $7,500 “per affected child for each intentional violation,” recoverable only through a civil action brought by the Attorney General. Cal. Civ. Code § 1798.99.35(a). The State may thus pursue compliance by enforcing both negligent and intentional violations, each of which would ostensibly require the State to prove negligence or intent, respectively. But because the parties do not develop these arguments, we again cannot say whether “elimination of the 90-day cure period affects whether provisions concerning the Attorney General’s civil enforcement of valid sections of the CAADCA are volitionally severable.” NetChoice I, 113 F.4th at 1125. Moreover, the district court overstates the import of the chronology of the Act’s passage. As NetChoice notes, the legislature referred a version of the draft bill that did not contain a notice-and-cure provision to the “suspense file” on August 1, 2022. The bill was amended on August 11, 2022, to add a 45-day cure period and revised again on August 22, 2022, to include the presently enjoined 90-day cure period. But these revisions also included amendments to other substantive provisions, including the age estimation requirement and dark patterns restriction at issue in this appeal, as well as provisions exempting broadband internet

NETCHOICE, LLC V. BONTA 45 services, telecommunications services, and physical products from the Act’s coverage. The district court itself recognized that the bill underwent several rounds of “substantial changes.” And, as the State argues on appeal, NetChoice does not demonstrate that the 90-day cure period was the reason the bill was ultimately passed. On the other hand, the district court may have underweighted the State’s evidence. The State argues that the Act’s findings make clear that “companies should prioritize the privacy, safety, and well-being of children” and that “children should be afforded protections” by both online services “specifically directed at them” and “all online . . . services they are likely to access.” Cal. Civ. Code § 1798.99.29; see also Ohio House, LLC v. City of Costa Mesa, 135 F.4th 645, 677 (9th Cir. 2025) (holding invalid provision volitionally severable under California law by looking to regulation’s “purpose provision”); People v. Nguyen, 222 Cal. App. 4th 1168, 1193 (2014) (looking to ordinance’s “purpose and intent section”). The legislative history also repeatedly emphasizes that the CAADCA is distinct from other “[f]ederal and state efforts to protect children online” because those statutes “permit online platforms to treat all consumers as adults unless there is actual knowledge that a consumer is a child” and therefore do not “offer the highest privacy protections by design and by default.” Cal. A.B. No. 2273, at 5 (2022) (Comm. on Privacy & Consumer Prot. Rep.). The legislature may have understood the CAADCA to fill that regulatory gap by ensuring covered businesses default to the highest privacy protections. But we are unable to determine on this record whether the legislature considered the notice-and-cure provision necessary to achieving that goal.

46 NETCHOICE, LLC V. BONTA Accordingly, we vacate the district court’s determination that the notice-and-cure provision is not volitionally severable from the CAADCA’s valid remainder, and we remand for further proceedings consistent with this opinion. CONCLUSION For the foregoing reasons, we AFFIRM the district court’s preliminary injunction insofar as it enjoined enforcement of California Civil Code §§ 1798.99.31(b)(1)⁠– ⁠(4) and 1798.99.31(b)(7), and VACATE the remainder of the preliminary injunction. Both parties shall bear their own costs on appeal. See Fed. R. App. P. 39(a)(4). We do not reach NetChoice’s alternative grounds for affirming the district court’s preliminary injunction. See NetChoice I, 113 F.4th at 1126 n.9.