California’s New Age-Appropriate Design Code Act: Violation of Free Speech?

Social media consumes many teens’ and children’s daily lives.  According to a 2022 study conducted by Pew Research, 95% of teens aged 13 to 17 use YouTube daily, and 67% use TikTok daily.[1]  When asked how much time each teen spends daily using online platforms, over 50% of teens said “almost constantly.”[2]  Many of these social media platforms are free to use, but users consent in exchange for these platforms to collect their data, including geo locations, recent searches on the platform, liked content, and the content users spend their time watching.[3]  These platforms sell this data to companies and companies utilize this data to pay for targeted ads to the users primed to respond.[4]  An average person generates 146,880 MB of data a day when engaging in online content.[5]  What then happens to the trail of data that children leave behind online?  Queue the California Age-Appropriate Design Code Act.[6]

In September 2022, the California Legislature passed the Age-Appropriate Design Code Act (“Design Code Act”).[7]  The Design Code Act was inspired by the United Kingdom’s Age-Appropriate Design Code Act, which regulated children’s privacy online with fifteen standards to uphold.[8]  The Design Code Act protects the data privacy for persons under the age of eighteen in California “by creating child-friendly safeguards that will provide children and their parents/guardians with more transparency and control in relation to how children’s personal data is used.” [9]  In light of the new law, businesses are now required to “adopt sufficient controls and protections to reduce, eliminate or mitigate” any risks or threats to children’s privacy rights and personal data.[10]  Companies that fail to adhere to the Design Code Act may face an injunction and/or a civil penalty up to $2,500 for every negligent violation and up to $7,500 for each intentional violation.[11]

The Design Code Act is not the first privacy law passed to protect children in California. Children also have protection under laws such as the Parent’s Accountability and Child Protection Act, which requires age verification when purchasing goods online that are illegal for minors, such as alcohol or nicotine.[12]  The Design Code Act seeks to increase the protection of children in the online sphere when they access, engage, and post content online.

However, the protections afforded by the Design Code Act have not gone unchallenged.  NetChoice LLC, a technology trade group representing Big Tech interests like Amazon, Google, Meta, and TikTok, sued the California Attorney General and the state of California, asserting a variety of Constitutional violations.[13]  The powerhouse trade group alleges that the Design Code Act violates the First and Fourth Amendments of the U.S. Constitution because it chills free speech and mandates government searches of company information.[14]  NetChoice further claims that the Design Code Act violates the Due Process Clause and Commerce Clause.[15]  They assert that the Due Process Clause forbids the enactment of vague laws and that the Design Code Act violates this provision as it is overly broad, and thus vague.[16]  NetChoice further states that the Design Code Act will create a dormant Commerce Clause issue by burdening interstate commerce and creating issues with cross-state compliance as other states may have conflicting privacy laws.[17] 

Challenges to the Design Code Act extend beyond state law.  NetChoice also makes a preemption claim, asserting that Design Code Act is preempted by the federal Children's Online Privacy Protection Act (COPPA) and the Communications Decency Act (CDA).[18]  NetChoice believes that COPPA, “precludes states from imposing child-focused privacy rules that differ from those imposed by COPPA.”[19]  The trade group also asserts that the CDA preempts the Design Code Act because the CDA diverts liability when companies take a “good faith” action to remove publications of lewd or violent content online.[20]

The intersection of data protection and free speech has long been debated in law. The fierce debate grows with the concern over Big Tech’s usage of collected personal data.  NetChoice specifies that the Act will subject tech companies to government censorship and thus “hobble” free speech.[21]  NetChoice claims that the Act violates the First Amendment because the language in the Act is overly broad and requires companies to manage online speech, not data.[22]  Additionally, online platforms use data to create personalized ads and content recommendations to earn revenue; NetChoice argues that restrictions on data collection will “disallow a range of commonplace online speech, including engaging with users to learn their preferences.”[23]  It also argues that the new law strips away freedom from families and parents to make decisions regarding their child’s online presence.[24]  The issue of decision-making freedom also comes into question with individuals under the age of eighteen who choose to monetize their platforms via “influencing.” NetChoice claims that the Design Code Act will further chill free speech by hindering influencers and everyday users from creating and posting niche content that may be taken down by platforms to ensure compliance with the Design Code Act.[25]  The imposition of creating online content that must comply with privacy laws may conflict with free speech rights.  Fear of content removal may keep users from putting in time and effort into creating posts, thus deterring free speech and online discourse.[26]

Notably, the Design Code Act does not explicitly limit free speech rights.  The Design Code Act requires online businesses and platforms to ensure that children accessing online content use and have the highest default privacy settings.[27]  The California Privacy Rights Act of 2020 created the California Privacy Protection Agency, which will now oversee and review the data protection assessments provided by individual companies to ensure they comply with the Design Code Act.[28]  These assessments require companies to identify and explain certain features of their platforms that may pose a risk to children and to demonstrate how the company plans to rectify or mitigate these risks.[29]  The Design Code Act also prohibits the sale and use of children’s data unless the company can prove a compelling reason to utilize it otherwise.[30]  The Design Code Act exclusively focuses on the privacy rights of children and does not appear to inhibit or halt general free speech rights online.  The Design Code Act does not keep children offline or prohibit them from exercising free speech rights on social media; instead, it aims to protect their privacy in spaces where they are vulnerable. 

However, compliance with the Design Code Act may prove difficult when many online platforms are utilized by both children and adults alike.  For example, TikTok, a platform with over 755 million worldwide users, attracts users as young as 10 years old and as old as 110 years old.[31]  TikTok uses a very specific algorithm protected by trade secret law.[32]  Companies like TikTok who see heavy traffic from both adults and children will be required under the Act to give privacy assessments to the California Privacy Protection Agency.[33]  Algorithms, which are the key to many platforms’ success, may face big changes to ensure compliance with the new law and to avoid any civil penalties.  Changes in algorithms in turn may change the internet as we know it.

The Design Code Act has the potential to change free speech protections in the context of children’s right to privacy and to afford new online protections to children and teens under the age of 18 in California.  However, if enacted, the Design Code Act could disrupt tech companies’ algorithms and operations, potentially costing them significant expenses to stay in compliance.  NetChoice LLC seeks injunctive relief and repayment of attorney’s fees and costs in their lawsuit against California.  The NetChoice lawsuit may help determine the future of the internet and the regulation of online privacy, but whether the California Age-Appropriate Design Code Act violates the U.S. Constitution remains to be decided by California courts. 

[1] Emily A. Vogels et. al., Teens, Social Media and Technology 2022, Pew Research (Aug. 10, 2022), https://www.pewresearch.org/internet/2022/08/10/teens-social-media-and-technology-2022/.  

[2] Id.  

[3] See, e.g., Tiffani Sabrina Moorehead, TikTok: The App That May Watch You Back, Hastings Commc’n Ent. L. J.: Online Content (Oct. 13, 2022), https://www.hastingscomment.org/online-content/tiktok-the-app-that-may-watch-you-back.

[4] See Kalev Leetaru, What Does It Mean for Social Media Platforms to "Sell" Our Data, Forbes (Dec 15, 2018, 3:56 PM), https://www.forbes.com/sites/kalevleetaru/2018/12/15/what-does-it-mean-for-social-media-platforms-to-sell-our-data/?sh=7eee63cc2d6c.

[5] Louie Andre, 53 Important Statistics About How Much Data Is Created Every Day, FinancesOnline (Jan. 7, 2023), https://financesonline.com/how-much-data-is-created-every-day/.

[6] See generally Cal. Civ. Code §§ 7198.99.28 - 7198.99.40 (West 2023).

[7] Megan Brown et. al., California Age-Appropriate Design Code Act to Impose Significant New Requirements on Businesses Providing Online Services, Products, or Features, JDSupra (Sept. 19, 2022). https://www.jdsupra.com/legalnews/california-age-appropriate-design-code-8105166/.

[8] Age-Appropriate Design Code 2018, C.12, § 123, https://www.legislation.gov.uk/ukpga/2018/12/section/123; see also Isabela Tancredo, Keeping Children Safe Online: The California Age-Appropriate Design Code, Evalian: Data Protection (Oct. 3, 2022), https://evalian.co.uk/keeping-children-safe-online-the-california-age-appropriate-design-code-act-vs-the-uk-age-appropriate-design-code/ (comparing the UK Act to the CA Act).

[9] Tancredo, supra note 8.

[10] Id.

[11] Cal. Civ. Code § 1798.99.35(a) (West 2023).

[12] See Cal. Civ. Code § 1798.99.1 (2021).

[13] NetChoice, LLC v. Bonta, No. 5:22-cv-08861 (N.D. Cal. filed Dec.14, 2022); see also Lauren Berg, Calif. Internet Law Does More Harm Than Good, Big Tech Says, Law360 (Dec. 14, 2022, 9:53 PM), https://www.law360.com/articles/1558473.

[14] Complaint for Declaratory and Injunctive Relief at 13-15, NetChoice, LLC v. Bonta, No. 5:22-cv-08861 (9th Cir. Dec. 14, 2022) [hereinafter “Complaint”].

[15] Lauren Feiner, Tech Industry Group Sues to Block California Law Designed to Protect Kids Online Over Free Speech Concerns, CNBC (Dec. 14, 2022, 3:33 PM), https://www.cnbc.com/2022/12/14/tech-grojup-netchoice-sues-to-block-california-kids-online-safety-law.html.

[16] Complaint, supra note 14, at 15-16.

[17] Id. at 16.

[18] Lauren Berg, Calif. Internet Law Does More Harm Than Good, Big Tech Says, Law360 (Dec. 14, 2022, 9:53 PM), https://www.law360.com/articles/1558473.

[19] Complaint, supra note 14, at 17.

[20] Id. at 18.

[21] Id. at 1.

[22] Id. at 20.

[23] Id. at 11.

[24] Id.

[25] Id. at 4.

[26] Id.

[27] Cal. Civ. Code § 7198.99.31 (West 2023).

[28] Id. § 7198.99.32(d)(6).

[29] Id. § 1798.99.31(a)(1)(B).

[30] Id. § 1798.99.31(b)(2)(ii).

[31] L. Ceci, Number of TikTok Users Worldwide from 2020 to 2025, Statista (Sept. 5, 2022),  https://www.statista.com/statistics/1327116/number-of-global-tiktok-users/; see also Kevin Rawlinson, Welsh Woman Marks 110th Birthday With Viral TikTok Fame, The Guardian (Jan. 29, 2021), https://www.theguardian.com/uk-news/2021/jan/29/welsh-woman-marks-110th-birthday-tiktok-appearance-amy-hawkins.

[32] Shweta Singh, TikTok’s Secret Algorithm Is Its Greatest Strength – and Could Also Be Its Undoing, The Conversation (Feb. 8, 2022, 11:04 AM), https://theconversation.com/tiktoks-secret-algorithm-is-its-greatest-strength-and-could-also-be-its-undoing-176605.

[33] See generally Cal. Civ. Code § 7198.99.31.