On March 13, 2025, the U.S. District Court for the Northern District of California granted a preliminary injunction preventing the California Attorney General (AG) from enforcing the California Age-Appropriate Design Code Act (CAADCA). The decision followed the California AG’s agreement to delay the enforcement of CAADCA until April 5, 2025. As of now, the California AG has not announced whether his office will appeal the injunction.
Originally set to take effect on July 1, 2024, CAADCA mandates that businesses offering online services, products, or features likely to be accessed by California residents under the age of 18 (children) implement specific privacy and online safety measures to protect children. One key requirement of CAADCA is the completion of a Data Protection Impact Assessment (DPIA) to evaluate potential risks to children posed by these online services. Businesses that substantially comply with the DPIA requirements are granted a 90-day cure period, allowing them to rectify any alleged violations and avoid civil penalties within that timeframe. On December 14, 2022, a trade association challenged CAADCA, leading to a preliminary injunction that halted the enforcement of the DPIA provisions on First Amendment grounds. This week, the court granted the trade association’s second motion for a preliminary injunction, effectively blocking the enforcement of CAADCA in its entirety.
The court determined that the trade association is likely to succeed in proving that CAADCA facially violates the First Amendment. The court explained CAADCA imposes a content-based speech regulation because its applicability criteria create a “coverage definition” that “unavoidably requires an evaluation of content.” For instance, businesses providing online content likely to be accessed by children—such as games, cartoons, music, or celebrities appealing to children—would be subject to CAADCA, whereas businesses offering other types of content would not. Given that CAADCA’s coverage definition applies universally across all applications of the statute, the court held that the statute as a whole is subject to strict scrutiny. The court further held that the California AG’s office failed to demonstrate that CAADCA could survive strict scrutiny, as it did not adequately show that (1) being online harms children in a manner that CAADCA can mitigate, or (2) CAADCA is the least restrictive means to achieve the government’s interest in protecting children.
Additionally, the court found that the non-DPIA provisions of CAADCA are not severable from the DPIA provisions, which had already been enjoined. The court highlighted that the cure provision, which provides businesses a 90-day period to rectify violations, was a critical part of the legislative process, as seen in the Legislative Counsel’s Digest emphasizing the importance of the DPIA regime, including the cure period. Given this legislative history, the court concluded that it could not confidently assert that the legislature would have passed CAADCA without the DPIA provisions, making the non-DPIA provisions inseverable from the DPIA provisions.
This injunction provides a temporary relief from CAADCA, allowing businesses to continue their operations without the immediate risk of enforcement under CAADCA. But businesses offering online services to children should remain aware that other laws and regulations also protect children’s online privacy and safety. For instance, the Maryland Age-Appropriate Design Code Act (MAADCA), which closely resembles CAADCA, became effective on October 1, 2024, although it faces a similar validity challenge initiated by the trade association in February 2025.
Alston & Bird’s Privacy, Cyber & Data Strategy Team will continue to monitor developments around laws and regulations involving children’s online privacy and safety, including the trade association’s ongoing challenge against CAADCA and MAADCA.
[View source.]
