Lawsuits Continue to Impact State Laws Regulating the Internet

States around the country have been enacting laws to regulate the internet in the name of children’s safety. Several of these regulatory schemes have been preliminarily enjoined because they burden free speech and raise other constitutional concerns. There are a lot of laws and lawsuits to keep track of, so below, we discuss developments in key challenges to children’s online privacy laws in California, Arkansas, Ohio, and Utah. Given the rapid clip of this litigation, companies that do business online should keep a close eye on the courts over the coming months. Some of the issues in the litigation, from First Amendment questions to federal preemption under the Children’s Online Privacy Protection Act (COPPA), may continue to spawn challenges as state internet regulations proliferate.

California Age-Appropriate Design Code Act: Preliminarily Enjoined

On September 18, 2023, the United States District Court for the Northern District of California preliminarily enjoined AB 2273, California’s Age-Appropriate Design Code Act. AB 2273 requires online businesses to implement a host of compliance obligations related to all children under the age of 18. Among other obligations, the law requires covered businesses to “address” whether their products, services, or features contain “potentially harmful” content for children.

The court held that the law’s purported privacy regulations significantly burden expression on the internet. For example, the court found that a provision requiring online businesses to estimate the age of their users or employ children-specific privacy protections to all users had a “potentially vast chilling effect” on expression. It found that other restrictions on content and data collection would “throw[] out the baby with the bathwater” by subjecting an inordinate amount of speech to regulation by California’s Attorney General. 

While the preliminary injunction remains in place, AB 2273 – much of which was slated to go into effect on July 1, 2024 – will not be enforceable. However, California has appealed the preliminary injunction to the Ninth Circuit, where briefing is still ongoing. (Wiley authored amicus briefs before both the district court and the Ninth Circuit in support of granting the preliminary injunction.)

Arkansas Social Media Safety Act: Preliminarily Enjoined

On August 31, 2023, the District Court for the Western District of Arkansas preliminarily enjoined Arkansas’s online age-verification law, the Arkansas Social Media Safety Act (SB 396). SB 396 – which was set to go into effect on September 1, 2023 – requires covered “social media companies” to verify that account holders on their platforms are adults or have parental consent to create an account. To effectuate this requirement, the law requires social media companies to use “age verification methods,” such as requiring their users to submit “government-issued identification.”

The court enjoined the law on two grounds. First, it held that SB 396’s definition of “social media company” was likely unconstitutionally vague because it turns on “the primary purpose” of a website. That phrase, the court found, lacked “any guidelines” and thus left “companies to choose between risking unpredictable and arbitrary enforcement” or costly compliance burdens. Second, the court held that SB 396 likely violated the First Amendment because age verification would chill speech by making it harder for both children and adults to access online content.

Arkansas may not enforce the law at this time, but the case is not over. While the State has not appealed the preliminary injunction, it is defending against summary judgment in the district court.  After the court issues a final decision, the losing party may appeal to the Eighth Circuit.

Ohio Parental Notification by Social Media Operators Act: Preliminarily Enjoined*

On February 12, 2024, the United States District Court for the Southern District of Ohio preliminarily enjoined Ohio from enforcing its Parental Notification by Social Media Operators Act (the Ohio Act) – but only as to specific companies. Under the Ohio Act – which was set to go into effect on January 15, 2024[1] – websites that target children or may reasonably be accessed by children must obtain verifiable consent from parents before allowing children under 16 to access online services. Parents can give verifiable consent by signing and returning forms, calling a toll-free number, connecting with trained personnel via videoconference, or providing government-issued identification.

The court found that the Ohio Act was unconstitutional on two grounds. First, it found that the law violated the First Amendment by unconstitutionally restricting access to speech without adequate justification. Second, the court found that the Ohio Act was void for vagueness because its threshold trigger for covered operators – those that are “reasonably anticipated to be accessed by children” – invoked a malleable “eleven-factor list” that “practically invites arbitrary application of the law."

As a result of the injunction, Ohio may not enforce the age-verification law against the trade association, NetChoice “or its member organizations.” Thus, for businesses that are not members of NetChoice, Ohio may continue to enforce its law until the court definitively resolves the case on the merits.

Utah Social Media Regulation Act: TBD

In December 2023, NetChoice filed a complaint and motion for preliminary injunction in the United States District Court for the District of Utah challenging the State’s Social Media Regulation Act (the Utah Act).[2] The Utah Act requires certain social media companies to obtain parental consent before allowing children under 18 to create an account. The law also imposes age-verification obligations and other restrictions on content that children can access. The challenger alleges that the Utah Act is unconstitutionally vague, imposes content-based speech restrictions in violation of the First Amendment, and is preempted by federal law. 

After the lawsuit was filed, Utah delayed the law’s effective date until October 1, 2024. At Utah’s urging, the court put a pause on the preliminary-injunction briefing, citing both “the delayed implementation” and “the possibility that the Act will be altered during Utah’s legislative session.” Thus, the motion for preliminary relief remains pending, so, as of today, the Utah Act is set to take effect on October 1.

 

***

 

Despite these legal challenges and court decisions noting serious constitutional flaws in States’ online regulatory efforts, States show no sign of slowing down their consideration and adoption of laws to regulate online practices – with 13 states passing 23 online child safety laws in 2023 alone. Wiley has been involved in some of the litigation discussed above, and it is actively engaged on state legislative activities as well as consideration by the Federal Trade Commission of updated COPPA rules. Wiley’s Telecom, Media & Technology and Issues and Appeals attorneys are closely monitoring these growing compliance obligations and the litigation they spawn. This is a dynamic and complex area for organizations operating online.

 

[1]  Prior to the preliminary injunction, the court granted a temporary restraining order to pause enforcement of the Ohio Act against NetChoice and its members before the law went into effect.

[2]  The law is a combination of Senate Bill 152 (SB 152) and House Bill 311 (HB 311).