In recent years, states have enacted wide-ranging requirements for technologies like social media1 and generative artificial intelligence.2 These regulations are, like all government action, limited by the First Amendment. In Moody v. NetChoice, LLC,3 the Supreme Court emphasized that even novel technologies receive the Constitution’s protection4 while nonetheless stressing the demanding requirements for a facial challenge to succeed.5 Recently, in NetChoice, LLC v. Bonta,6 the Ninth Circuit largely affirmed the district court’s partial denial of a preliminary injunction, but reversed as to one provision — the statute’s restriction on the visibility of like counts and other feedback — and remanded with instructions to enjoin its enforcement.7 The court’s reasoning was inconsistent: It denied a facial challenge because of plaintiff’s “fail[ure] to develop a [thorough] record” of the law’s application,8 but it allowed a different challenge after cursorily concluding that the challenged provision “appl[ied in] the same way to all covered websites.”9 By allowing the latter challenge to proceed, the Ninth Circuit failed to apply Moody, and may have perversely incentivized lawmakers to insulate statutes from review by using unnecessarily broad statutory language.
In 2024, responding to widespread concern about the influence of personalized social media feeds on teenage mental health,10 California enacted the Protecting Our Kids from Social Media Addiction Act.11 The Act bars the presentation of personalized feeds to underage users absent “verifiable parental consent”12 (the “feed restriction”), restricts the delivery of notifications to an underage user’s phone during school or overnight hours absent “verifiable parental consent”13 (the “notification restriction”), and mandates annual disclosure of certain statistics concerning platform usage by underage users14 (the “disclosure requirement”). It also requires covered platforms to create default-on parental controls governing, inter alia, whether underage users are shown feedback on media within a feed15 (the “feedback control”) and whether the user is able to interact with other users they have not connected with16 (the “private-mode control”). The Act currently permits platforms to provide personalized feeds to underage users if they “do[] not have actual knowledge that the user is a minor,”17 but will in the future require platforms to affirmatively “determine[] that the user is not a minor” pursuant to regulations to be promulgated by the Attorney General.18 NetChoice, a trade group representing many major technology companies,19 immediately filed suit seeking to enjoin the law’s enforcement.20 The group mounted facial and as-applied challenges to almost every provision and separately argued that the statute was void for vagueness.21
In December 2024, the U.S. District Court for the Northern District of California, ruling on NetChoice’s motion for a preliminary injunction, granted the motion in part and denied it in part.22 Judge Davila found that NetChoice’s challenge to the Act’s age-verification requirements was not yet ripe, as the Attorney General had not yet established the required process for conducting age verification.23 He denied NetChoice’s facial and as-applied challenges to the feed restriction, finding that NetChoice had failed to develop a record demonstrating that “most or all personalized feeds . . . are expressive,”24 and that NetChoice lacked associational standing due to the need for each member to develop an individual record demonstrating how its personalized feed actually works.25 He preliminarily enjoined the operation of the notification restriction under NetChoice’s facial challenge, finding that the provision would likely fail to survive intermediate scrutiny: It was underinclusive because it restricted notifications from social media companies but not from other websites.26
Judge Davila then applied the same analysis to three of the parental controls, finding the notification-timing control, the time-limited feed control, and the default personalized feed setting “effectively duplicative” of the feed and notification restrictions.27 He then enjoined the notification-timing control on the same basis as the notification restriction: that it was unacceptably underinclusive and therefore likely failed intermediate scrutiny.28 He noted that the analyses for the as-applied and facial challenges were not “meaningful[ly] differen[t].”29 Finally, Judge Davila enjoined the disclosure requirement, finding that the required disclosure of usage metrics constituted prohibited compelled speech.30 NetChoice appealed the denial of a preliminary injunction with respect to the feed restriction,31 the age-verification requirements,32 the private-mode control, and the feedback control.33
The Ninth Circuit affirmed the district court’s denial of a preliminary injunction with respect to the first three provisions, but directed the district court to enter an order enjoining the enforcement of the feedback control.34 Judge Ryan Nelson, writing for the unanimous panel,35 affirmed the district court’s finding that NetChoice “lack[ed] associational standing” to challenge the feed restriction.36 He noted that the need to “review . . . each member’s algorithm” mandated the individual participation of NetChoice’s members.37 The court further denied NetChoice’s as-applied challenge to the age-verification requirements. It agreed with the district court that the challenge was not yet ripe, as the Attorney General had not yet promulgated regulations implementing the Act’s requirements.38
Turning to the two challenged parental control provisions — the private-mode control and the feedback control — the court began by considering what level of scrutiny was warranted.39 It identified that the Act’s wholesale exclusion of websites “limited to commercial transactions or to consumer reviews” did not constitute content awareness (which would have required strict scrutiny),40 nor did “the Act’s [thematic] focus on social media.”41 The court then found that the private-mode control did “not ‘reflect[] a content preference,’” and hence warranted only intermediate scrutiny, which it survived.42 The court reasoned that the private-mode control was “agnostic as to content” because a user “connected to a minor can share or access . . . any message[ ] that an unconnected user can share,” and further that the provision survived intermediate scrutiny because it “logically serve[d] the [state’s goal] of protecting minors’ mental health.”43
In contrast, the court held that the feedback control restricted only “speech with a particular content” and was therefore content based and subject to strict scrutiny.44 The court then noted that the provision “appl[ied in] the same way to all covered websites” and therefore “a dense factual record” was not needed “to know how these settings will play out in the real world.”45 In turn, the court found that circuit precedent “compel[led]” it to hold that the feedback control was insufficiently narrowly tailored.46 The court held that NetChoice had established a likelihood of success on the merits for both the as-applied and facial challenges.47 It consequently enjoined the provision’s enforcement after concluding it was severable from the remainder of the Act48 and that the remaining three preliminary injunction factors favored NetChoice.49
The court denied NetChoice’s remaining facial challenge to the feed restriction. In doing so, it applied Moody’s requirement that the plaintiff “develop a record that would allow the court to ‘determine [the] law’s full set of applications’” and held that NetChoice had failed to do so.50 It noted that “current constitutional doctrine may make such a showing unrealistic,”51 but found that at a bare minimum, the failure to disclose which platforms NetChoice believed the feed restriction reached meant the challenge could not succeed.52 It further held that the challenge independently failed because NetChoice had not demonstrated constitutional issues with the law’s application to third parties.53 In sum, the court reversed the district court with respect only to the feedback control and enjoined that provision’s enforcement.54
Facial challenges under the First Amendment are “hard to win,”55 so it might come as little surprise that only one of NetChoice’s facial challenges succeeded on appeal. A plaintiff is responsible for establishing that the statute’s unconstitutional applications are “not only . . . real, but substantial as well, judged in relation to the statute’s plainly legitimate sweep.”56 Yet, the Bonta court applied this standard unevenly: It enjoined the enforcement of the feedback control, but then denied the challenge to the feed restriction.57 In doing so, the court misapplied binding precedent while creating a two-track system for facial challenges.
In 2024, the Moody Court reaffirmed the high threshold for facial challenges.58 There, the Court considered facial challenges by NetChoice to two state laws regulating the content moderation practices of social media platforms.59 It emphasized that the editorial choices of private parties fell within the First Amendment’s protection,60 but then remanded after concluding that NetChoice had not shown that the laws were substantially overbroad.61 The trade group had focused on how the laws would apply to “the content-moderation practices that giant social-media platforms use on their best-known services,”62 but had ignored burdens posed by the laws on other services like Gmail, Etsy, and Uber.63 NetChoice needed to build a record spanning “the full range” of the law’s applications,64 and then demonstrate that the unconstitutional applications substantially outweighed the permissible ones.65
In Bonta, the Ninth Circuit professed to apply the Moody standard in denying many of NetChoice’s facial challenges.66 Yet, NetChoice’s lone success — the challenge to the feedback control — did not rest on an exhaustive record and a demonstration of substantial overbreadth.67 The Ninth Circuit enjoined the law’s operation with respect to all parties after summarily concluding that it “appl[ied] the same way to all covered websites.”68 The provision’s language applies broadly: A covered website must permit a parent to “[l]imit their child’s ability to view the number of likes or other forms of feedback to pieces of media within an addictive feed.”69 Yet the court did not ask NetChoice to identify the provision’s consequences for other websites, nor did it consider whether all forms of “feedback” and all “[l]imit[s]” on the “ability to view” that feedback were equally constitutionally implicated.70 The court instead quickly concluded that restricting the visibility of “the number of likes or feedback that [a] post has received” constituted a content-based restriction.71 It did so without “candidly disclosing” what the provision even reached.72 The court’s application of strict scrutiny was similarly cursory and was supposedly “compel[led]” by identically named circuit precedent from a year prior.73 That precedent, however, was meaningfully distinct: It held that compelled corporate disclosures of data management risks to children were likely unconstitutional,74 and suggested that the state instead consider offering “voluntary content filters,”75 a solution not dissimilar to the feedback control itself (which could be voluntarily disabled by a parent).76
Even if the feedback control triggers and fails strict scrutiny as applied to “like counts”77 — the provision’s clearest application — that should not conclude the constitutional analysis. If “feedback” reaches any text or statistic that responds to an item on a feed,78 then the provision might not be content based under recent Supreme Court rulings.79 The constitutional interest in different forms of feedback could vary as well. A factual machine-generated view count on YouTube might deserve less constitutional protection than a user-authored comment on Reddit, and the feedback control might be more narrowly tailored as applied to other categories of feedback.80 The Ninth Circuit may have correctly concluded that the feedback control was unconstitutional as-applied to NetChoice’s members, but it improperly allowed NetChoice’s facial challenge by failing to apply Moody’s clear standard. The court recognized the applicability of the standard: A few pages later, it barred NetChoice’s facial challenge to the feed restriction after holding that the group failed to develop a record as to the law’s reach.81
The court’s distinction between these provisions appears to rest on the clarity of the statutory language and the court’s belief that it can accurately characterize all the statute’s applications. Both the feed restriction and the feedback control apply to the same parties.82 Both provisions also require the court to identify what, if any, constitutional interest exists in a technological feature: for the former, the curation of a personalized feed; for the latter, the display of feedback on an item in such a feed.83 The Ninth Circuit’s willingness to quickly conclude that the feedback control applied in “the same way to all covered websites”84 seemed to rest on the court envisioning every application as analogous to a widely criticized version of feedback: Instagram’s “likes.”85 This logic is difficult to administer consistently in other circumstances: Whether a statute’s application to varied, unknown technologies raises “the same First Amendment issues in every conceivable application”86 amounts to little more than judicial guesswork.
The practical consequence of Bonta is a two-track system for facial challenges under the First Amendment. If the court can easily envision the statute’s reach (or even a single, highly salient application), the facial challenge proceeds without the intensive development of the record required by Moody — regardless of whether the statute’s language might in fact apply to other categories of plaintiffs.87 If the court cannot envision the statute’s reach and the regulation may apply to a heterogeneous set of parties, the court instead requires the plaintiff to construct an exhaustive record under Moody — a hurdle which may be insurmountable, as the Ninth Circuit itself noted in Bonta.88 This system contradicts Moody’s requirement that courts consider the “full range of activities” that a law covers,89 so as to lessen the guesswork required about the “law’s coverage and its future enforcement.”90
The Ninth Circuit may have been reluctant to apply Moody’s demanding standard because doing so could largely eliminate facial challenges to regulations of social media platforms.91 The Moody Court itself seemed aware of this tension, leading some commentators to suggest that the Court was deeply uncertain “how [First Amendment] principles applied in the novel social and technological environment of the internet.”92 Yet, lower courts cannot improvise exceptions to binding precedent, and the Ninth Circuit’s approach creates its own problems: The two-track system means that seemingly inconsequential choices in drafting can meaningfully alter the difficulty of mounting a facial challenge.
The Bonta court’s reasoning provides state actors with a perverse incentive to make statutory language artificially broad and generic. A statute that identifies a salient target is more vulnerable to facial invalidation, so legislatures may rationally respond by avoiding specificity while drafting — even when enforcement of the statute will remain narrow. In Bonta, had the legislature simply altered the feedback control to use more general language (say, by replacing “the number of likes or other forms of feedback”93 with simply “feedback”), it might have benefited from the exhaustive record requirements the court imposed for the feed restriction, and therefore might have not been enjoined. The Ninth Circuit’s rule, while perhaps intended to preserve facial challenges to technology regulations after Moody, may unintentionally result in savvy legislators shielding unconstitutional statutes from facial invalidation via worse drafting, not better.