California’s Age-Appropriate Design Code Act has been one of the most closely watched experiments in children’s online safety, and one of the most contested on First Amendment grounds. In its second opinion in NetChoice v. Bonta, the Ninth Circuit narrowed the injunction that had frozen the law, reviving some provisions while leaving others blocked. For any business with products likely to be accessed by children, the decision changes the compliance picture without settling it.

The Act, enacted in 2022, imposes a set of obligations on online services likely to be accessed by children. Those obligations include estimating the age of users, defaulting to privacy-protective settings, completing data-protection impact assessments, and refraining from certain uses of children’s data and from manipulative design tricks known as dark patterns. The trade association NetChoice challenged the law, and a district court initially enjoined it on free-speech grounds.

A long procedural road

This is the statute’s second trip to the Ninth Circuit. In 2024, the court affirmed an injunction as to the impact-assessment requirement but vacated the rest, sending the case back for fresh analysis under the Supreme Court’s framework for facial First Amendment challenges in Moody v. NetChoice. On remand, the district court again enjoined the whole statute, and in the alternative enjoined seven specific provisions, including age estimation, several data-use restrictions, and the dark-patterns ban. California appealed again, producing the March 2026 decision.

The result is a genuine split decision. The panel vacated the injunction as applied to the statute as a whole and, importantly, as applied to the age-estimation feature. The court faulted the district court for misapplying the Moody facial-challenge framework, which requires a careful, provision-by-provision look rather than a single sweeping judgment. The panel emphasized that the law’s coverage definition is built from several separate indicators, each demanding its own inquiry, so striking everything at once was premature. At the same time, the court affirmed the injunction against certain data-use restrictions and the dark-patterns prohibition, agreeing those provisions are likely unconstitutionally vague. The case now returns to the district court for further work on age estimation and on whether the surviving and enjoined provisions can be separated.

What businesses should take from it

The headline for compliance teams is uncertainty, but it is a more structured uncertainty than before. Provisions that the district court had swept aside, including the coverage definition and age estimation, are no longer enjoined as a categorical matter, which means companies cannot assume those requirements are dead. The data-use and dark-patterns provisions remain blocked for now on vagueness grounds, so enforcement of those specific rules is off the table while the litigation continues. Prudent planning treats age-estimation obligations as live risks worth preparing for, while watching the remand closely.

It helps to see what the disputed obligations actually require. Age estimation asks a covered service to gauge, with a reasonable level of certainty, whether a user is a minor, and then to tailor the experience accordingly. Critics call that a backdoor mandate to identify and monitor every user. Defenders call it a sensible precondition to protecting children. The data-use restrictions limit how a service may collect, sell, or repurpose a child’s information, and the dark-patterns ban targets interface designs engineered to nudge users into giving up privacy. The court’s vagueness concern with the latter two is not about their goals but about whether they tell a regulated business clearly enough what is forbidden.

For compliance planning, the practical posture is now provision-specific. A service likely accessed by children in California should assume the coverage definition and age-estimation obligations could be enforced, and should map its products against them rather than wait for the remand to conclude. The data-use and dark-patterns rules are paused, but a pause is not a repeal, and a business built around aggressive data practices remains exposed if those provisions are later clarified and revived. The safest course treats privacy-protective defaults as a baseline regardless of how the litigation ends.

One more practical point bears emphasis. Because the court insisted on separating the statute into its component obligations, the eventual resolution may be a patchwork, with some duties enforceable and others not, depending on how the district court handles severability. Businesses that operate nationally already face a thicket of state-by-state children’s privacy rules, and a partial California law adds another layer. Building to the strictest reasonable standard, rather than to whichever provisions happen to be enjoined at a given moment, is the approach least likely to require costly redesigns later.

The decision also fits a national pattern. States have rushed to regulate how minors experience the internet, and industry has answered with First Amendment challenges, leaving courts to sort speech regulation from conduct regulation. Moody raised the bar for facial challenges, and the Ninth Circuit’s insistence on a granular, provision-by-provision review reflects that shift. Expect the next round to focus on age estimation, the feature that sits closest to the line between protecting children and burdening lawful speech, and on whether California’s law can stand in pieces if it cannot stand whole.