A federal appeals court has upheld data privacy-related provisions of California’s online child safety law while striking down those that required tech companies to assess and mitigate risks of harmful content to children, finding that these provisions likely violate the First Amendment.

The Ninth Circuit Court of Appeals issued a ruling on Aug. 16 that upholds those parts of California’s Age-Appropriate Design Code Act (AB 2273) that restrict the collection, use, and sale of children’s personal data, as well as those that prohibit the tracking of children’s geolocation, seeing them as a necessary protection for children’s privacy online.

The appeals court struck down provisions that required companies to assess and mitigate risks related to harmful content, as well as those that required companies to prioritize content deemed to be in the “best interests” of children, holding that these would likely violate free speech rights.

With its decision, the appeals court partially upheld and partially vacated a Sept. 18, 2023, preliminary injunction issued by the U.S. District Court for the Northern District of California that blocked the entire law from going into effect, finding that the plaintiff—NetChoice—was likely to succeed on the merits of its First Amendment challenge.

NetChoice, a tech industry group that represents companies including Google and Meta, alleged in its complaint that the law was unconstitutional on at least four grounds, including the First Amendment, while arguing that the act would force platforms to behave as “roving censors” and suppress lawful content to avoid penalties.

The district court found that provisions requiring companies to conduct risk assessments and create policies to mitigate harmful content amounted to compelling companies to express certain viewpoints or take actions that align with the state’s definition of what is deemed harmful, in violation of the First Amendment.

The lower court also found that the law’s standards for what constitutes harmful content or content that promotes the “best interests” of children were too subjective and vague, running the risk of arbitrary enforcement and excessive self-censorship.

While the district court acknowledged that parts of the law might be severable, meaning that they could be separated from the rest of the law and blocked while allowing others to remain in force, it chose to enjoin the entire act. Its decision was based on the idea that the law was so interdependent that removing certain parts would disrupt the overall regulatory scheme.

The appeals court disagreed with the district court’s decision to block the entire law, finding that the lower court had overstated the likelihood that all the provisions were inseparable from those that were deemed unconstitutional. The Ninth Circuit vacated the broader injunction, allowing other parts of the law to go into effect, while remanding the case to the lower court to consider which provisions could be enforced separately from the invalid ones.

Both sides saw the appeals court’s ruling as a partial win.

“The Ninth Circuit’s ruling is a victory for free expression, online security, and Californian families,” Chris Marchese, director of the NetChoice litigation center, said in a statement. “The court recognized that California’s government cannot commandeer private businesses to censor lawful content online or to restrict access to it.”

California Gov. Gavin Newsom, who signed the act into law in September 2022, responded to the ruling by emphasizing the parts that were upheld.

“California enacted this nation-leading law to shield kids from predatory practices,” Newsom said in a statement. “Instead of adopting these commonsense protections, NetChoice chose to sue—yet today, the Court largely sided with us. It’s time for NetChoice to drop this reckless lawsuit and support safeguards that protect our kids’ safety and privacy.”

California Attorney General Rob Bonta echoed those sentiments.

“The California Department of Justice remains committed to protecting our kids’ privacy and safety from companies that seek to exploit their online experiences for profit,” he said.

Both sides will now prepare for the next round in the lower court, which will likely focus on assessing whether the upheld provisions, such as data privacy requirements, can be enforced without being affected by the invalidated content moderation requirements.