On November 24, 2025, trade association NetChoice secured a win in its constitutional challenge to Maryland's Age-Appropriate Design Code Act (Kids Code or Act) when the U.S. District Court for the District of Maryland denied a motion to dismiss.
The court found that NetChoice had adequately alleged that the law violates the First and Fourteenth Amendments and is preempted by federal law. While the Kids Code remains in effect as the case proceeds to discovery, the NetChoice v. Brown decision suggests that courts will carefully examine how state regulations interact with speech and editorial functions, even when those regulations concern children’s privacy or online safety.
Overview of the Maryland Kids Code
The Kids Code, which took effect on October 1, 2024, regulates for‑profit online services that do business in Maryland and meet specified size or data‑processing thresholds when their products are reasonably likely to be accessed by “children”—defined as all Maryland residents under 18, and evaluated through a multi‑factor test. The law defines “personal data” broadly and articulates a general requirement that covered entities prioritize the privacy, safety, and well‑being of children.
Substantively, the Kids Code imposes a duty to act in a manner consistent with the “best interests of children” and incorporates that requirement into several specific obligations. Covered entities must complete Data Protection Impact Assessments (DPIAs) by April 1, 2026, for each covered product. The Act broadly restricts processing and profiling of minors’ data inconsistent with the best‑interests standard and prohibits the use of “dark patterns” that, among other things, induce children to provide unnecessary data or circumvent privacy protections. Enforcement by the Maryland Attorney General can lead to civil penalties of up to $2,500 per affected child for negligent violations, and $7,500 per affected child for intentional violations, along with a notice‑and‑cure opportunity for entities in substantial compliance.
What NetChoice Is Challenging and Why
At the heart of NetChoice's challenge is the "best interests of children" standard. NetChoice contends that requiring covered entities to act in the “best interests of children" effectively deputizes them to act as censors by compelling content- and speaker-based judgments about whether their data practices— and, by extension, their content moderation and curation—serve children’s interests. This, NetChoice argues, burdens editorial discretion. NetChoice further asserts that the Act’s scope—covering products “reasonably likely to be accessed by children”—likewise forces content-based differentiation and fails to provide fair notice, given undefined terms and criteria such as what constitutes a “significant number of children” or a “substantially similar” product. In NetChoice’s view, these features risk sweeping in services with no actual child users and compel changes to data use that will alter the presentation of protected content.
The complaint also alleges practical traps in the statute's design: Platforms must either collect more data to determine user ages—risking data "processing" violations under the "best interests" standard—or collect less and risk being told they "should have known" users were minors. In addition, the Act's notice-and-cure safe harbor requires "substantial compliance"—a term the statute leaves undefined, causing uncertainty and risking arbitrary enforcement.
NetChoice characterizes the law’s DPIA requirement as compelled speech that forces platforms to produce opinionated assessments about content suitability for children, while deputizing them to censor First Amendment-protected content. Because the law burdens the tools platforms use for editorial curation and forces content moderation decisions, it operates as an impermissible restraint on protected speech.
Finally, on preemption, NetChoice alleges both express and implied conflict with the Children’s Online Privacy Protection Act (COPPA), 15 U.S.C. §§ 6501–6506, particularly the mismatch between COPPA's "actual knowledge" standard for under-13 data collection and Maryland's broader "reasonably likely" and "should have known" triggers. NetChoice also argues the Kids Code conflicts with the immunity provided by Section 230 of the Communications Decency Act, 47 U.S.C. § 230, by requiring platforms to monitor or editorially alter third-party content to satisfy the vague "best interests" duty.
NetChoice brings both facial and as-applied challenges, arguing that the Kids Code is unconstitutional on its face and in its application to specific platform operations and content moderation practices.
The Court Ruling
The court found NetChoice had standing and adequately alleged all claims in the complaint.
- Standing. The court upheld NetChoice’s associational standing, finding that it plausibly alleged member injuries, such as burdens on protected provision of curated content and chilled editorial choices.
- First Amendment. The court determined that NetChoice had adequately alleged facts to state both facial and as-applied claims that the Kids Code burdens speech protected by the First Amendment. The court did not decide whether strict or intermediate First Amendment scrutiny applies. The court held that NetChoice plausibly alleged the Kids Code burdens editorial functions by requiring covered entities to evaluate whether their data collection practices serve the “best interests of children” or apply to products that are “reasonably likely to be accessed by children,” which in turn requires members to evaluate and potentially alter moderated content. The court also found that NetChoice had sufficiently alleged that the Kids Code requires covered entities that provide services that are “reasonably likely to be accessed by children” to suppress or alter protected content with respect to adult users. Further, the court found that NetChoice plausibly alleged that the DPIA requirement compels platforms to produce opinionated assessments about content suitability for children, and that such assessments “constitute compelled speech and deputize covered entities to act as censors for the State.”
- Fourteenth Amendment. The court found that NetChoice had adequately alleged that both the "best interests" standard and the “reasonably likely to be accessed by children” standard were unconstitutionally vague because they incorporated undefined, subjective standards that fail to provide fair notice of when or how the law applies, risking arbitrary enforcement. For example, the court highlighted that the multi-factor “reasonably likely to be accessed by children” standard leaves unclear whether websites must measure “significant number of children” by a proportional percentage or an absolute number of child users and does not provide notice of what it means for products to be “substantially similar” in this context.
- Preemption. NetChoice plausibly alleged conflict with COPPA's "actual knowledge" framework, given the potential liability for conduct permissible under COPPA, and with the immunity that Section 230 provides for platforms that disseminate or make decisions about third-party content.
Procedurally, since this was a ruling on a motion to dismiss, the court did not decide on the merits of NetChoice’s claims. Even so, the decision is a meaningful step for NetChoice: It confirms the complaint plausibly alleges claims that warrant moving forward, preserves both facial and as-applied challenges, and opens the door to discovery and a fuller record.
How This Fits the Post-Moody Landscape
The decision arrives against the backdrop of the Supreme Court’s 2024 ruling in Moody v. NetChoice, which cautioned that platform curation can be protected expressive activity and that state attempts to force “viewpoint neutrality” in curation raise serious First Amendment concerns. At the same time, the Moody court emphasized that a proper facial-challenge analysis must account for the many different apps, functionalities, and use cases implicated by broad platform regulations. Enforcement of the Texas and Florida laws challenged in that case remains paused while the lower courts conduct that granular inquiry. (For additional background, see our prior analysis of Moody.)
Post‑Moody, the key inquiry is whether and how a statute, in operation, restricts or reshapes protected curation and dissemination choices across specific product features and contexts—both facially and as applied.
What’s Next
The case moves into discovery with the law still enforceable. Expect a briefing on the appropriate level of First Amendment scrutiny and whether the statute passes muster, the extent to which the challenged provisions are severable, and whether COPPA and Section 230 preempt core components of the Kids Code. As with other state efforts to regulate minors’ online experiences, the path forward will likely turn on the statute’s real-world applications to specific platform features and editorial decisions, with both facial and as-applied challenges remaining central to the litigation.
In the meantime, platforms will need to contend with friction points being litigated as they work toward compliance.
—
Perkins Coie’s experienced team routinely advises platforms on children’s privacy regulation, content moderation requirements, and constitutional challenges to state speech laws. We are closely tracking this litigation and related state and federal developments affecting content curation, minors’ privacy frameworks, and product design obligations.
