Mississippi’s Age-Authentication Law Declared Unconstitutional–NetChoice v. Fitch

[Note 1: I’m thinking my full analysis of Moody v. NetChoice won’t be ready until next week. I have a lot to say!]

[Note 2: This morning, Supreme Court granted cert in Free Speech Coalition v. Paxton over Texas’ law requiring porn sites to do age authentication. So age authentication is back on the Supreme Court docket, with implications for this case and many like it.]

Mississippi passed an “everything but the kitchen sink” bill to regulate children online with a weird mix of policy ideas. The court summarizes Mississippi’s law:

Section 4(1) of H.B. 1126 requires all users, adults and minors alike, to verify their age before they may open an account with non-excluded digital service providers (the “age-verification requirement”), while Section 4(2) requires parental consent before a known minor may create an account (the “parental consent requirement”). Section 5 contains a limitation for collection of data by non-excluded digital service providers that enter into an agreement with a known minor for access to a digital service (the “data-collection limitation”), and Section 6 requires those digital service providers to make commercially reasonable efforts to develop and implement a strategy to prevent or mitigate the known minor’s exposure to harmful material and other content that promotes or facilitates certain harms to minors (the “prevention-or-mitigation requirement”).

NetChoice didn’t challenge the data-collection limitation. The court preliminarily enjoins the rest.

Content Regulation

The law’s content-based distinction is inherent in the definition of “digital service provider,” which is at the core of defining the Act’s coverage. Even if this were considered a speaker-based distinction, the Supreme Court has held that “laws favoring some speakers over others demand strict scrutiny when the legislature’s speaker preference reflects a content preference.” In essence, H.B. 1126 treats or classifies digital service providers differently based upon the nature of the material that is disseminated, whether it is “social interaction,” as opposed to “news, sports, commerce, [or] online video games”…

The facial distinction in H.B. 1126 based on the message the digital service provider conveys, or the more subtle content-based restriction based upon the speech’s function or purpose, makes the Act content-based, and therefore subject to strict scrutiny.

Strict Scrutiny

The court says the law isn’t narrowly tailored: “the Attorney General has not shown that the alternative suggested by NetChoice, a regime of providing parents additional information or mechanisms needed to engage in active supervision over children’s internet access, would be insufficient to secure the State’s objective of protecting children.”

With respect to the age authentication requirement, the court says simply “This burdens adults’ First Amendment rights, and that alone makes it overinclusive.”

With respect to the parental consent requirement, the court says  it “represents a one-size-fits-all approach to all children from birth to 17 years and 364-days old. H.B. 1126 is thus overinclusive to the extent it is intended as an aid to parental authority beyond the resources for monitoring children’s internet use that NetChoice has identified, because not all children forbidden by the Act to create accounts on their own have parents who will care whether they create such accounts.”

The court then identifies some ways the law is underinclusive:

  • the lack of specificity about how services are supposed to authenticate parental status.
  • the law “permits a child to create an account with certain websites, but not others”
  • the AG claimed the law was needed to protect children from predators, but the sites purported to be predator havens (Amazon and Roblox) were excluded from the law
  • the prevent-or-mitigate requirement is underinclusive because it doesn’t apply to minors who search for or request content.

The court summarizes:

NetChoice has demonstrated a substantial likelihood of success on its claim that H.B. 1126 is either overinclusive or underinclusive, or both, for achieving the asserted governmental interest – protecting minors from predatory behavior online – and that a substantial number, if not all, of H.B. 1126’s applications are unconstitutional judged in relation to its legitimate sweep.

Void for Vagueness

The court has problems with the definition of “digital service provider.” The law doesn’t apply to a “digital service provider’s provision of a digital service that: (i) Primarily functions to provide a user with access to news, sports, commerce, online video games or content primarily generated or selected by the digital service provider; and (ii) Allows chat, comment or other interactive functionality that is incidental to the digital service.” The court isn’t sure what test to use for “primarily functions” and lacks guidance about when functionality is “incidental.” That means the “definition is overly indefinite, leaving it open for potential arbitrary and discriminatory enforcement.”

The court also has an issue with defining digital service provider as connecting “users in a manner that allows users to socially interact with other users on the digital service.” The court asks: what are non-social user-to-user interactions? Because of that uncertainty, “Websites are thus left to guess as to whether the Act applies at all to them, and NetChoice has shown that the coverage definition is so indefinite that it presents a concern over potential arbitrary and discriminatory enforcement.”

This definitional problem casts a shadow over the data-collection limitation, even though it wasn’t challenged.


At the end, the court says “It is not lost on the Court the seriousness of the issue the legislature was attempting to address, nor does the Court doubt the good intentions behind the enactment of H.B. 1126.” In my forthcoming paper on child safety, I will in fact question the “good intentions” of the proponents, given that they passed an unconstitutional law and, as I will explain, the provisions predictably impose significant harm on both children and adults. I think we are far too willing to give free passes to regulators who claim–possibly pretextually–that they are trying to protect children but choose piss-poor methods. We should stop issuing those free passes and start grilling the regulators if they really understand how their “solutions” harm their constituents.

The law primarily fails due to its weak definitions about who is in/out of scope. Definitions are a constant problem in efforts to regulate “social media” or, in this case, “digital service providers.” As this court explains, the definitions are routinely under- and over-inclusive in constitutionally significant ways. For more on the definitions problem, see this piece.

Does This Ruling Satisfy Moody v. NetChoice?

This is a well-done ruling, but does it overcome the Supreme Court’s repeated admonishments in the Moody case that facial challenges are hard? As I read the Moody opinion, I felt like the Supreme Court wants lower courts to go through each restrictive precision with care to show that each provision could never be constitutional as to any entity. This opinion, like a number of the other NetChoice cases, instead takes a more summary approach to the constitutional law analysis (it’s still a 40 page opinion). The court even added a last-minute cite to the Moody case acknowledging the standards for facial challenges, but the court didn’t do the kind of numerator (unconstitutional outcomes)/denominator (total outcomes) calculations that I felt like the Supreme Court wants to see. Did the court do enough? Does it matter that the court relied on the alternative grounds of the vagueness challenge?

We’ll surely find out. Mississippi is in the Fifth Circuit, and we all know what that means for the next stage of this appeal. The FSC v. Paxton case will also answer some of these questions within the next 12 months.

Case Citation: NetChoice LLC v. Fitch, 2024 WL 3276409 (S.D. Miss. July 1, 2024)

Related Posts on Age Authentication Mandates