The temperature of legal risk continues to rise for companies who provide online interactive features such as social media or mobile applications to minors, particularly in the 11th Circuit states of Georgia, Florida, and Alabama. On October 14, 2026, the U.S. Court of Appeals for the Eleventh Circuit vacated and reversed[1] a preliminary injunction on a Florida social media law, House Bill 3 of 2024 (more on the law below).
The decision comes alongside two related developments in the Eleventh Circuit. A day later on October 15, the Eleventh Circuit vacated a preliminary injunction[2] against a Georgia social media law, Senate Bill 351 of 2024, and returned the case to the district court. Meanwhile, Alabamaʼs House Bill 161 of 2026 is scheduled to take effect January 1, 2027. These laws share a child protection objective, but their coverage, age thresholds, and compliance requirements differ substantially.
Law and Decision Details
FLORIDA
Florida HB 3 applies in relevant part to “social media platforms,” defined according to certain features, usage, and algorithm use. Key provisions are that the law requires such platforms to: not allow account creation for minors under the age of 14; delete accounts of minors under the age of 14; obtain parental consent before allowing a minor of age 14 or 15 to create an account; delete accounts of minors age 14 or 15 unless it obtains parental consent; allow and facilitate account deletion requests from minors and parents; and permanently delete all personal information that it holds related to such terminated accounts. Violations are deemed unfair and deceptive trade practices. The Florida Department of Legal Affairs may, in addition, collect civil penalties of up to $50,000 per violation and attorneys fees and court costs.
In analyzing Constitutional challenges to the law, the Eleventh Circuit panel held that the law implicated the First Amendment and that the law’s speech regulation was content-neutral and therefore should be analyzed under intermediate scrutiny instead of strict scrutiny, which would have been required for content-specific speech. Part of the court’s reasoning for determining that the speech is content-neutral is due to the law’s unusual definition of “social media platform,” which the court considered as turning on a platform’s “functional capabilities and features” rather than content. The court then found that the law likely stands up to intermediate scrutiny because it advances an important governmental interest unrelated to the suppression of free speech and because it is likely appropriately tailored to advancing that interest.
Nevertheless, despite overturning the temporary injunction and allowing enforcement for the time being, the court also held that the plaintiffs (the Computer & Communications Industry Association and NetChoice) have standing to continue pressing their constitutional challenges.
GEORGIA
Georgia’s S.B. 351 also applies in relevant part to “social media platforms,” defined in a more traditional sense than in Florida’s law (however subject to a litany of exceptions) to include “online forums that allow account holders to create profiles, upload posts, view and listen to posts, form mutual connections, and interact publicly and privately with other account holders and users.” Key requirements are that platforms must verify account holders’ ages and prohibit minors under age 16 from using their features without parental consent. Platforms must offer a description of content moderation features and allow parents to alter or disable these features. The law also prohibits certain targeted advertising activities to minors. Violations can be enforced as unfair business practices, and the state Attorney General may seek damages for up to $2,500 per violation.
In analyzing NetChoice’s challenges to the law, the Eleventh Circuit also vacated a prior preliminary injunction, and here the court remanded the case back to the district court for further proceedings. Regarding plaintiff’s facial First Amendment challenge, court held that NetChoice failed to show that “the law’s unconstitutional applications substantially outweigh its constitutional ones” and thus failed to carry its required burden of proof in a facial challenge.
ALABAMA
Alabama’s H.B. 161 applies in relevant part to “app store providers” (defined in the usual/expected sense) and “developers” defined as entities that own or control an app made available through an app store or a pre-installed app. Some key requirements for app store providers are: providers must request age category information from Alabama users at account creation and verify age using specified methods; minor accounts must be affiliated with parental accounts and providers must obtain parental consent before allowing app download/purchase or in-app purchases; providers must facilitate and honor parental consent withdrawals; and providers must provide certain notices and obtain updated consents upon receiving notice of significant changes from app developers.
Some key requirements for developers include: verifying the age category of users via certain information made available from app store providers; notify the app store provider of significant changes to the app; request age category data or parental consent for app downloads or purchases; and implement age-related restrictions and safety controls based on the youngest age category of users. Violations will be deemed deceptive trade practices, and in addition, the state Attorney General can collect a civil penalty of up to $7,500 per violation, attorney fees, and court costs.
We are unaware of any current litigation regarding this law. Come January 1, 2027, at present, the law is scheduled to go into full force and effect.
What it Means for Businesses
These Eleventh Circuit decisions and the Alabama law sit at the intersection of social media, online services, and children’s data. Taft has been tracking new and developing social media and children’s data protection laws, as detailed previously here. Upon last review in early 2026, over twenty U.S. states had passed laws regulating social media platforms or other online services that interact with minors. In addition, similar new state laws are constantly being passed (as we recently described here).
As always, please sign up to receive emails of our latest posts here on Privacy and Data Security Insights, and follow us on LinkedIn for the latest in privacy, security and artificial intelligence legal news.
[1] Computer & Communications Industry Association, et al. v. Attorney General, State of Florida, case number 25-11881, in the U.S. Court of Appeals for the Eleventh Circuit.
[2] NetChoice v. Attorney General, State of Georgia, case number 25-12436, in the U.S. Court of Appeals for the Eleventh Circuit.
Recent Comments