On 15 October 2026, a unanimous Eleventh Circuit panel (Judge Newsom, joined by Judges Luck and Tjoflat) vacated the preliminary injunction against Georgia's SB 351. The law requires covered platforms to verify every user's age, bars under-16s from creating accounts without parental consent, and limits the personal data used to target ads at under-16s. Read closely, the opinion is less a green light for age-gating than a lesson in litigation procedure. That distinction matters for every state now drafting a similar statute.
The strongest case for Georgia
The state's argument deserves a fair hearing. Parents report real difficulty supervising children across dozens of apps, and platforms have had years to solve the problem voluntarily. A parental-consent rule restores a familiar default: minors need an adult's sign-off for many contracts. Georgia Attorney General Chris Carr framed the ruling as a win for families, saying the law is about keeping children safe from online predators and mental-health harms (The Current). Those are legitimate aims, and the Supreme Court has shown some willingness to let states pursue them. In Free Speech Coalition v. Paxton (27 June 2025), the Court applied intermediate scrutiny to Texas's age-verification law for sexually explicit material and upheld it, finding it only incidentally burdened adults' protected speech (Cornell LII).
What the Eleventh Circuit actually held
The panel did not declare SB 351 constitutional. NetChoice's own litigation director, Paul Taske, said as much: the court "did not hold that SB 351 is constitutional" (The Current). The decision turned on three points.
- The facial-challenge burden. Under Moody v. NetChoice (1 July 2024), a plaintiff must show that "a substantial number of [the law's] applications are unconstitutional, judged in relation to the statute's plainly legitimate sweep" (Moody opinion; text). Per Eugene Volokh's summary, the panel found NetChoice had focused on "heartland" applications such as large social networks and had not supplied a full list of its own affected members or identified other covered sites, so the court could not weigh unconstitutional applications against constitutional ones (Volokh Conspiracy).
- The vagueness theory. The district court had found the "commercially reasonable" age-verification standard unconstitutionally vague. The panel held that theory was raised sua sponte and never pleaded, so granting relief on it violated the party-presentation principle (Volokh Conspiracy).
- Section 230. The court held that § 230 does not bar the advertising restriction. Section 230(c)(1) provides that no provider "shall be treated as the publisher or speaker" of information supplied by another (47 U.S.C. § 230). A ban on using personal data to target minors with ads regulates the platform's own conduct, not liability for a user's content.
Why the procedural framing should worry innovators
The advertising holding is probably the least controversial part, and a narrow data-use limit is the kind of proportionate rule this publication has favoured. The harder issue is the facial-challenge posture. Moody was a unanimous demand for careful, record-based analysis, and the Eleventh Circuit applied it strictly. The consequence is that a law with sweeping access restrictions takes effect while the evidence is still being gathered. The Current reports that Georgia can now enforce the law and that the case returns to the district court, where Judge Amy Totenberg had granted the injunction in June 2025 (The Current).
That sequencing imposes real costs before any merits ruling. Age verification for all users, not just minors, means every adult in Georgia may need to prove their age to read or post on covered services. Smaller and newer platforms, which cannot absorb the engineering, vendor and liability costs the way Meta or YouTube can, bear the heaviest burden. A rule that entrenches incumbents in the name of child safety is a poor trade.
Proportionality, not prohibition
The Paxton analogy is weaker than Georgia will argue. That case concerned content obscene as to minors, where states have long had room to act. SB 351 conditions access to general-purpose social platforms, which carry news, political speech and community life for teenagers aged 13 to 15. Intermediate scrutiny would still require tailoring, and less restrictive options exist: default privacy settings for teen accounts, device-level parental controls, limits on targeted advertising, and enforcement against platforms that ignore known harms. The advertising limit that survived § 230 scrutiny is itself an example of a narrower tool.
There is also an evidentiary lesson. The panel faulted NetChoice for thin proof, and future challengers will respond with member-by-member declarations and expert records. States, in turn, should expect their laws to be tested against that fuller record. Legislators who want durable protections should write statutes that can survive the weighing Moody requires: narrow definitions of covered services, privacy-preserving verification, and clear exemptions for educational and news services.
What to watch
NetChoice said it is evaluating its legal options. Possible paths include en banc review, a renewed as-applied challenge, or a better-developed facial record on remand. Until then, Georgia families and platforms operate under a law whose constitutionality has been postponed, not decided. For a policy debate that benefits from clarity, that is an unsatisfying outcome, and a reminder that the strongest child-safety rules are the ones built to withstand scrutiny on the merits.