Federal Court Says State Regulation That Compels Production Of Code May Violate The First Amendment

A rather interesting First Amendment opinion has been handed down by a federal court in Arizona. (h/t Volokh Conspiracy)

At the heart of it is new mandates for data sharing and data protection by car dealers. In 2019, the Arizona state legislature passed the Dealer Data Security Law, which mandates changes to dealer management systems (DMSs), including the institution of protective measures to limit breaches or leaks of sensitive data held by car dealers.

The law also requires DMS providers to integrate with third parties (like the dealerships themselves) and adopt standardized processes that will facilitate these integrations and improve compatibility between systems. The plaintiffs -- two DMS providers -- sued the state's Attorney General (along with the Arizona Automobile Dealers Association) claiming this new law violated the Constitution by compelling speech, namely the creation of new computer code and documentation.

And so, this law and its good intentions (more compatibility, better protection of sensitive data) is possibly on its way to being declared unconstitutional. As the court sees it [PDF], compelling the production of code violates the First Amendment.

Plaintiffs have sufficiently alleged that the Dealer Law abridges their freedom of speech. Plaintiffs claim that the law violates their free speech rights three ways: (1) by abridging their protected interest in exercising editorial discretion in the content of their computer systems; (2) by requiring that Plaintiffs draft code to facilitate disclosure; and (3) by functionally mandating that Plaintiffs write documents explaining the new standards they have adopted to comply with the Dealer Law. Because Plaintiffs' second proposed interest is sufficient to support its claim, the Court need not address the other assertions.

The court points to previous decisions by federal courts finding that software code is not only expressive, but worthy of First Amendment protections. Not all code falls under these protections, but the demands made by the state appear to do so in this case.

Plaintiffs have sufficiently alleged that the code they must draft to comply with the Dealer Law communicates substantively with the user of the program. The Amended Complaint alleges "Plaintiffs must draft code to receive and respond to requests from `authorized integrators'. . . who will interact with the code by commanding it to communicate the information they choose to request." (Doc. 121 at 51.) It also states that the code will express the creative choices of the software developers and communicate those choices "to those who would access the Plaintiff's DMSs, as well as to other third-party programmers." Id. at 52. Taken as true, these allegations sufficiently allege a protected interest in the content of the code.

The AG argued there's no First Amendment violation here because the law does not tell DMS providers what to say. It only orders them to adopt a data sharing framework that complies with the law. According to the AG, this merely mandates function and access, not how this is accomplished.

Wrong, says the court -- at least at this stage of litigation.

Plaintiffs' allegations go beyond the functional capability of their code because they claim users will interact with their program in a substantive way. Defendants' arguments that the Dealer Law is more properly considered a regulation on conduct therefore amount to disagreements about the factual consequences of the law and the drafted code.

It may be several months before this is resolved, but these arguments against the government's intrusion into private parties' software code has implications that reach beyond the specifics of this case. This is the same argument Apple made when fighting against the federal government's attempt to compel the production of an encryption backdoor in the San Bernardino case.

Under well-settled law, computer code is treated as speech within the meaning of the First Amendment.... The Supreme Court has made clear that where, as here, the government seeks to compel speech, such action triggers First Amendment protections..... Compelled speech is a content-based restriction subject to exacting scrutiny... and so may only be upheld if it is narrowly tailored to obtain a compelling state interest....

This may find its way to the appellate level if the state is unwilling to take a loss in the lower court or if the plaintiffs' First Amendment arguments are ultimately unsuccessful. Once courts start deciding code isn't speech, they invite the government to engage in far more nefarious proxy tinkering than the mild regulatory intercession on display here. Important constitutional questions are often answered during cases like these -- ones without national attention or particularly compelling plaintiffs/defendants. But they still need to be answered and courts still need to consider the long-term effects of their decisions. The First Amendment protects a lot of code, even code targeted by something more benign than a demand for an encryption backdoor.