OPINION

FISHER, Circuit Judge:

We address the constitutionality of a California charitable registration requirement as applied to two nonprofit organizations that solicit tax-deductible contributions in the state. Americans for Prosperity Foundation (the Foundation) and Thomas More Law Center (the Law Center) qualify as tax-exempt charitable organizations under § 501(c)(3) of the Internal Revenue Code, 26 U.S.C. § 501(c)(3). They challenge the Attorney General of California's collection of Internal Revenue Service (IRS) Form 990 Schedule B, which contains the names and addresses of their relatively few largest contributors. The Attorney General uses the information solely to prevent charitable fraud, and the information is not to be made public except in very limited circumstances. The plaintiffs argue the state's disclosure requirement impermissibly burdens their First Amendment right to free association by deterring individuals from making contributions.

The district court held that the Schedule B requirement violates the First Amendment as applied to the Foundation and Law Center and permanently enjoined the Attorney General from demanding the plaintiffs' Schedule B forms. We have jurisdiction under 28 U.S.C. § 1291, and we vacate the injunctions, reverse the judgments and remand for entry of judgment in the Attorney General's favor.

We hold that the California Attorney General's Schedule B requirement, which obligates charities to submit the very information they already file each year with the IRS, survives exacting scrutiny as applied to the plaintiffs because it is substantially related to an important state interest in policing charitable fraud. Even assuming arguendo that the plaintiffs' contributors would face substantial harassment if Schedule B information became public, the strength of the state's interest in collecting Schedule B information reflects the actual burden on First Amendment rights because the information is collected solely for nonpublic use, and the risk of inadvertent public disclosure is slight.

I.

A.

California's Supervision of Trustees and Charitable Trusts Act requires the Attorney General to maintain a registry of charitable corporations (the Registry) and authorizes him to obtain "whatever information, copies of instruments, reports, and records are needed for the establishment and maintenance of the [Registry]." Cal. Gov't Code § 12584. To solicit tax-deductible contributions from California residents, an organization must maintain membership in the Registry. See id. § 12585. Registry information is open to public inspection, subject to reasonable rules and regulations adopted by the Attorney General. See id. § 12590.

As one condition of Registry membership, the Attorney General requires charities to submit a complete copy of the IRS Form 990 they file with the IRS, including attached schedules. See Cal. Code Regs. tit. 11, § 301.1 One of these attachments, Schedule B, requires 501(c)(3) organizations to report the names and addresses of their largest contributors. Generally, they must report "the names and addresses of all persons who contributed ... $5,000 or more (in money or other property) during the taxable year." 26 C.F.R. § 1.6033-2(a)(2)(ii)(f). Special rules, however, apply to organizations, such as the Foundation and Law Center, meeting certain support requirements. These organizations need only "provide the name and address of a person who contributed ... in excess of 2 percent of the total contributions ... received by the organization during the year." Id. § 1.6033-2(a)(2)(iii)(a). An organization with $10 million in receipts, for example, is required to disclose only contributors providing at least $200,000 in financial support. Here, for any year between 2010 and 2015, the Law Center was obligated to report no more than seven contributors on its Schedule B, and the Foundation was required to report no more than 10 contributors — those contributing over $250,000 to the Foundation.

The IRS and the California Attorney General both make certain filings of tax-exempt organizations publicly available but exclude Schedule B information from public inspection. See 26 U.S.C. § 6104; Cal Gov't Code § 12590; Cal. Code Regs. tit. 11, § 310. At the outset of this litigation, the Attorney General maintained an informal policy treating Schedule B as a confidential document not available for public inspection on the Registry. See Americans for Prosperity Found. v. Harris, 809 F.3d 536, 542 (9th Cir. 2015) (AFPF I). In 2016, the Attorney General codified that policy, adopting a regulation that makes Schedule B information confidential and exempts it from public inspection except in a judicial or administrative proceeding or in response to a search warrant. See Cal. Code Regs. tit. 11, § 310 (July 8, 2016). Under the new regulation:

Id. § 310(b). In accordance with this regulation, the Attorney General keeps Schedule Bs in a separate file from other submissions to the Registry and excludes them from public inspection on the Registry website.

B.

Thomas More Law Center is a legal organization founded to "restore and defend America's Judeo-Christian heritage" by "represent[ing] people who promote Roman Catholic values," "marriage and family matters, freedom from government interference in [religion]" and "opposition to the imposition of Sharia law within the United States." Americans for Prosperity Foundation was founded in 1987 as "Citizens for a Sound Economy Educational Foundation," with the mission of "further[ing] free enterprise, free society-type issues." The Foundation hosts conferences, issues policy papers and develops educational programs worldwide to promote the benefits of a free market. It operates alongside Americans for Prosperity, a 501(c)(4) organization focused on direct issue advocacy.

Charities like the Foundation and the Law Center are overseen by the Charitable Trusts Section of the California Department of Justice, which houses the Registry and a separate investigative and legal enforcement unit (the Investigative Unit). The Registry Unit processes annual registration renewals and maintains both the public-facing website of registered charities and the confidential database used for enforcement. The Investigative Unit analyzes complaints of unlawful charity activity and conducts audits and investigations based on those complaints.

Beginning in 2010, the Registry Unit ramped up its efforts to enforce charities' Schedule B obligations, sending thousands of deficiency letters to charities that had not complied with the Schedule B requirement. Since 2001, both the Law Center and the Foundation had either filed redacted versions of the Schedule B or not filed it with the Attorney General at all. Each plaintiff had, however, annually filed a complete Schedule B with the IRS. In 2012, the Registry Unit informed the Law Center it was deficient in submitting Schedule B information. In 2013, it informed the Foundation of the same deficiency.

C.

In response to the Attorney General's demands, the Law Center and the Foundation separately filed suit, alleging that the Schedule B requirement unconstitutionally burdens their First Amendment right to free association by deterring individuals from financially supporting them. The district court granted both plaintiffs' motions for a preliminary injunction, concluding they had raised serious questions going to the merits of their cases and demonstrated that the balance of hardships tipped in their favor. See Americans for Prosperity Found. v. Harris, No. 2:14-CV-09448-R-FFM, 2015 WL 769778 (C.D. Cal. Feb. 23, 2015). The Attorney General appealed.

While those appeals were pending, we upheld the Schedule B requirement against a facial constitutional challenge brought by the Center for Competitive Politics. See Ctr. for Competitive Politics v. Harris, 784 F.3d 1307, 1317 (9th Cir. 2015). Applying exacting scrutiny, we held both that the Schedule B requirement furthers California's compelling interest in enforcing its laws and that the plaintiff had failed to show the requirement places an actual burden on First Amendment rights. See id. at 1316-17. We left open the possibility, however, that a future litigant might "show `a reasonable probability that the compelled disclosure of its contributors' names will subject them to threats, harassment, or reprisals from either Government officials or private parties' that would warrant relief on an as-applied challenge." Id. at 1317 (alteration omitted) (quoting Buckley v. Valeo, 424 U.S. 1, 74, 96 S.Ct. 612, 46 L.Ed.2d 659 (1976)).

The Law Center and the Foundation argue they have made such a showing. In considering the appeal from the preliminary injunction in their favor, we disagreed. See AFPF I, 809 F.3d at 540. We held that the plaintiffs had shown neither an actual chilling effect on association nor a reasonable probability of harassment at the hands of the state from the Attorney General's demand for nonpublic disclosure of Schedule B forms. See id. The Law Center and the Foundation had proffered some evidence that private citizens might retaliate against their contributors if Schedule B information became public, but "[t]he plaintiffs' allegations that technical failures or cybersecurity breaches are likely to lead to inadvertent public disclosure of their Schedule B forms [were] too speculative to support issuance of an injunction." Id. at 541.

We nevertheless identified some risk that the Attorney General could be compelled by § 12590 to make Schedule B information available for public inspection in the absence of a "rule[]" or "regulation[]," Cal. Gov't Code § 12590, formalizing the Attorney General's discretionary policy of maintaining Schedule B confidentiality. See AFPF I, 809 F.3d at 542. The Attorney General had proposed a regulation to exempt Schedule B forms from the general requirement to make Registry filings "open to public inspection," Cal. Gov't Code § 12590, but the state had not yet adopted the proposed regulation. We held that a narrow injunction precluding public disclosure of Schedule B information would address the risk of public disclosure pending the Attorney General's adoption of the proposed regulation. We therefore vacated the district court's orders precluding the Attorney General from collecting Schedule B information from the plaintiffs and instructed the court to enter new orders preliminarily enjoining the Attorney General only from making Schedule B information public. See AFPF I, 809 F.3d at 543.2

After presiding over a bench trial in each case, the district court held the Schedule B requirement unconstitutional as applied to the Foundation and the Law Center. See Thomas More Law Ctr. v. Harris, No. CV 15-3048-R, 2016 WL 6781090 (C.D. Cal. Nov. 16, 2016); Americans for Prosperity Found. v. Harris, 182 F.Supp.3d 1049 (C.D. Cal. 2016). The district court first rejected the plaintiffs' facial challenges, holding they were precluded by our opinion in Center for Competitive Politics. It then held that the Attorney General had failed to prove the Schedule B requirement was substantially related to a sufficiently important governmental interest, as necessary to withstand exacting scrutiny. The court reasoned that the Attorney General had no need to collect Schedule Bs, because he "has access to the same information from other sources," Thomas More Law Ctr., 2016 WL 6781090, at *2, and had failed to demonstrate the "necessity of Schedule B forms" in investigating charity wrongdoing, Americans for Prosperity Found., 182 F.Supp.3d at 1053. The court also concluded there was "ample evidence" establishing the plaintiffs' employees and supporters face public hostility, intimidation, harassment and threats "once their support for and affiliation with the organization becomes publicly known." Id. at 1055. The court rejected the proposition that the Attorney General's informal confidentiality policy could "effectively avoid inadvertent disclosure" of Schedule B information, citing a "pervasive, recurring pattern of uncontained Schedule B disclosures" by the Registry Unit. Id. at 1057. Even after the Attorney General codified the non-disclosure policy, the court concluded that this risk of inadvertent public disclosure remained. See Thomas More Law Ctr., 2016 WL 6781090, at *5.

Having found for the plaintiffs on their First Amendment freedom of association claims, the court entered judgment for the plaintiffs and permanently enjoined the Attorney General from enforcing the Schedule B requirement against them. The Attorney General appealed the judgments. The plaintiffs cross-appealed, challenging the district court's holding that precedent foreclosed a facial attack on the Schedule B requirement. The Law Center also cross-appealed the district court's adverse rulings on its Fourth Amendment and preemption claims, and the district court's failure to award it attorney's fees.

II.

"In reviewing a judgment following a bench trial, this court reviews the district court's findings of fact for clear error and its legal conclusions de novo." Dubner v. City & County of San Francisco, 266 F.3d 959, 964 (9th Cir. 2001). "[W]e will affirm a district court's factual finding unless that finding is illogical, implausible, or without support in inferences that may be drawn from the record." United States v. Hinkson, 585 F.3d 1247, 1263 (9th Cir. 2009) (en banc) (footnote omitted).

III.

We address whether the Attorney General's Schedule B requirement violates the First Amendment right to freedom of association as applied to the plaintiffs. We apply "exacting scrutiny" to disclosure requirements. See Doe v. Reed, 561 U.S. 186, 196, 130 S.Ct. 2811, 177 L.Ed.2d 493 (2010). "That standard `requires a substantial relation between the disclosure requirement and a sufficiently important governmental interest.'" Id. (quoting Citizens United v. FEC, 558 U.S. 310, 366-67, 130 S.Ct. 876, 175 L.Ed.2d 753 (2010)). "To withstand this scrutiny, `the strength of the governmental interest must reflect the seriousness of the actual burden on First Amendment rights.'" Id. (quoting Davis v. FEC, 554 U.S. 724, 744, 128 S.Ct. 2759, 171 L.Ed.2d 737 (2008)).

The plaintiffs contend "[t]he `substantial relation' element requires, among other things, that the State employ means `narrowly drawn' to avoid needlessly stifling expressive association." They cite Louisiana ex rel. Gremillion v. NAACP, 366 U.S. 293, 297, 81 S.Ct. 1333, 6 L.Ed.2d 301 (1961) ("[W]hile public safety, peace, comfort, or convenience can be safeguarded by regulating the time and manner of solicitation, those regulations need to be `narrowly drawn to prevent the supposed evil.'" (citation omitted) (quoting Cantwell v. Connecticut, 310 U.S. 296, 307, 60 S.Ct. 900, 84 S.Ct. 1213 (1940))), Shelton v. Tucker, 364 U.S. 479, 488, 81 S.Ct. 247, 5 L.Ed.2d 231 (1960) ("In a series of decisions this Court has held that, even though the governmental purpose be legitimate and substantial, that purpose cannot be pursued by means that broadly stifle fundamental personal liberties when the end can be more narrowly achieved."), and McCutcheon v. FEC, 572 U.S. 185, 134 S.Ct. 1434, 1456-57, 188 L.Ed.2d 468 (2014) (plurality opinion) ("Even when the Court is not applying strict scrutiny, we still require `a fit that is not necessarily perfect, but reasonable; that represents not necessarily the single best disposition but one whose scope is in proportion to the interest served, ... that employs not necessarily the least restrictive means but ... a means narrowly tailored to achieve the desired objective.'" (alterations in original) (quoting Board of Trustees of State Univ. of N.Y. v. Fox, 492 U.S. 469, 480, 109 S.Ct. 3028, 106 L.Ed.2d 388 (1989))). We are not persuaded, however, that the standard the plaintiffs advocate is distinguishable from the ordinary "substantial relation" standard that both the Supreme Court and this court have consistently applied in disclosure cases such as Doe and Family PAC v. McKenna, 685 F.3d 800, 805-06 (9th Cir. 2012). To the extent the plaintiffs ask us to apply the kind of "narrow tailoring" traditionally required in the context of strict scrutiny, or to require the state to choose the least restrictive means of accomplishing its purposes, they are mistaken. See, e.g., Citizens United v. Schneiderman, 882 F.3d 374, 381 (2d Cir. 2018) (rejecting the plaintiffs' request "to apply strict scrutiny and to hold that any mandatory disclosure of a member or donor list is unconstitutional absent a compelling government interest and narrowly drawn regulations furthering that interest"); AFPF I, 809 F.3d at 541 ("The district court's conclusion that the Attorney General's demand for national donor information may be more intrusive than necessary does not raise serious questions because `exacting scrutiny is not a least-restrictive-means test.'" (quoting Chula Vista Citizens for Jobs & Fair Competition v. Norris, 782 F.3d 520, 541 (9th Cir. 2015) (en banc))); Ctr. for Competitive Politics, 784 F.3d at 1312 ("[The plaintiff's argument] that the Attorney General must have a compelling interest in the disclosure requirement, and that the requirement must be narrowly tailored in order to justify the First Amendment harm it causes[,] ... is a novel theory, but it is not supported by our case law or by Supreme Court precedent.").

In short, we apply the "substantial relation" standard the Supreme Court applied in Doe. "To withstand this scrutiny, `the strength of the governmental interest must reflect the seriousness of the actual burden on First Amendment rights.'" Doe, 561 U.S. at 196, 130 S.Ct. 2811 (quoting Davis, 554 U.S. at 744, 128 S.Ct. 2759).

A. The Strength of the Governmental Interest

It is clear that the disclosure requirement serves an important governmental interest. In Center for Competitive Politics, 784 F.3d at 1311, we recognized the Attorney General's argument that "there is a compelling law enforcement interest in the disclosure of the names of significant donors." See also id. at 1317. The Attorney General observed that "such information is necessary to determine whether a charity is actually engaged in a charitable purpose, or is instead violating California law by engaging in self-dealing, improper loans, or other unfair business practices," id. at 1311, and we agreed that "[t]he Attorney General has provided justifications for employing a disclosure requirement instead of issuing subpoenas," id. at 1317. In AFPF I, we reiterated that "the Attorney General's authority to demand and collect charitable organizations' Schedule B forms ... furthers California's compelling interest in enforcing its laws." AFPF I, 809 F.3d at 538-39.

These conclusions are consistent with those reached by the Second Circuit, which recently upheld New York's Schedule B disclosure requirement against a challenge similar to the one presented here. The attorney general explained that the Schedule B disclosure requirement allows him to carry out "his responsibility to protect the public from fraud and self-dealing among tax-exempt organizations." Schneiderman, 882 F.3d at 382. The court agreed with the state that

Id. (alterations, citations and internal quotation marks omitted). The Schedule B requirement, therefore, served the state's important "interests in ensuring organizations that receive special tax treatment do not abuse that privilege and ... in preventing those organizations from using donations for purposes other than those they represent to their donors and the public." Id.

The plaintiffs nonetheless question the strength of the state's governmental interest, arguing the Attorney General's need to collect Schedule B information is belied by the evidence that he does not use the information frequently enough to justify collecting it en masse, he is able to investigate charities without Schedule B information and he does not review individual Schedule B forms until he receives a complaint, at which point he has at his disposal tools of subpoena and audit to obtain the Schedule B information he needs. The district court credited these arguments, concluding that Schedule B information is not "necessary" to the Attorney General's investigations because: the Registry, whose sole job it is to collect and maintain complete registration information, does not actively review Schedule B forms as they come in; Schedule Bs have not been used to trigger investigations; and the Attorney General can obtain a Schedule B through subpoenas and audits when a case-specific need arises. See Americans for Prosperity Found., 182 F.Supp.3d at 1053-54.

We addressed these same arguments, of course, in Center for Competitive Politics, 784 F.3d at 1317, where we expressly rejected the proposition that the Schedule B requirement is insufficiently tailored because the state could achieve its enforcement goals through use of its subpoena power or audit letters. We noted that the state's quick access to Schedule B filings "increases [the Attorney General's] investigative efficiency" and allows him to "flag suspicious activity." Id. For example, as the Attorney General argued in that case,

Id. at 1311.

The evidence at trial confirms our earlier conclusions. Belinda Johns, the senior assistant attorney general who oversaw the Charitable Trusts Section for many years, testified that attempting to obtain a Schedule B from a regulated entity after an investigation began was unsatisfactory. She testified that her office would want "to look at [the] Schedule B ... the moment we thought there might be an issue with the charity." "[I]f we subpoenaed it or sent a letter to the charity, that would tip them off to our investigation, which would allow them potentially to dissipate more assets or hide assets or destroy documents, which certainly happened several times; or it just allows more damage to be done to [the] charity if we don't have the whole document at the outset." Rather than having "to wait extra days," she wanted to "take the action that needs to be taken as quickly as possible." She explained that her office relied on Schedule Bs to "tell us whether or not there was an illegal activity occurring." Where such activity was found, she would "go into court immediately and... request a [temporary restraining order] from the court to freeze assets."

Johns' successor, Tania Ibanez, testified similarly that "getting a Schedule B through a[n] audit letter is not the best use of my limited resources."

Sonja Berndt, a deputy attorney general in the Charitable Trusts Section, confirmed that attempting to obtain Schedule Bs through the auditing process would entail substantial delay.

The district court's other conclusions are equally flawed. Although the state may not routinely use Schedule B information as it comes in, the Attorney General offered ample evidence of the ways his office uses Schedule B information in investigating charities that are alleged to have violated California law. See Cal. Corp. Code §§ 5227, 5233, 5236 (providing examples of the role the Attorney General plays in investigating nonprofit organizations that violate California law). Current and former members of the Charitable Trusts Section, for example, testified that they found the Schedule B particularly useful in several investigations over the past few years, and provided examples. They were able to use Schedule B information to trace money used for improper purposes in connection with a charity serving animals after Hurricane Katrina; to identify a charity's founder as its principal contributor, indicating he was using the research charity as a pass-through; to identify self-dealing in that same charity; to track a for-profit corporation's use of a non-profit organization as an improper vessel for gain; and to investigate a cancer charity's gift-inkind fraud.3

In sum, the record demonstrates that the state has a strong interest in the collection of Schedule B information from regulated charities. We agree with the Second Circuit that the disclosure requirement "clearly further[s]" the state's "important government interests" in "preventing fraud and self-dealing in charities ... by making it easier to police for such fraud." Schneiderman, 882 F.3d at 384.

The district court reached a different conclusion, but it did so by applying an erroneous legal standard. The district court required the Attorney General to demonstrate that collection of Schedule B information was "necessary," Thomas More Law Ctr., 2016 WL 6781090, at *2, that it was no "more burdensome than necessary" and that the state could not achieve its ends "by more narrowly tailored means," id. at *2-3. Because it was "possible for the Attorney General to monitor charitable organizations without Schedule B," the court concluded the requirement is unconstitutional. Id. at *2. The "more burdensome than necessary" test the district court applied, however, is indistinguishable from the narrow tailoring and least-restrictive-means tests that we have repeatedly held do not apply here. The district court's application of this standard, therefore, constituted legal error.

Because the district court applied an erroneous legal standard, it consistently framed the legal inquiry as whether it was possible "that the Attorney General could accomplish her goals without the Schedule B." Id. at *3. Under the substantial relation test, however, the state was not required to show that it could accomplish its goals only by collecting Schedule B information. The state instead properly and persuasively relied on evidence to show that the up-front collection of Schedule B information improves the efficiency and efficacy of the Attorney General's important regulatory efforts. Even if the Attorney General can achieve his goals through other means, nothing in the substantial relation test requires him to forgo the most efficient and effective means of doing so, at least not absent a showing of a significant burden on First Amendment rights. As Steven Bauman, a supervising investigative auditor for the Charitable Trusts Section testified, "We could complete our investigations if you took away many of the tools that we have. We just wouldn't be as effective or as efficient."

Because the strict necessity test the district court applied is not the law, the district court's analysis does not alter our conclusion that the state has a strong interest in the collection of Schedule B information from regulated charities.

B. The Seriousness of the Actual Burden on First Amendment Rights

Having considered the strength of the governmental interest, we turn to the actual burden on the plaintiffs' First Amendment rights.

The Supreme Court has concluded that "compelled disclosure has the potential for substantially infringing the exercise of First Amendment rights." Buckley v. Valeo, 424 U.S. 1, 66, 96 S.Ct. 612, 46 L.Ed.2d 659 (1976). To assess "the possibility that disclosure will impinge upon protected associational activity," id. at 73, 96 S.Ct. 612, we consider "any deterrent effect on the exercise of First Amendment rights," id. at 65, 96 S.Ct. 612.

We may examine, for example, the extent to which requiring "disclosure of contributions ... will deter some individuals who otherwise might contribute," including whether disclosure will "expose contributors to harassment or retaliation." Id. at 68, 96 S.Ct. 612. "[T]hat one or two persons refused to make contributions because of the possibility of disclosure" will not establish a significant First Amendment burden. Id. at 72, 96 S.Ct. 612. Nor will a showing that "people may `think twice' about contributing." Family PAC, 685 F.3d at 807. "[D]isclosure requirements," however, "can chill donations to an organization by exposing donors to retaliation," Citizens United, 558 U.S. at 370, 130 S.Ct. 876, and "[i]n some instances fears of reprisal may deter contributions to the point where the movement cannot survive," Buckley, 424 U.S. at 71, 96 S.Ct. 612. In such cases, the First Amendment burdens are indeed significant.

A party challenging a disclosure requirement, therefore, may succeed by proving "a substantial threat of harassment." Id. at 74, 96 S.Ct. 612. As a general matter, "those resisting disclosure can prevail under the First Amendment if they can show `a reasonable probability that the compelled disclosure of personal information will subject them to threats, harassment, or reprisals from either Government officials or private parties.'" Doe, 561 U.S. at 200, 130 S.Ct. 2811 (alteration omitted) (quoting Buckley, 424 U.S. at 74, 96 S.Ct. 612); see also Citizens United, 558 U.S. at 370, 130 S.Ct. 876.4

Here, the plaintiffs contend requiring them to comply with the Attorney General's Schedule B disclosure requirement will impose a significant First Amendment burden in two related ways. First, they contend requiring them to comply with the Schedule B requirement will deter contributors. Second, they argue disclosure to the Attorney General will subject their contributors to threats, harassment and reprisals. We consider these contentions in turn.

1. Evidence That Disclosure Will Deter Contributors

We begin by considering whether disclosure will deter contributors. We first consider evidence presented by the Foundation. We then consider evidence presented by the Law Center.

Christopher Joseph Fink, the Foundation's chief operating officer, testified that prospective contributors' "number one concern is about being disclosed." He testified that "they are afraid to have their information in the hands of state government or a federal government or in the hands of the public." He testified that business owners "are afraid if they are associated with our foundation or with Americans for Prosperity, their businesses would be targeted or audited from the state government." Teresa Oelke, the Foundation's vice president of state operations, described two individuals who, she believed, stopped supporting the Foundation in light of actual or feared retaliation by the IRS. One contributor "did business with the Government," and he and his business associates "did not feel like they could take on the risk of continuing to give to us." Another contributor allegedly stopped giving "because he, his business partner and their business had experienced seven different reviews from government agencies, including individual IRS audits, both personally and their businesses, and their family was not willing to continue enduring the emotional, financial, time stress and the stress that it placed on their business." Oelke testified that, on average, the Foundation and Americans for Prosperity combined lose "roughly three donors a year" due to "their concern that they are going to be disclosed and the threats that they believe that being disclosed lays to either their business, their families or just their employees." Paul Schervish, an emeritus professor of sociology, testified that, in his opinion, disclosure to the California Attorney General would chill contributions to the Foundation, although he conceded that he had not actually spoken to any of the Foundation's contributors. Foundation President Tim Phillips testified that contributors see the California Attorney General's office as "a powerful partisan office." The Foundation also points to evidence that, in its view, shows that some California officials harbor a negative attitude toward Charles and David Koch.

The Law Center introduced a letter from a contributor who chose to make a $25 contribution anonymously out of fear that ISIS would break into the Law Center's office, obtain a list of contributors and target them. Schervish, the sociology professor, opined that the Law Center's "disclosure of Schedule B to the registry would chill contributions." He acknowledged, however, that he had not spoken with any of the Law Center's existing or prospective contributors, and he could not point to any contributor who had reduced or eliminated his or her support for the Law Center due to the fear of disclosure — a common weakness in the Law Center's evidence.

For example, Thomas Monaghan, the Law Center's co-founder and most wellknown contributor, testified that he is not aware of any Law Center contributor who was "harassed in some way because they made a donation." Despite being included "at the top of a list ... of the most antigay persons in the country" (allegedly because of his financial support for the Law Center), he remains "perfectly willing" to be listed on the Law Center's website as "one of the people who helped to establish" the Law Center. Similarly, the Law Center's president testified that he has never had a conversation with a potential contributor who was unwilling to contribute to the Law Center because of the public controversy surrounding the Law Center or its disclosure requirements. For years, moreover, the Law Center has over-disclosed contributor information on Schedule Bs filed with the IRS. Although by law the Law Center is required to disclose only those contributors furnishing 2 percent or more of the organization's receipts (about five to seven contributors a year), it has instead chosen to disclose all contributors providing $5,000 or more in financial support (about 23 to 60 contributors a year). This voluntary over-disclosure tends to undermine the Law Center's contention that Schedule B disclosure meaningfully deters contributions.

Considered as a whole, the plaintiffs' evidence shows that some individuals who have or would support the plaintiffs may be deterred from contributing if the plaintiffs are required to submit their Schedule Bs to the Attorney General. The evidence, however, shows at most a modest impact on contributions. Ultimately, neither plaintiff has identified a single individual whose willingness to contribute hinges on whether Schedule B information will be disclosed to the California Attorney General. Although there may be a small group of contributors who are comfortable with disclosure to the IRS, but who would not be comfortable with disclosure to the Attorney General, the evidence does not show that this group exists or, if it does, its magnitude. As the Second Circuit explained:

Schneiderman, 882 F.3d at 384.

The mere possibility that some contributors may choose to withhold their support does not establish a substantial burden on First Amendment rights. A plaintiff cannot establish a significant First Amendment burden by showing only "that one or two persons refused to make contributions because of the possibility of disclosure," Buckley, 424 U.S. at 72, 96 S.Ct. 612, or that "people may `think twice' about contributing," Family PAC, 685 F.3d at 807. The evidence presented by the plaintiffs here does not show that disclosure to the Attorney General will "actually and meaningfully deter contributors," id., or that disclosure would entail "the likelihood of a substantial restraint upon the exercise by [their contributors] of their right to freedom of association," NAACP v. Alabama ex rel. Patterson, 357 U.S. 449, 462, 78 S.Ct. 1163, 2 L.Ed.2d 1488 (1958).5 Cf. Bates v. City of Little Rock, 361 U.S. 516, 521 n.5, 80 S.Ct. 412, 4 L.Ed.2d 480 (1960) (between 100 and 150 members declined to renew their NAACP membership, citing disclosure concerns); Dole v. Serv. Emps. Union, AFL-CIO, Local 280, 950 F.2d 1456, 1460 (9th Cir. 1991) (placing particular weight on two letters explaining that because meeting minutes might be disclosed, union members would no longer attend meetings).

The Schedule B requirement, moreover, is not a sweeping one. It requires the Foundation and the Law Center to disclose only their dozen or so largest contributors, and a number of these contributors are already publicly identified, because they are private foundations which by law must make their expenditures public. As applied to these plaintiffs, therefore, the Schedule B requirement is a far cry from the broad and indiscriminate disclosure laws passed in the 1950s to harass and intimidate members of unpopular organizations. See, e.g., Gremillion, 366 U.S. at 295, 81 S.Ct. 1833 (invalidating a state law requiring every organization operating in the state "to file with the Secretary of State annually `a full, complete and true list of the names and addresses of all of the members and officers' in the State"); Shelton, 364 U.S. at 480, 81 S.Ct. 247 (invalidating a state law "compel[ing] every teacher, as a condition of employment in a state-supported school or college, to file annually an affidavit listing without limitation every organization to which he has belonged or regularly contributed within the preceding five years").

In sum, the plaintiffs have not shown a significant First Amendment burden on the theory that complying with the Attorney General's Schedule B nonpublic disclosure requirement will chill contributions.

2. Evidence That Disclosure to the Attorney General Will Subject Contributors to Threats, Harassment and Reprisals

Alternatively, the plaintiffs seek to establish a First Amendment burden by showing that, if they are required to disclose their Schedule B information to the Attorney General, there is "a reasonable probability that the compelled disclosure of personal information will subject [their contributors] to threats, harassment, or reprisals from either Government officials or private parties." Doe, 561 U.S. at 200, 130 S.Ct. 2811 (alteration omitted) (quoting Buckley, 424 U.S. at 74, 96 S.Ct. 612). This inquiry necessarily entails two questions: (1) what is the risk of public disclosure; and (2), if public disclosure does occur, what is the likelihood that contributors will be subjected to threats, harassment or reprisals? We consider these questions in reverse order.

a. Likelihood of Retaliation

The first question, then, is whether the plaintiffs have shown that contributors are likely to be subjected to threats, harassment or reprisals if Schedule B information were to become public. We again consider the Foundation's evidence first, followed by the Law Center's evidence.

The Foundation's evidence undeniably shows that some individuals publicly associated with the Foundation have been subjected to threats, harassment or economic reprisals. Lucas Hilgemann, the Foundation's chief executive officer, testified that he was harassed and targeted, and his personal information posted online, in connection with his work surrounding union "right to work" issues in Wisconsin. Charles and David Koch have received death threats, and Christopher Fink, the Foundation's chief operating officer, has received death threats for publicly contributing to the Foundation through his family's private foundation. Art Pope, a member of the Foundation's board of directors, and a contributor through his family foundation, testified that he received a death threat and has been harassed by "a series of articles" that falsely accuse him of "funding global warming deni[al]." His businesses have been boycotted, although we hesitate to attribute those boycotts to Pope's association with the Foundation.6

In some cases, moreover, the Foundation's actual or perceived contributors may have faced economic reprisals or other forms of harassment. Teresa Oelke, for instance, cited

Hilgemann, the Foundation's CEO, suggested that during the "right to work" campaign in Wisconsin in 2012, an opposition group "pulled together a list of suspected donors to the Foundation because of their interactions with groups like ours in the past that had been publicized. [Opponents] boycotted their businesses. They made personal and private threats against them, their families and their business and their employees."7

The Law Center, too, has presented some evidence to suggest individuals associated with the Law Center have experienced harassment, although it is less clear to what extent it results solely from that association. The Law Center, for instance, points to: a smattering of critical letters, phone calls and emails it has received over the years; the incident in which Monaghan was placed on a list of "the most antigay persons in the country" after the Law Center became involved in a controversial lawsuit; and threats and harassment its clients, such as Robert Spencer and Pamela Geller, have received based on their controversial public activities. As noted, however, Monaghan could not recall any situation in which a contributor to the Law Center was harassed, or expressed concerns about being harassed, on account of having contributed to the Law Center.

On the one hand, this evidence plainly shows at least the possibility that the plaintiffs' Schedule B contributors would face threats, harassment or reprisals if their information were to become public. Such harassment, however, is not a foregone conclusion. In 2013, after acquiring copies of the Foundation's 2001 and 2003 Schedule B filings, the National Journal published an article publicly identifying many of the Foundation's largest contributors.8 If, as the plaintiffs contend, public disclosure of Schedule B information would subject their contributors to widespread retaliation, we would expect the Foundation to present evidence to show that, following the National Journal's unauthorized Schedule B disclosure, its contributors were harassed or threatened. No such evidence, however, has been presented.

Ultimately, we need not decide whether the plaintiffs have demonstrated a reasonable probability that the compelled disclosure of Schedule B information would subject their contributors to a constitutionally significant level of threats, harassment or reprisals if their Schedule B information were to become public. See Doe, 561 U.S. at 200, 130 S.Ct. 2811.9 As we explain next, we are not persuaded that there exists a reasonable probability that the plaintiffs' Schedule B information will become public as a result of disclosure to the Attorney General. Thus, the plaintiffs have not established a reasonable probability of retaliation from compliance with the Attorney General's disclosure requirement.

b. Risk of Public Disclosure

The parties agree that, as a legal matter, public disclosure of Schedule B information is prohibited. California law allows for public inspection of charitable trust records, with the following exception:

Cal. Code Regs. tit. 11, § 310(b).10 The plaintiffs argue, however, that their Schedule B information may become public because the Attorney General has a poor track record of shielding the information from the public view.

We agree that, in the past, the Attorney General's office has not maintained Schedule B information as securely as it should have, and we agree with the plaintiffs that this history raises a serious concern. The state's past confidentiality lapses are of two varieties: first, human error when Registry staff miscoded Schedule B forms during uploading; and second, a software vulnerability that failed to block access to the Foundation's expert, James McClave, as he probed the Registry's servers for flaws during this litigation.

We are less concerned with the latter lapse. McClave discovered that by manipulating the hexadecimal ending of the URL corresponding to each file on the Registry website, he could access a file that was confidential and did not correspond to a clickable link on the website. That is, although documents were deemed "confidential," that meant only that they were not visible to the public; it did not mean they were not still housed on the public-facing Registry website. By altering the single digit at the end of the URL, McClave was able to access, one at a time, all 350,000 of the Registry's confidential documents. This lapse was a singularity, stemming from an issue with the Attorney General's third-party security vendor. When it was brought to the Attorney General's attention during trial, the vulnerability was quickly remedied. There is no evidence to suggest that this type of error is likely to recur.

We are more concerned with human error. As part of an iterative search on the public-facing website of the Registry, McClave found approximately 1800 confidential Schedule Bs that had been misclassified as public over several years. The Attorney General promptly removed them from public access, but some had remained on the website since 2012, when the Registry began loading its documents to servers.

Much of this error can be traced to the large amount of paper the Registry Unit processes around the same time each year. The Registry Unit receives over 60,000 registration renewals annually, and 90 percent are filed in hard copy. It processes each by hand before using temporary workers and student workers to scan them into an electronic record system. The volume and tediousness of the work seems to have resulted in some staff occasionally mismarking confidential Schedule Bs as public and then uploading them to the public-facing site.

Recognizing the serious need to protect confidentiality, however, the Registry Unit has implemented stronger protocols to prevent human error. It has implemented "procedural quality checks ... to sample work as it [is] being performed" and to ensure it is "in accordance with procedures on handling documents and [indexing them] prior to uploading." It has further implemented a system of text-searching batch uploads before they are scanned to the Registry site to ensure none contains Schedule B keywords. At the time of trial in 2016, the Registry Unit had halted batch uploads altogether in favor of loading each document individually, as it was refining the text-search system. After forms are loaded to the Registry, the Charitable Trusts Section runs an automated weekly script to identify and remove any documents that it had inadvertently misclassified as public. There is also no dispute that the Registry Unit immediately removes any information that an organization identifies as having been misclassified for public access.

Nothing is perfectly secure on the internet in 2018, and the Attorney General's data are no exception, but this factor alone does not establish a significant risk of public disclosure. As the Second Circuit recently explained, "[a]ny form of disclosure-based regulation — indeed, any regulation at all — comes with some risk of abuse. This background risk does not alone present constitutional problems." Schneiderman, 882 F.3d at 383.

Although the plaintiffs have shown the state could afford to test its own systems with more regularity, they have not shown its cybersecurity protocols are deficient or substandard as compared to either the industry or the IRS, which maintains the same confidential information.11 We agree with the Second Circuit that "there is always a risk somebody in the Attorney General's office will let confidential information slip notwithstanding an express prohibition. But if the sheer possibility that a government agent will fail to live up to her duties were enough for us to assume those duties are not binding, hardly any government action would withstand our positively philosophical skepticism." Id. at 384.

Although the district court appears to have concluded that there is a high risk of public disclosure notwithstanding the promulgation of § 310 and the Attorney General's adoption of additional security measures, the court appears to have rested this conclusion solely on the state's past "inability to ensure confidentiality." Thomas More Law Ctr., 2016 WL 6781090, at *5. In light of the changes the Attorney General has adopted since those breaches occurred, however, the evidence does not support the inference that the Attorney General is likely to inadvertently disclose either the Law Center's or the Foundation's Schedule B in the future. The risk of inadvertent disclosure of any Schedule B information in the future is small, and the risk of inadvertent disclosure of the plaintiffs' Schedule B information in particular is smaller still. To the extent the district court found otherwise, that finding was clearly erroneous.

Given the slight risk of public disclosure, we cannot say that the plaintiffs have shown "a reasonable probability that the compelled disclosure of personal information will subject them to threats, harassment, or reprisals." See Doe, 561 U.S. at 200, 130 S.Ct. 2811 (alteration omitted) (quoting Buckley, 424 U.S. at 74, 96 S.Ct. 612).

In sum, the plaintiffs have not shown that compliance with the Attorney General's Schedule B requirement will impose significant First Amendment burdens. The plaintiffs have not demonstrated that compliance with the state's disclosure requirement will meaningfully deter contributions. Nor, in light of the low risk of public disclosure, have the plaintiffs shown a reasonable probability of threats, harassment or reprisals. Because the burden on the First Amendment right to association is modest, and the Attorney General's interest in enforcing its laws is important, Ctr. for Competitive Politics, 784 F.3d at 1317, "the strength of the governmental interest ... reflect[s] the seriousness of the actual burden on First Amendment rights." Doe, 561 U.S. at 196, 130 S.Ct. 2811 (quoting Davis, 554 U.S. at 744, 128 S.Ct. 2759). As applied to the plaintiffs, therefore, the Attorney General's Schedule B requirement survives exacting First Amendment scrutiny.

IV.

The plaintiffs' facial challenges also fail. In AFPF I, we held that we were "bound by our holding in Center for Competitive Politics, 784 F.3d at 1317, that the Attorney General's nonpublic Schedule B disclosure regime is facially constitutional." AFPF I, 809 F.3d at 538. That holding constitutes the law of the case. See Ranchers Cattlemen Action Legal Fund United Stockgrowers of Am. v. U.S. Dep't of Agric., 499 F.3d 1108, 1114 (9th Cir. 2007) ("[T]he general rule [is] that our decisions at the preliminary injunction phase do not constitute the law of the case. Any of our conclusions on pure issues of law, however, are binding." (citations and internal quotation marks omitted)). Even if we were to consider the facial challenges anew, the evidence adduced at these trials does not prove the Schedule B requirement "fails exacting scrutiny in a `substantial' number of cases, `judged in relation to [its] plainly legitimate sweep.'" Ctr. for Competitive Politics, 784 F.3d at 1315 (quoting United States v. Stevens, 559 U.S. 460, 473, 130 S.Ct. 1577, 176 L.Ed.2d 435 (2010)).

We also reject the Law Center's cross-appeal as to its Fourth Amendment and preemption claims. These claims were not proved at trial. We decline to consider the Law Center's motion for attorney's fees because it was not presented to the district court. Finally, we deny the Law Center's motion for judicial notice and the Attorney General's motion to strike portions of the Law Center's reply brief.

The judgments of the district court are reversed. The permanent injunctions are vacated. The case is remanded for entry of judgments in favor of the Attorney General.

INJUNCTIONS VACATED; JUDGMENTS REVERSED; CASES REMANDED.

The Law Center's motion for judicial notice, filed February 12, 2018 (Dkt. 45, No. 16-56855) is DENIED.

The Attorney General's motion to strike, filed February 13, 2018 (Dkt. 47, No. 16-56855), is DENIED.