MILLER, Circuit Judge

Michael A. Scodro (argued), Britt M. Miller, and Brett E. Legner, Bayer Brown LLP, Chicago, Illinois; Thomas J. Dillickrath (argued) and Jonathan R. DeFosse, Sheppard Mullin Richter & Hampton LLP, Washington, D.C.; Brian A. Howie and Lauren E. Stine, Quarles & Brady LLP, Phoenix, Arizona; Molly C. Lorenzi, San Francisco, California; Mark W. Ryan, Washington, D.C.; Aundrea K. Gulley, Brice A. Wilkinson, and Denise Drake, Gibbs & Bruns LLP, Houston, Texas; for Plaintiffs-Appellants.

Brunn (Beau) W. Roysden III (argued) and Rusty D. Crandell, Office of the Attorney General, Phoenix, Arizona; Mary O'Grady and William D. Furnish, Osborn Maledon P.A., Phoenix, Arizona; for Defendants-Appellees.

Derek T. Ho (argued), Aaron M. Panner, Brendan J. Crimmins, Daniel V. Dorris, Joshua Hafenbrack, Bethan R. Jones, and Jayme L. Weber, Kellogg Hansen Todd Figel & Frederick PLLC, Washington, D.C.; John C. Norling, John J. Egbert, Jeffrey D. Gardner, and Jimmie W. Pursell Jr., Jennings Strouss & Salmon P.L.C., Phoenix, Arizona; for Intervenor-Defendants-Appellees.

R.J. "Jim" Sewell Jr, Smith Law Firm P.C., Helena, Montana, for Amicus Curiae Montana Automobile Dealers Association.

Timothy C. Fox, Attorney General; Matthew T. Cochenour, Acting Solicitor General; Jon Bennion, Chief Deputy Attorney General; Office of the Attorney General, Helena, Montana; for Amicus Curiae State of Montana.

Craig Nichols, Nichols Law Group LLP, Portland, Oregon; Aaron H. Jacoby, Victor P. Danhi, Karen Van Essen, and Franjo M. Dolenac, Arent Fox LLP, Los Angeles, California; for Amici Curiae California New Care Dealers Association and Oregon Auto Dealers Association.

Before: William A. Fletcher, Eric D. Miller, and Danielle J. Forrest, Circuit Judges.

MILLER, Circuit Judge: In 2019, the Arizona Legislature enacted a statute aimed at strengthening privacy protections for consumers whose data is collected by car dealers and restricting anticompetitive business practices by technology companies that provide database services for dealers. The statute's key provisions prevent database providers from limiting access to dealer data by dealer-authorized third parties and require providers to create a standardized framework to facilitate such access. Two database providers subject to the statute filed suit and sought a preliminary injunction against its enforcement on the grounds that it is unconstitutional and that it is preempted by numerous federal statutes. After concluding that the plaintiffs were unlikely to succeed on the merits of their claims, the district court denied a preliminary injunction. We affirm.

I

To manage their operations, car dealers use specialized software known as a dealer management system (DMS). The core of a DMS is a database containing information about a dealer's customers, vehicles, accounting, parts, and services. Some of that data, such as customers’ social-security numbers and credit history, is highly sensitive. DMSs use the data to perform a variety of tasks, from sales and accounting to financing and inventory management.

In addition, dealers often rely on separate software applications for aspects of their business, such as managing online marketing and customer relations. In order to function, those third-party applications must be able to access the data stored in a dealer's DMS.

Plaintiffs CDK Global LLC and Reynolds and Reynolds Co. are technology companies that license widely used DMSs to dealers. Between them, they control a substantial majority of the DMS market. They have litigated this case together, and their business practices do not vary in any way that matters to the case, so for simplicity we will refer to them collectively as CDK.

In the past, CDK allowed dealers to share access to the DMS with third-party data-integration companies that would extract a dealer's data from the DMS and reformat it for use in the dealer's other software applications. But a few years ago, CDK began to prohibit that practice. It justified the change as necessary to protect its intellectual property rights and ensure robust system performance and security. CDK now offers its own data-integration services to dealers, albeit at significantly higher prices than independent data integrators do.

Some competing DMS providers continue to permit dealers to grant DMS access to third parties. But switching to a new DMS provider can be costly, and many dealers are locked into long-term contracts with CDK.

In 2019, the Arizona Legislature unanimously enacted a statute—which we will refer to as the "Dealer Law"—to ensure that dealers retain control over their data. See Ariz. Rev. Stat. Ann. §§ 28-4651 to -4655. Two of its provisions are central to this appeal.

First, the Dealer Law prohibits DMS providers from "tak[ing] any action by contract, technical means or otherwise to prohibit or limit a dealer's ability to protect, store, copy, share or use" data the dealer has stored in its DMS. Ariz. Rev. Stat. Ann. §§ 28-4651(7), 28-4653(A)(3). More specifically, DMS providers may not impose charges "beyond any direct costs incurred" for database access. See id. §§ 28-4651(5), 28-4653(A)(3)(a). And as long as a dealer-authorized third-party integrator complies with industry security standards, DMS providers may not prohibit the third party "from integrating into the dealer's data system," nor may they otherwise "plac[e] an unreasonable restriction on integration." Id. §§ 28-4651(1), (9), 28-4653(A)(3)(b).

Second, the Dealer Law requires DMS providers to "[a]dopt and make available a standardized framework for the exchange, integration and sharing of data" with authorized integrators. Ariz. Rev. Stat. Ann. § 28-4654(A)(1). The law specifies that this framework must comply with industry security standards and that it should be implemented using an "open application programming interface[ ]," or "API," unless an API is "not the reasonable commercial or technical standard for secure data integration," in which case a DMS provider may instead "provide a similar open access integration method." Id. § 28-4654(A)(2). APIs are commonly used tools in software development that provide for standardized communications between computer systems. They allow developers to access information and other resources on a remote computer without having to understand the internal operations of the system with which they are interacting. See generally Google LLC v. Oracle Am., Inc. , ––– U.S. ––––, 141 S. Ct. 1183, 1191–93, 209 L.Ed.2d 311 (2021).

CDK sued the Attorney General of Arizona for declaratory and injunctive relief, asserting a wide range of claims. As relevant here, it argued that the Dealer Law is preempted by the Copyright Act, 17 U.S.C. § 101 et seq. , and the Computer Fraud and Abuse Act (CFAA), Pub. L. No. 99-474, 100 Stat. 1213 (1986) (codified at 18 U.S.C. § 1030 ); that it violates the Contracts Clause and the Takings Clause; and that it is void for vagueness. CDK moved for a preliminary injunction.

The Arizona Automobile Dealers Association intervened in defense of the law and, together with the Attorney General, moved to dismiss the complaint. The district court dismissed most of the claims but allowed the copyright preemption, Contracts Clause, and Takings Clause claims to proceed. Following a hearing, the district court denied a preliminary injunction.

II

CDK appeals the denial of a preliminary injunction, and the first issue we must resolve is the scope of its appeal. Specifically, the parties disagree about whether we have jurisdiction over CDK's CFAA and vagueness claims, which the district court dismissed before ruling on the preliminary injunction and therefore did not address in its order denying an injunction. Although 28 U.S.C. § 1292(a)(1) gives us jurisdiction to review an interlocutory order denying injunctive relief, we generally lack jurisdiction to review a non-final order dismissing claims under Federal Rule of Civil Procedure 12(b)(6). Arc of Cal. v. Douglas , 757 F.3d 975, 992 (9th Cir. 2014).

CDK invokes the doctrine of pendent appellate jurisdiction, under which we may review an "otherwise non-appealable ruling" in certain limited situations when it "is inextricably intertwined with or necessary to ensure meaningful review of the order properly before us on interlocutory appeal." Arc of Cal. , 757 F.3d at 992–93 (quoting Melendres v. Arpaio , 695 F.3d 990, 996 (9th Cir. 2012) ). This is not such a situation, however. The CFAA and vagueness claims addressed in the district court's dismissal order are entirely separate from the claims addressed in the preliminary-injunction order. Review of one order does not require review of the other.

The separateness of the issues in the dismissal order and the preliminary-injunction order is underscored by the sequence of the filings in this case. After the district court dismissed the CFAA and vagueness claims, but before it ruled on the preliminary-injunction motion, CDK filed an amended complaint omitting those claims. An amended complaint "supersedes the original complaint," so the amended complaint was the operative pleading at the time the district court ruled on the preliminary-injunction motion. Pacific Bell Tel. Co. v. linkLine Commc'ns, Inc. , 555 U.S. 438, 456 n.4, 129 S.Ct. 1109, 172 L.Ed.2d 836 (2009). The district court could not possibly have abused its discretion by denying an injunction on claims that were not included in that complaint. See LA Alliance for Hum. Rts. v. County of Los Angeles , No. 21-55395, 14 F.4th 947, 957 (9th Cir. Sept. 23, 2021) (A district court "does not have the authority to issue an injunction based on claims not pled in the complaint." (internal quotation marks omitted)). It therefore would not be appropriate for us to review those claims in reviewing the denial of the injunction. We confine our review to the issues addressed in the preliminary-injunction order.

"A plaintiff seeking a preliminary injunction must establish that he is likely to succeed on the merits, that he is likely to suffer irreparable harm in the absence of preliminary relief, that the balance of equities tips in his favor, and that an injunction is in the public interest." Winter v. NRDC, Inc. , 555 U.S. 7, 20, 129 S.Ct. 365, 172 L.Ed.2d 249 (2008). Because we conclude that the first factor—likelihood of success on the merits—is decisive, we need not address the other factors. See Hall v. USDA , 984 F.3d 825, 835 (9th Cir. 2020). We review the denial of a preliminary injunction for abuse of discretion, but we review the district court's underlying legal conclusions de novo. Id.

III

CDK argues that the Dealer Law is preempted by the Copyright Act because it "stands as an obstacle to the accomplishment and execution of the full purposes and objectives of Congress." Puente Ariz. v. Arpaio , 821 F.3d 1098, 1103 (9th Cir. 2016) (quoting Arizona v. United States , 567 U.S. 387, 399, 132 S.Ct. 2492, 183 L.Ed.2d 351 (2012) ). CDK faces a high bar: "The mere fact that there is tension between federal and state law is not enough to establish conflict preemption." MetroPCS Cal., LLC v. Picker , 970 F.3d 1106, 1118 (9th Cir. 2020) (internal quotation marks and alteration omitted). "In the absence of irreconcilability" between state and federal law, "there is no conflict preemption." United States v. California , 921 F.3d 865, 882 (9th Cir. 2019).

Moreover, because CDK has brought a facial challenge to the Dealer Law, it "must show that ‘no set of circumstances exists under which [it] would be valid.’ " Puente Ariz. , 821 F.3d at 1104 (quoting United States v. Salerno , 481 U.S. 739, 745, 107 S.Ct. 2095, 95 L.Ed.2d 697 (1987) ); accord MetroPCS , 970 F.3d at 1122. In other words, it must establish that every possible application of the Dealer Law would conflict with the Copyright Act. See Puente Ariz. , 821 F.3d at 1104. Because CDK cannot carry that burden, the district court correctly concluded that it is unlikely to succeed on its Copyright Act preemption claim. CDK contends that the Dealer Law conflicts with the Copyright Act because it grants dealers and their authorized integrators the right to access CDK's systems and create unlicensed copies of (1) its DMS, (2) its APIs, and (3) its data compilations. In all three respects, it says, the statute conflicts with 17 U.S.C. § 106(1), which grants the owner of a copyrighted work the exclusive right "to reproduce the copyrighted work in copies."

As a preliminary matter, the defendants argue that CDK forfeited these arguments by not raising them in the motion for a preliminary injunction. But although CDK did not advance the first two arguments until its reply in support of the motion for a preliminary injunction, it raised all three arguments at the hearing, and the district court ruled on all three. "[W]hen a party takes a position and the district court rules on it," the argument is preserved. Yamada v. Nobel Biocare Holding AG , 825 F.3d 536, 543 (9th Cir. 2016).

A

CDK first argues that the Dealer Law interferes with its exclusive right to reproduce its copyrighted DMS. That is so, it says, because every time a third party uses the "open access integration method" prescribed by the Dealer Law to integrate with its systems, that party causes a copy of CDK's DMS software to be created in the memory of CDK's servers.

States retain the power to regulate market practices even when those practices relate to copyrighted material. See, e.g. , Watson v. Buck , 313 U.S. 387, 404, 61 S.Ct. 962, 85 L.Ed. 1416 (1941) ; Associated Film Distrib. Corp. v. Thornburgh , 800 F.2d 369, 375 (3d Cir. 1986) ; Allied Artists Picture Corp. v. Rhodes , 679 F.2d 656, 662–63 (6th Cir. 1982). Thus, the Copyright Act does not preempt market regulations that merely "touch copyrighted works indirectly." Orson, Inc. v. Miramax Film Corp. , 189 F.3d 377, 385 (3d Cir. 1999) (en banc). For at least two reasons, the Dealer Law touches CDK's copyrighted works only indirectly, if at all.

First, the district court found that third-party use of an "open access integration method" would not necessarily require a copy of the DMS to be created in memory on CDK's servers. To be sure, CDK presented a witness who testified that "[e]ach time a party sends a request through an API, that party would cause a copy of [the] DMS software to be made in the memory of DMS servers in order to process the request." But for purposes of a facial challenge, the current design of the system is irrelevant—CDK must show that no set of circumstances exists under which the Dealer Law could be valid. And the district court heard testimony that whether a DMS provider would be required to create a copy of its executable code in the memory of its own systems to respond to third-party requests "[d]epends on the implementation." According to one expert witness, if a copy of the code were already running on a provider's system, the provider would not necessarily need to create a new copy but could instead reuse the existing copy. It therefore may be possible for CDK to comply with the Dealer Law without being forced to create a new copy of its software to process third-party requests.

Second, even if CDK were forced to create new copies of its DMS on its own server in response to third-party requests, it has not established that those copies would infringe its reproduction right. The copies that CDK finds objectionable would be copies of its own software running on its own servers and not shared with anyone else. Like other property rights, the right granted by a copyright is the right to exclude others. See 17 U.S.C. § 106. We are unaware of any authority suggesting that causing a copyright holder to make a copy of its own copyrighted work and keep it within the copyright holder's exclusive possession would violate the Copyright Act. In addition, it is possible that causing a DMS provider to copy its software on its own server in these circumstances would constitute fair use. See Assessment Techs. of WI, LLC v. WIREdata, Inc. , 350 F.3d 640, 644–45 (7th Cir. 2003) ; Association of Am. Med. Colls. v. Cuomo , 928 F.2d 519, 523 (2d Cir. 1991) (holding that fair use is relevant to conflict preemption under the Copyright Act).

But we need not resolve those issues because there is another problem with CDK's theory. The reproduction right extends only to the creation of "copies," which are defined by the Copyright Act as "material objects, ... in which a work is fixed ... and from which the work can be perceived, reproduced, or otherwise communicated." 17 U.S.C. § 101. A work is " ‘fixed’ in a tangible medium of expression when its embodiment ... is sufficiently permanent or stable to permit it to be perceived, reproduced, or otherwise communicated for a period of more than transitory duration." Id. ; see Cartoon Network LP, LLLP v. CSC Holdings, Inc. , 536 F.3d 121, 127 (2d Cir. 2008) (explaining that the statute "imposes two distinct but related requirements: ... the ‘embodiment requirement’ " and "the ‘duration requirement’ ").

Loading software into a computer's memory satisfies the embodiment requirement because a computer's memory is a medium from which software "can be ‘perceived, reproduced, or otherwise communicated.’ " MAI Sys. Corp. v. Peak Comput., Inc. , 991 F.2d 511, 518–19 (9th Cir. 1993) (quoting 17 U.S.C. § 101 ). But embodiment alone does not result in the creation of a copy; the embodiment must also persist for a period of more than transitory duration. We have not previously considered what is required for a copy to persist for more than a transitory period. In MAI , the duration requirement was not disputed, but it seems likely to have been met because the copy at issue remained fixed for a period long enough for a human technician "to view the system error log and diagnose the problem with the computer." Id. ; accord, e.g. , Perfect 10, Inc. v. Amazon.com, Inc. , 508 F.3d 1146, 1160 (9th Cir. 2007) (thumbnail versions of copyrighted images were stored long enough to repeatedly "communicate copies of those thumbnails to [the defendant's] users"); Triad Sys. Corp. v. Southeastern Express Co. , 64 F.3d 1330, 1333 (9th Cir. 1995) (copy of operating system remained in memory while computer was "in use" by a human technician). We agree with the Second Circuit's characterization of our decisions: MAI and the cases following it establish only that "loading a program into a computer's [memory] can result in copying that program," not that "loading a program into a form of [memory] always results in copying." Cartoon Network , 536 F.3d at 128 ; accord CoStar Grp., Inc. v. LoopNet, Inc. , 373 F.3d 544, 551 (4th Cir. 2004).

Of course, embodiments in a computer's memory may perform some useful function despite being transitory. Cartoon Network , 536 F.3d at 130 ; CoStar , 373 F.3d at 551. Here, for example, the embodiment would allow the DMS to process the request of the dealer or authorized integrator using it. But the Copyright Act does not provide copyright owners the exclusive right to use their works. See 17 U.S.C. § 106. Such a right "can only be secured, if it can be secured at all, by letters-patent." Baker v. Selden , 101 U.S. 99, 105, 25 L.Ed. 841 (1879) ; accord Google LLC v. Oracle Am., Inc. , ––– U.S. ––––, 141 S. Ct. 1183, 1196, 209 L.Ed.2d 311 (2021) ("[U]nlike patents, which protect novel and useful ideas, copyrights protect ‘expression’ but not the ‘ideas’ that lie behind it.").

CDK has presented no evidence that the Dealer Law will require the embodiments of its DMS to persist for a period of more than transitory duration. Because this is a facial challenge, it is CDK's burden to show that every possible application of the law would conflict with the Copyright Act. CDK has not established a likelihood of success on the merits of that claim.

B

CDK next argues that the Dealer Law conflicts with the Copyright Act because it requires CDK to create APIs that will be used by authorized integrators. Because an authorized integrator must "copy" the API's specified command names in order to communicate with the DMS, CDK argues that the Dealer Law vitiates its exclusive rights in the API.

As an initial matter, we note that the Dealer Law does not require a provider to use an API; a provider may instead use "a similar open access integration method" if "the [APIs] are not the reasonable commercial or technical standard for secure data integration." Ariz. Rev. Stat. Ann. § 28-4654(A)(2). And if a provider chooses to use an API, it need not develop its own organizational scheme or set of commands. Instead, as the district court noted, it could implement an industry-standard interface. In either case, the provider would not have created any original expression, so there would be no prospect of infringing any copyright.

Even if a provider does create an API, it is not clear that the API would be subject to copyright protection. See Google , 141 S. Ct. at 1202. Nevertheless, because the argument fails either way, we will assume, without deciding, that at least some of the code defining a provider's API would be subject to copyright protection.

We base our analysis on the Supreme Court's decision in Google . In that case, Google was accused of infringing Oracle's copyright in Java SE, a computer platform that allowed developers to use the widely employed Java programming language to develop programs that could run on any computer, regardless of the underlying hardware. Google , 141 S. Ct. at 1190. The Court explained that the Java API comprised "a vast library of prewritten code to carry out complex tasks" that programmers confront in the course of software development. Id. at 1191. Programmers could call upon those prewritten building blocks to save time in writing programs. Id. Google sought to create its own development platform for smartphones, and in doing so, it copied some code from Java's APIs so that programmers who were familiar with Java would be able to work with its new platform. Id.

The Court divided the relevant code into three categories: implementing code, method calls, and declaring code. Google , 141 S. Ct. at 1191–92. Implementing code is the prewritten code provided in the Java API that "tells the computer how to execute the particular task you have asked it to perform." Id. at 1191. It makes up the vast majority of the code in an API. See id. at 1204–05. Method calls are the commands that individual programmers using the Java API type into their own programs that "tell the computer which of the implementing code programs it should choose" to run, that is, "which task it should carry out." Id. at 1191–92. Finally, declaring code "provides both the name for each task and the location of each task within the API's overall organizational system." Id. at 1192. It is the part of the API that recognizes the method calls written by a programmer and links them with the corresponding implementing code to carry out the task the programmer has requested. Id.

Because Google wrote all of its own implementing code, that code was not in dispute. Google , 141 S. Ct. at 1201. Similarly undisputed were the method calls: Oracle did not argue that the mere use by programmers of method calls in their own programs would violate any copyright. Id. Instead, the case turned on whether Google's reuse of the same declaring code contained in the Java API constituted copyright infringement. Id. Assuming that that code was copyrightable, see id. at 1197, the Court held that because "Google reimplemented a user interface, taking only what was needed to allow users to put their accrued talents to work in a new and transformative program, Google's copying of the ... Java API was a fair use of that material as a matter of law." Id. at 1209.

CDK argues that the Dealer Law frees dealers’ authorized integrators to copy its API's declaring code; in CDK's view, the integrators are therefore analogous to Google. Setting aside that the Supreme Court ultimately ruled in favor of Google on the basis of fair use, the analogy is inapt. As the district court found, authorized integrators need not copy any of the API's declaring and implementing code. They have no need to do so—unlike Google, authorized integrators are not attempting to replicate DMS providers’ APIs to create their own complementary platforms. All an authorized integrator needs to write is an API request, which is analogous to a method call. Thus, authorized integrators are analogous not to Google, but to the individual programmers in Google who used the Java API. As the Supreme Court noted, Oracle did not even attempt to argue that the mere use of an API by programmers writing method calls would infringe its copyrights—and for good reason. Google , 141 S. Ct. at 1201. Programmers writing method calls do not engage in verbatim copying of API source code. CDK cannot show that the use of its API would necessarily infringe any copyright it might hold.

C

Finally, CDK argues that the Dealer Law conflicts with the Copyright Act because, it says, the law gives dealers and authorized integrators the right to copy and distribute its copyrighted data compilations. But although the Dealer Law bars DMS providers from limiting access to "protected dealer data," Ariz. Rev. Stat. Ann. § 28-4653(A)(3), it nowhere requires or permits the copying of any copyrighted data compilations.

Significantly, providers do not hold a copyright in the data itself, which consists of facts about dealers’ customers and business operations. Ariz. Rev. Stat. Ann. § 28-4651(7). Copyright protects expression, not facts. Feist Publ'ns, Inc. v. Rural Tel. Serv. Co. , 499 U.S. 340, 344–45, 111 S.Ct. 1282, 113 L.Ed.2d 358 (1991) ; Experian Info. Sols., Inc. v. Nationwide Mktg. Servs., Inc. , 893 F.3d 1176, 1181–86 (9th Cir. 2018). To be sure, an arrangement of facts can enjoy copyright protection, but only if the arrangement displays some creativity; an obvious arrangement, such as using alphabetical order for a listing of names in the phone book, does not qualify. Feist , 499 U.S. at 362–64, 111 S.Ct. 1282. And even if an arrangement is creative, so that it is entitled to some measure of copyright protection, that protection "is severely limited"—infringement requires " ‘unauthorized use of substantially the entire item,’ " not merely a part of it. Experian , 893 F.3d at 1186 (quoting Harper House, Inc. v. Thomas Nelson, Inc. , 889 F.2d 197, 205 (9th Cir. 1989) ).

For that reason, dealers and authorized integrators would not infringe a DMS provider's copyright by making copies of the raw data in DMS databases, or even by copying subsets of that data arranged in particular ways by the provider. To infringe a copyright, they would, at a minimum, have to copy substantially all of a database that the provider had structured in some creative way. CDK has not shown that such an application of the Dealer Law is likely, let alone inevitable, and in the context of a facial challenge, that failure of proof is fatal to its preemption claim.

IV

We now turn to CDK's constitutional claims, beginning with its argument that the Dealer Law violates the Contracts Clause. The Contracts Clause provides that "[n]o State shall ... pass any ... Law impairing the Obligation of Contracts." U.S. Const. art. I, § 10, cl. 1. A state law violates the clause if it (1) "operate[s] as a substantial impairment of a contractual relationship," and (2) is not "drawn in an appropriate and reasonable way to advance a significant and legitimate public purpose." Sveen v. Melin , ––– U.S. ––––, 138 S. Ct. 1815, 1821–22, 201 L.Ed.2d 180 (2018) (internal quotation marks and citations omitted); see Apartment Ass'n of L.A. Cnty., Inc. v. City of Los Angeles , 10 F.4th 905, 913 (9th Cir. 2021). CDK advances three different theories of Contracts Clause violations. We conclude that none is likely to succeed.

First, CDK argues that the Dealer Law impairs various contracts that it has with third-party vendors. The district court declined to address that claim because CDK did not raise it in its complaint or in its motion for a preliminary injunction but instead mentioned it for the first time at the preliminary-injunction hearing. CDK responds that it attached the third-party contracts as exhibits to the preliminary-injunction motion, but that is not enough to preserve the claim. See Smith v. Marsh , 194 F.3d 1045, 1052 n.5 (9th Cir. 1999). We agree with the district court that the claim was forfeited.

Second, CDK argues that the Dealer Law impairs its ability to discharge its contractual duty to keep dealer data confidential. To establish a substantial impairment of a contractual relationship, a party must show, at a minimum, that a law effects an "alteration of contractual obligations"—in other words, that it alters the rights or duties created by a contract. Allied Structural Steel Co. v. Spannaus , 438 U.S. 234, 245, 98 S.Ct. 2716, 57 L.Ed.2d 727 (1978). Even under CDK's view, the Dealer Law does not do that. At most, it makes it more difficult for CDK to perform its contracts, which continue to exist unmodified. But legislation routinely affects a party's cost of performing contracts. Imagine an owner of a factory who has a long-term contract to sell the goods it produces. If new environmental regulations make it more expensive to operate the factory, that does not raise an issue under the Contracts Clause even though it might make it more difficult for the owner to perform. As Justice Holmes put it, "[o]ne whose rights, such as they are, are subject to state restriction, cannot remove them from the power of the State by making a contract about them." Hudson Cnty. Water Co. v. McCarter , 209 U.S. 349, 357, 28 S.Ct. 529, 52 L.Ed. 828 (1908). That principle controls here.

In any event, CDK has not shown even that the statute impairs its ability to perform its contracts. The statute allows DMS providers to impose reasonable limitations on access and to restrict access to third parties who comply with industry security standards. Ariz. Rev. Stat. Ann. §§ 28-4653(A)(3)(b), 28-4654(A)(1). Based on those provisions, the district court found that CDK "could still fulfill [its] data-security obligations while complying with the statute's mandate." We see no clear error in that finding.

Third, CDK argues that the statute will impair its agreements with dealers because those agreements specify that dealers may not allow any third-party software to access the DMS. Assuming, without deciding, that the Dealer Law substantially impairs contractual third-party access restrictions, it still does not violate the Contracts Clause because it is reasonably drawn to serve an important public purpose.

Where, as here, a State is not a party to a contract, "courts properly defer to legislative judgment as to the necessity and reasonableness of a particular measure." Apartment Ass'n of L.A. , 10 F.4th at 913 (quoting Energy Rsrvs. Grp., Inc. v. Kansas Power & Light Co. , 459 U.S. 400, 413, 103 S.Ct. 697, 74 L.Ed.2d 569 (1983) ); accord Seltzer v. Cochrane (In re Seltzer) , 104 F.3d 234, 236 (9th Cir. 1996). CDK bears the burden of proving that the Dealer Law "does not serve a valid public purpose" or that it is not drawn in a reasonable and appropriate way. Seltzer , 104 F.3d at 236. CDK has not carried that burden.

Promoting consumer data privacy and competition plainly qualify as legitimate public purposes. See Energy Rsrvs. , 459 U.S. at 411–12, 417, 103 S.Ct. 697. CDK points out that the Arizona Legislature did not make findings specifying that those were the purposes motivating the enactment of the statute, but it was not required to do so. The purposes are apparent on the face of the law. The Dealer Law contains multiple provisions that further consumer data privacy. See, e.g. , Ariz. Rev. Stat. Ann. §§ 28-4653(A)(1), (D), 28-4654(B), 28-4655(2). Others address potential anticompetitive business practices. See, e.g. , id. §§ 28-4652, 28-4653(A)(3), (B), (E), 28-4654(A). That is sufficient to show a public purpose.

CDK asserts that the law unfairly targets its business, but its discussion of the legislative history of the statute falls far short of establishing that the State's "political process had broken down." Energy Rsrvs. Grp. , 459 U.S. at 417 n.25, 103 S.Ct. 697. And nothing in the statute itself supports CDK's assertion. The law applies to all DMS providers that store protected dealer data, "regardless of whether they happen[ ] to be parties to ... contracts that contain[ ] a provision" affected by the law. Exxon Corp. v. Eagerton , 462 U.S. 176, 191, 103 S.Ct. 2296, 76 L.Ed.2d 497 (1983). The Contracts Clause does not disable a State from enacting such "a generally applicable rule of conduct designed to advance ‘a broad societal interest.’ " Id. (quoting Allied Structural Steel Co. , 438 U.S. at 249, 98 S.Ct. 2716 ). Although the statute regulates the dealer data industry rather than some broader segment of the economy, that does not make it suspect. CDK's own witnesses explained that DMSs store highly sensitive data like social-security numbers and consumer credit applications, and that DMS providers are attractive targets for hackers, on a par with major financial institutions. It is therefore unsurprising that the Arizona Legislature would be particularly interested in regulating the industry to safeguard Arizonans’ privacy. Likewise, the State could reasonably determine that anticompetitive practices were of particular concern in that industry and decide to focus its efforts at reform there. Several other States have enacted similar legislation, further undermining the suggestion that the Arizona Legislature acted with an improper purpose. See, e.g. , Act of July 19, 2019, SL 2019-125, 2019 N.C. Sess. Laws 569; Act of June 25, 2019, ch. 500, 2019 Or. Laws 1508; Act of May 3, 2019, ch. 283, 2019 Mont. Laws 1004. Cf. Seltzer , 104 F.3d at 236.

The law advances its purposes in a reasonable way. The record shows that contractual restrictions on third-party access to DMSs have led many dealers to download their data in plain text and email it in an unsecured format to their application providers. By ensuring that third-party providers have direct access to dealer data through a secure API, the Dealer Law eliminates the incentive for dealers to resort to unsecured email transfers. Ariz. Rev. Stat. Ann. § 28-4653(A)(3). At the same time, as the district court explained, the law advances its pro-competitive purpose by prohibiting a provider "from monopolizing data that is not its own to its great financial advantage."

CDK objects that the law does not promote privacy because, it says, requiring it to give access to integrators will weaken data security. But the law requires DMS providers to give access only to those authorized integrators that comply with industry security standards. Ariz. Rev. Stat. Ann. §§ 28-4653(A)(3)(b), 28-4654(A)(1). It also permits DMS providers to place reasonable restrictions on such access, id. § 28-4653(A)(3)(b), including restrictions to ensure that third parties access only the data necessary to "carry out the specified function" for which they were granted access, id. § 28-4651(1). CDK may disagree with the State's policy choice, but that does not mean that the law violates the Constitution.

V

Finally, CDK argues that the law takes property without compensation, in violation of the Takings Clause. See U.S. Const. amend. V ; Chicago, B. & Q.R. Co. v. City of Chicago , 166 U.S. 226, 247, 17 S.Ct. 581, 41 L.Ed. 979 (1897) (applying the Takings Clause to States through the Fourteenth Amendment). We disagree.

The Supreme Court has recognized two kinds of claims under the Takings Clause. When the government carries out "a physical appropriation of property, a per se taking has occurred." Cedar Point Nursery v. Hassid , ––– U.S. ––––, 141 S. Ct. 2063, 2072, 210 L.Ed.2d 369 (2021). But when the government "has instead restricted a property owner's ability to use his own property," id. , a court must evaluate the action under the three-factor test announced in Penn Central Transportation Co. v. City of New York , 438 U.S. 104, 98 S.Ct. 2646, 57 L.Ed.2d 631 (1978), to determine whether it constitutes a "regulatory taking."

CDK argues that the Dealer Law effects a per se physical taking because, as CDK describes it, the law requires DMS providers to allow authorized integrators "to enter, use, and occupy" their DMSs. CDK relies on Loretto v. Teleprompter Manhattan CATV Corp. , 458 U.S. 419, 102 S.Ct. 3164, 73 L.Ed.2d 868 (1982), which involved a New York statute requiring the owner of a building to allow cable television facilities to be installed there, id. at 422–24, 102 S.Ct. 3164. Although the invasion was "minor," the Court held that because it was a "permanent physical occupation" of part of the building, it constituted a per se taking. Id. at 421, 102 S.Ct. 3164. But the analogy between Loretto and this case is misplaced for two reasons.

First, the district court found that authorized integrators merely exchange messages with DMS providers’ systems and do not physically invade the systems at all. CDK objects that indirect access to their systems via an API is still a form of access, but for purposes of a per se takings analysis, the lack of any physical invasion is dispositive. Regulations commonly require regulated entities to disclose certain information. This could be described as a requirement to allow "access," but no one conceives of such requirements as physical takings. To be sure, there can be property interests in information, and those interests are protected by the Takings Clause. Ruckelshaus v. Monsanto Co. , 467 U.S. 986, 1003–04, 104 S.Ct. 2862, 81 L.Ed.2d 815 (1984). But CDK does not argue that such property interests—trade secrets, for example—are subject to a taking here.

Second, "[t]he government effects a physical taking only where it requires the [property owner] to submit to the physical occupation of his [property]." Yee v. City of Escondido , 503 U.S. 519, 527, 112 S.Ct. 1522, 118 L.Ed.2d 153 (1992). Although CDK objects that the Dealer Law permits authorized integrators to write data to a DMS on a dealer's behalf, CDK voluntarily licenses its DMS to dealers, and nothing in the Dealer Law compels it to continue doing so. In particular, the law does not limit DMS providers’ ability to terminate contracts with dealers. See id. at 528, 112 S.Ct. 1522 (explaining that landlords’ ability to evict tenants "with 6 or 12 months notice" undermined any notion of compulsion). It is no answer that CDK may not wish to open its DMS to any particular authorized integrator. Once property owners "voluntarily open their property to occupation by others," they "cannot assert a per se right to compensation based on their inability to exclude particular individuals." Id. at 530, 112 S.Ct. 1522 ; PruneYard Shopping Ctr. v. Robins , 447 U.S. 74, 82–84, 100 S.Ct. 2035, 64 L.Ed.2d 741 (1980) ; Heart of Atlanta Motel, Inc. v. United States , 379 U.S. 241, 261, 85 S.Ct. 348, 13 L.Ed.2d 258 (1964) ; see also Cedar Point Nursery , 141 S. Ct. at 2076–77 (reaffirming PruneYard ).

That leaves the argument that the statute constitutes a regulatory taking. Determining whether a regulatory taking has occurred entails an "ad hoc, factual inquir[y]" into (1) "[t]he economic impact of the regulation on the [property owner]," (2) "the extent to which the regulation has interfered with distinct investment-backed expectations," and (3) "the character of the governmental action." Penn Central , 438 U.S. at 124, 98 S.Ct. 2646. We agree with the district court that CDK is unlikely to succeed on its regulatory takings claim.

First, we discern no clear error in the district court's finding that the economic impact of the Dealer Law is "minimal." The district court noted that the cost of building an API is "very small in comparison to building a DMS" and that DMS providers are entitled to recoup their "direct costs incurred ... in providing dealer data access to an authorized integrator." Ariz. Rev. Stat. Ann. §§ 28-4651(5), 28-4653(A)(3)(a) ; see City of Portland v. United States , 969 F.3d 1020, 1049 (9th Cir. 2020) (A regulation that "allows for the recovery of actual costs ... does not constitute a regulatory taking.").

Second, the Dealer Law does not impermissibly interfere with distinct investment-backed expectations. As a general matter, "in the case of personal property, by reason of the State's traditionally high degree of control over commercial dealings, [a property owner] ought to be aware of the possibility that new regulation might even render his property economically worthless." Lucas v. South Carolina Coastal Council , 505 U.S. 1003, 1027–28, 112 S.Ct. 2886, 120 L.Ed.2d 798 (1992) ; see Horne v. Department of Agric. , 576 U.S. 350, 361, 135 S.Ct. 2419, 192 L.Ed.2d 388 (2015). And as the district court found, there was never any "customary practice of charging authorized third-party integrators significant fees to access a dealer's protected data."

Third, the character of the law is more akin to an "interference aris[ing] from some public program adjusting the benefits and burdens of economic life to promote the common good" than "a physical invasion by government." Penn Central , 438 U.S. at 124, 98 S.Ct. 2646. CDK argues that the statute does not serve public purposes, but that is not "an independent means to challenge an alleged regulatory taking." Rancho de Calistoga v. City of Calistoga , 800 F.3d 1083, 1092 (9th Cir. 2015). In any event, the Dealer Law applies to all DMS providers, not just CDK, see Ariz. Rev. Stat. Ann. § 28-4651(4), and as we discussed in the context of the Contracts Clause claim, we see no basis to question the judgment of the Arizona Legislature that the statute promotes the common good through the advancement of consumer privacy and competition. See Penn Central , 438 U.S. at 134–35, 98 S.Ct. 2646.

AFFIRMED.