By Lauren Feiner
The Senate passed the Kids Online Safety Act (KOSA) and the Children and Teens’ Online Privacy Protection Act (also known as COPPA 2.0), the first major internet bills meant to protect children to reach that milestone in two decades. A legislative vehicle that included both KOSA and COPPA 2.0 passed 91–3.
Senate Majority Leader Chuck Schumer (D-NY) called it “a momentous day” in a speech ahead of the vote, saying that “the Senate keeps its promise to every parent who’s lost a child because of the risks of social media.” He called for the House to pass the bills “as soon as they can.”
KOSA is a landmark piece of legislation that a persistent group of parent advocates played a key role in pushing forward — meeting with lawmakers, showing up at hearings with tech CEOs, and bringing along photos of their children, who, in many cases, died by suicide after experiencing cyberbullying or other harms from social media. These parents say that a bill like KOSA could have saved their own children from suffering and hope it will do the same for other children.
The bill works by creating a duty of care for online platforms that are used by minors, requiring they take “reasonable” measures in how they design their products to mitigate a list of harms, including online bullying, sexual exploitation, drug promotion, and eating disorders. It specifies that the bill doesn’t prevent platforms from letting minors search for any specific content or providing resources to mitigate any of the listed harms, “including evidence-informed information and clinical resources.”
Parent advocates believe this legal duty of care will protect children, but digital rights, free speech, and some LGBTQ+ advocates believe the bill could actually harm marginalized kids by creating a chilling effect and pressuring platforms to limit free expression on the internet. In a recent letter to senators, groups including the American Civil Liberties Union (ACLU), Electronic Frontier Foundation (EFF), LGBT Tech, and NetChoice wrote that the duty of care could result in “aggressive filtering of content by companies preventing access to important, First Amendment-protected, educational, and even lifesaving content” to avoid liability. They also fear it will lead platforms to impose age verification systems, raising additional privacy and constitutional concerns.
These concerns are not coming out of left field. Lead cosponsor Sen. Marsha Blackburn (R-TN) has previously justified the bill on the basis that we should be “protecting minor children from the transgender in this culture.” Since then, the bill has been amended in response to the concerns of LGBTQ+ advocates, and the revisions were sufficient to get some organizations — like GLAAD and The Trevor Project — to drop their opposition.
In a speech on the Senate floor ahead of Tuesday’s vote, Sen. Richard Blumenthal (D-CT), another of the bill’s lead sponsors, said the law was not aiming to block or censor content: “We’re simply creating an environment that is safe by design. And at its core, this bill is a product design bill.” Blumenthal compared KOSA to other efforts throughout his career to “protect consumers against defective products that are designed to make more money and more profits at the risk or expense of injury to people,” including by targeting cigarettes and car manufacturers.
Blackburn said that while “there are laws that protect children from buying alcohol, buying tobacco, buying pornography,” the same kinds of protections are lacking on the internet. “When you look at the social media platforms, there are no guardrails.”
The duty of care is probably the most controversial, but KOSA contains a host of other provisions. KOSA also requires safeguards for kids on the internet, like preventing unknown adults from communicating with kids or viewing their personal data, restricting the ability to share minors’ geolocation data, and letting the accounts of children opt out of personalized recommendations or at least limit recommendation categories. Platforms would also need to default kids’ accounts to the strictest level of privacy settings and make it easy to delete their personal data and limit the time they spend on the service. The law would also require a handful of parental control tools, allowing parents to view their children’s privacy and account settings, restrict their purchases, and limit how much time they spend.
COPPA 2.0, which builds on a 1998 children’s privacy law by the same name, would raise the age covered by those protections from those under 13 to those under 17. It would also ban targeted advertising to kids covered by the bill. Sen. Ed Markey (D-MA), the lead sponsor of the new bill, was also the lead sponsor of the original COPPA. Markey said in a speech on the Senate floor that covering kids under 13 was “all I could get” in 1998. Markey said the original law “has done a lot of good, but as the years have passed, and technology has evolved, our online world once again, started to look like the Wild West.”
The three senators who voted no — Ron Wyden (D-OR), Rand Paul (R-KY), and Mike Lee (R-UT) — said they had concerns that KOSA could potentially be used to censor information. Wyden wrote in a thread on X that while changes to the bill have made it “less likely that the bill can be used as a tool for MAGA extremists to wage war on legal and essential information to teens,” he still worries it “could be used to sue services that offer privacy technologies like encryption or anonymity features that kids rely on to communicate securely and privately without being spied on by predators online.” Paul called it a “Pandora’s box of unintended consequences.”
While Wyden fears the bill could be used by a future administration to pressure companies to censor transgender health information, Lee seems to fear it will allow kids to see it. Lee wrote that KOSA would outsource mental health definitions to the American Psychological Association, which he called “an extreme and politically driven organization that supports gender-transition treatment for children.”
It’s actually a slightly different group, the American Psychiatric Association, which publishes the Diagnostic and Statistical Manual of Mental Disorders (DSM), a manual that is widely used to determine mental health diagnoses. The American Psychiatric Association is a professional group of nearly 40,000 people in psychiatric practice and research. KOSA defines “mental health disorder” in relation to the DSM — the statute literally says to reference the latest version of the DSM. The current manual defines gender dysphoria as a diagnosis. The APA also says that “[m]edical affirmation is not recommended for prepubertal children.”
The bills now move to the House, which had about a week left to take them up before the August recess — except that the chamber recently decided to adjourn a week early. Prior to Thursday’s procedural vote, House Speaker Mike Johnson (R-LA) said in a statement to The Verge that he was “looking forward to reviewing the details of the legislation that comes out of the Senate. Parents should have greater control and the necessary tools to protect their kids online. I am committed to working to find consensus in the House.” But it will be harder to pick up momentum after Congress’ break, given the political dynamics of passing substantive policy in the months right before a presidential election.
Should the bills become law, KOSA is still likely to face opposition in the courts. NetChoice, which represents major tech platforms like Google and Meta, has sued to block several other laws throughout the country with similar goals of protecting kids. NetChoice has (in many cases, successfully) argued that such bills pose a risk to free expression that would not withstand First Amendment scrutiny. If challenged, KOSA will also have to contend with a recent Supreme Court ruling, where the majority opinion said that content moderation and curation are protected forms of expression.
