The Kids Online Safety Act, known as KOSA, is a federal bill that would require social media platforms, video games, messaging apps, and streaming services to build in safety protections for users under 17. It has not been signed into law. Senators Marsha Blackburn and Richard Blumenthal reintroduced the bill as S.1748 on May 14, 2025, and it was referred to the Senate Committee on Commerce, Science, and Transportation.1Congress.gov. S.1748 – Kids Online Safety Act 119th Congress (2025-2026) Until Congress passes it and the president signs it, none of the requirements below are enforceable.
Where the Bill Stands
KOSA passed the Senate with broad bipartisan support during the 118th Congress but never received a House vote before the session ended. The reintroduced version, S.1748, remains in committee and has not been voted on by either chamber. Everything described in the sections that follow reflects what the bill would do if enacted, not current law.
Who and What the Bill Would Cover
KOSA defines a “covered platform” as any online platform, online video game, messaging application, or video streaming service that connects to the internet and is used, or reasonably likely to be used, by a minor.2Congress.gov. Text – S.1748 – 119th Congress (2025-2026) Kids Online Safety Act That reach is intentionally broad and would cover the major social networks, video-sharing apps, multiplayer games, and subscription streaming services most families already use.
A “minor” means anyone under 17. The bill distinguishes between children (under 13) and teens (13 through 16), with stronger default protections for the younger group.
Services That Would Not Be Covered
Several categories of service are carved out of the definition even when minors use them:
- Broadband providers, common carriers, and standard wireless text-messaging services not tied to a social platform.
- Email and video-conferencing services where users join through a unique link rather than a social feed.
- Nonprofit organizations.
- Public and private schools at every level, preschools, higher education institutions, and libraries.
- News and sports sites whose video content relates to their own reporting and that do not otherwise function as social platforms.
- Products that primarily function as business-to-business tools.
The Duty of Care
The heart of KOSA is a duty of care requiring covered platforms to exercise reasonable care in designing and running their services to prevent and mitigate foreseeable harms to minors. The standard applies where a reasonable person would agree the harm was foreseeable and that a design feature contributed to it. The bill lists seven categories of harm:
- Mental health harms including eating disorders, substance use disorders, and suicidal behaviors.
- Clinically diagnosable depression and anxiety disorders tied to compulsive platform use.
- Usage patterns that indicate compulsive behavior.
- Physical violence and online harassment so severe or pervasive that it disrupts a major life activity.
- Sexual exploitation and abuse of minors.
- Distribution, sale, or use of narcotics, tobacco, cannabis, gambling, or alcohol.
- Unfair or deceptive practices causing financial injury.
The obligation runs to the platform’s design choices — its recommendation engine, notification system, and feed structure — rather than requiring families to police the service themselves.2Congress.gov. Text – S.1748 – 119th Congress (2025-2026) Kids Online Safety Act
Default Safety Settings and Design Controls
Covered platforms would have to ship with the strongest available privacy and safety settings turned on by default for any account the platform knows belongs to a minor. Teens could still choose less restrictive options, but they would start from the most protective configuration.
Platforms would also have to give minors tools to limit design features that push users toward more time or activity on the service. The bill specifically names infinite scrolling, auto-play, time-based rewards, push notifications, personalized recommendation systems, in-game purchases, and appearance-altering filters.
Algorithm Opt-Out
Platforms that use algorithms to select, order, or prioritize content based on user-specific data would have to notify users and offer an alternative feed that does not rely on that personal data.1Congress.gov. S.1748 – Kids Online Safety Act 119th Congress (2025-2026) A teenager could switch to a chronological or non-personalized feed instead of one built around engagement signals.
Dark Patterns
Platforms could not use manipulative interface tricks to undermine user choices around safeguards and parental controls. That means no burying opt-outs behind repeated confirmation screens and no guilt-tripping copy designed to discourage a teen from turning on time limits. The prohibition is tied to safety features specifically rather than to the entire interface.
Parental Tools
Covered platforms would have to provide accessible tools for parents to supervise a minor’s account. Those tools must include:
- The ability to view privacy and account settings, and for children under 13, to change and control those settings directly.
- The ability to restrict purchases and financial transactions.
- The ability to view total time-spent metrics and set time limits.
For children under 13, these controls must be on by default. For teens aged 13 through 16, platforms must offer the tools but let families decide whether to activate them. Platforms would also have to notify a minor when parental tools are active and what settings apply, so a teen would know their parent can see time-spent data rather than finding out later.3U.S. Senator Richard Blumenthal. Kids Online Safety Act
Advertising Restrictions
KOSA would ban platforms from facilitating advertising of narcotics, cannabis products, tobacco, gambling, or alcohol to any user the platform knows is a minor. On-demand video streaming services would face the same restriction and would have to prevent those ads from being served to known minor accounts.
Beyond the restricted-product ban, all ads shown to minors would have to carry clear labels identifying the product or brand, the subject matter of the ad, and whether content displayed to the minor is paid advertising or a commercial endorsement by another user. The FTC could issue guidance on minimum standards for those disclosures.2Congress.gov. Text – S.1748 – 119th Congress (2025-2026) Kids Online Safety Act
A companion bill often packaged with KOSA, the Children and Teens’ Online Privacy Protection Act (sometimes called COPPA 2.0), goes further by banning targeted advertising to users under 17 altogether.4U.S. Senate Committee on Commerce, Science, and Transportation. Senate Overwhelmingly Passes Childrens Online Privacy Legislation KOSA itself stops at the algorithm opt-out and the restricted-product ad rules.
Transparency Reports and Research Limits
Platforms with more than 10 million monthly active U.S. users that primarily function as community forums for user-generated content would have to publish annual public reports based on independent, third-party audits. The auditor must get full access to the platform’s internal systems, data, and relevant materials, and platforms cannot withhold information or misrepresent facts during the process.
The bill also prohibits covered platforms from conducting market or product research on children under 13. Research involving teens under 17 would require parental consent.
Enforcement and Penalties
The FTC would be the primary enforcer. Violations would be treated the same as violations of an FTC rule against unfair or deceptive practices, giving the agency its investigative powers, cease-and-desist authority, and the ability to seek civil penalties. As of January 2025, the maximum civil penalty for a knowing violation of an FTC rule is $53,088 per violation.5Federal Register. Adjustments to Civil Penalty Amounts Because each affected user could count as a separate violation, fines against a major platform could scale into the hundreds of millions.
State attorneys general could also bring civil actions on behalf of their residents for violations of the safeguard, parental-tool, and advertising-label provisions, seeking injunctions, damages, restitution, or other compensation. A platform could face action from the FTC and individual states at the same time.
KOSA does not create a private right of action. Individual families could not sue a platform directly under the law; enforcement runs through government agencies only.
Timeline If Enacted
Most requirements would take effect 18 months after enactment. The algorithm-transparency provisions in Title II have a shorter runway of one year.
How KOSA Relates to COPPA
The existing Children’s Online Privacy Protection Act, enacted in 1998, protects children under 13 by requiring verifiable parental consent before websites collect personal information. KOSA does not replace COPPA. The bill explicitly states that nothing in it preempts COPPA or its regulations. The two laws would work in parallel, with KOSA extending protections to users under 17 and focusing on platform design and safety rather than just data collection. A platform already obtaining parental consent under COPPA would be treated as having met certain KOSA notice requirements as well.
Free Speech Concerns
Civil liberties organizations have argued the duty of care could pressure platforms into censoring lawful speech. Because the bill enumerates topics like eating disorders, substance use, and bullying, critics worry platforms will over-remove content touching those subjects to avoid FTC liability. A support group for teens recovering from an eating disorder, for example, could get swept up alongside content that actually promotes disordered eating.
The bill includes a rule of construction stating that nothing in the duty of care requires a platform to prevent minors from independently searching for content or to block evidence-based health resources. Opponents argue this carve-out is too narrow to prevent real-world over-censorship, and that platforms facing penalties in the tens of millions will err on the side of removing borderline content.
Supporters counter that KOSA targets design features and algorithmic amplification rather than individual posts. A platform would not need to delete a forum about depression; it would need to stop its recommendation algorithm from funneling a 15-year-old into an endless loop of increasingly extreme content on the topic. Whether courts would accept that distinction under First Amendment scrutiny remains one of the bill’s biggest open legal questions.