What Is KOSA? The Kids Online Safety Act’s Duty of Care and Enforcement

The Kids Online Safety Act, known as KOSA, is a bipartisan federal bill that would require online platforms to take active steps to protect users under 17 from specific harms, addictive design features, and manipulative interfaces. It has not become law. The Senate passed a version 91-3 in July 2024, the House never voted, and Senators Blackburn, Blumenthal, Thune, and Schumer reintroduced the bill as S.1748 on May 14, 2025, with new language clarifying that it does not authorize lawsuits over content or speech.¹

Where the Bill Stands Right Now

KOSA is not yet law. After the Senate approved it in July 2024, House Speaker Mike Johnson declined to bring the bill to a floor vote, citing concerns about potential free speech impacts.² When the 118th Congress ended without House action, the bill expired.

The 2025 reintroduction as S.1748 uses the same core language the Senate approved, plus additional wording the sponsors said would “further make clear that KOSA would not censor, limit, or remove any content from the internet, and it does not give the FTC or state Attorneys General the power to bring lawsuits over content or speech.”¹ The bill still needs to pass both chambers and be signed by the president before any of its requirements take effect.

Which Platforms Would Have to Comply

KOSA applies to “covered platforms,” which the bill defines as any online platform, online video game, messaging application, or video streaming service that connects to the internet and is used, or reasonably likely to be used, by a minor.³ The focus is on commercial services that host user-generated content or provide community interaction spaces, particularly social media networks.

Several categories fall outside the bill. Nonprofit organizations and educational institutions are not covered.⁴ Traditional telecommunications services are excluded. Video streaming services made up primarily of preselected programming are exempt, though they lose that exemption if they host user-generated content. Blogs and personal websites are not covered.

The Duty of Care at the Center of the Bill

KOSA’s central legal obligation is a “duty of care” requiring covered platforms to exercise reasonable care in the design and implementation of their services to prevent and mitigate specific harms to minors. The duty targets platform design choices rather than individual pieces of content, and it applies to features like recommendation algorithms and addictive product features that a platform knows are causing harm.⁴

The bill defines a specific, closed list of covered harms rather than leaving the concept open-ended:

Promotion of mental health harms such as suicide, eating disorders, and substance use disorders
Sexual exploitation as defined by federal criminal law
Patterns of use that indicate or encourage addiction-like behaviors
Marketing of illicit drugs, tobacco, alcohol, and gambling to minors

That specificity is the point. If a platform’s recommendation algorithm is steering a teenager toward eating disorder content and the platform knows this, the FTC could act under the duty of care. General content that someone finds objectionable is not covered.⁴

Default Settings, Minor Controls, and Parental Tools

KOSA also spells out specific design requirements. The core rule is that safety and privacy settings for minors must default to the most protective level, including restrictions on geolocation sharing.² Young users would not have to hunt through settings menus to protect themselves; the safest configuration is the starting point.

Minors would get tools to shape their own experience. They could turn off infinite scrolling and autoplay, opt out of personalized recommendations altogether, or limit the categories of content the algorithm suggests.

Parents and guardians would receive a separate set of controls: the ability to restrict purchases, limit usage time, view and modify privacy settings, and report harmful behavior directed at their child.⁴

A Ban on Manipulative Design

The bill also prohibits “dark patterns,” interface tricks that mislead or confuse users into weakening their own privacy or safety settings.⁵ The practical effect is that the controls KOSA requires must be presented in a straightforward way, and platforms cannot design the flow so that minors or parents are nudged into giving up protections.

What KOSA Does Not Require: Age Verification

A common misconception is that KOSA would force platforms to verify every user’s age through government IDs. It would not. The bill explicitly states that it does not impose age verification requirements and does not require platforms to collect additional data from users to determine their age.⁴

KOSA’s obligations kick in only when a platform already knows a user is a minor, such as from a date of birth given at signup. If a platform genuinely does not know a user’s age, it has no obligation under the bill to provide the required protections or to gather more data to find out. The sponsors designed it this way to avoid building a new surveillance system inside a bill meant to protect privacy.

Transparency and Independent Audits

Covered platforms would have to disclose clear information about their safeguards, tailored to the ages and developmental needs of minors, and explain how their personalized recommendation systems use personal data along with how minors and parents can opt out.

Larger services face extra scrutiny. Platforms with more than 10 million active monthly users would have to publish reports based on independent third-party audits, covering usage metrics, the steps taken to reduce identified risks, and how the features minors interact with are designed.

How KOSA Would Be Enforced

The FTC is KOSA’s primary enforcer. A violation would be treated as an unfair or deceptive act under Section 5 of the FTC Act, giving the commission authority to seek civil penalties. The bill directs the FTC to issue guidance within 18 months of enactment explaining how it will determine whether a platform has knowledge that a specific user is a minor.⁴

State attorneys general can also bring civil actions for violations of the bill’s safeguards, disclosure requirements, and transparency provisions. The 2025 reintroduction clarified that neither the FTC nor state attorneys general can bring lawsuits over content or speech itself, a direct response to earlier criticism that officials might use the law to police speech based on political preferences.¹

The Free Speech Debate

The most persistent criticism comes from civil liberties groups who argue KOSA could still lead to broad content suppression. The concern is that if platforms face legal liability when harmful content reaches minors, they will over-filter and remove constitutionally protected speech to avoid enforcement risk, effectively making tech companies censors of lawful content.

Supporters counter that KOSA targets how platforms deliver content, not what content exists, and that the 2025 version’s explicit bar on content-based enforcement actions addresses the censorship concern. The debate is unresolved and will likely shape any court challenges if KOSA becomes law.

KOSA, COPPA 2.0, and State Laws

KOSA is often discussed alongside the Children and Teens’ Online Privacy Protection Act, known as COPPA 2.0. The Senate packaged the two together as the Kids Online Safety and Privacy Act for its July 2024 vote.² The bills do different work. COPPA 2.0 updates the existing children’s privacy law, extending its protections to teenagers (the original COPPA covers only children under 13) and restricting targeted advertising to minors. KOSA focuses on platform design, the duty of care, and transparency. They are complementary, and both would need to pass for the full framework to take effect.

Several states have not waited. California, New York, Virginia, Maryland, and others have already passed age-appropriate design codes and online safety laws for minors, creating a patchwork of requirements. Whether KOSA would preempt those state laws is unresolved: the Senate version does not include preemption language, so state laws would remain in force alongside the federal rules, but some House proposals have pushed for federal preemption that could displace state protections.

1
U.S. Senator Marsha Blackburn. Blackburn, Blumenthal, Thune, and Schumer Introduce the Kids Online Safety Act
2
U.S. Senate Committee on Commerce, Science, & Transportation. Senate Overwhelmingly Passes Children’s Online Privacy Legislation
3
Congress.gov. Text – S.1748 – 119th Congress (2025-2026): Kids Online Safety Act
4
U.S. Senator Richard Blumenthal. What Is the Kids Online Safety Act (KOSA)?
5
Congressman Gus M. Bilirakis. Bilirakis, Castor, Houchin, and Schrier Introduce Comprehensive Bill to Better Protect Children and Teens Online