What the kids online safety act would do, who it covers, exactly where the KOSA bill stands in Congress in 2026, and which child safety laws already apply.
The Kids Online Safety Act, usually shortened to KOSA, is a proposed United States federal law that would require online platforms to design their services so that they reduce a defined list of harms to users under 17. It is not law. As of late October 2026 the Senate bill, S. 1748, has cleared the Senate Commerce Committee but has not passed the full Senate. On 30 September Senator Rand Paul blocked an attempt to pass it by unanimous consent before the pre-election recess. The House has passed a separate package, the KIDS Act, containing a version of KOSA with the duty of care removed.
What This Guide Covers
What The Kids Online Safety Act Is
What KOSA Would Require
Who KOSA Would Cover
Timeline And Current Status In 2026
The Case For KOSA
The Case Against KOSA
What Is Actually In Force Today
What KOSA Means For Parents
What KOSA Means For Platforms
What To Watch Next
Frequently Asked Questions
The Short Version
What The Kids Online Safety Act Is
The kids online safety act is a bill, not a statute. It has been introduced in four consecutive sessions of Congress since 2022, has passed the Senate once, and has never been signed into law. Senators Richard Blumenthal of Connecticut and Marsha Blackburn of Tennessee have led it throughout.
Its central idea is a shift in what the law regulates. Existing federal protection online, chiefly the Children’s Online Privacy Protection Act of 1998, regulates data. KOSA regulates product design: whether features such as the recommendation feed, autoplay, infinite scroll or the ability of strangers to message a minor foreseeably contribute to a defined set of harms. Supporters call this a duty of care, borrowed from product safety law. Opponents call it a speech regulation in a product safety costume. That disagreement is why the bill is still not law.
Three proposals are frequently conflated. KOSA is the design bill. COPPA 2.0 would raise the data privacy age threshold from 13 to 16 and ban targeted advertising to minors. App store accountability laws, mostly at state level, push age checks down to Apple and Google. Only the last is operating.
What KOSA Would Require
The requirements below come from the text of S. 1748 as introduced. The House version differs, as set out later.
The Duty Of Care
Section 102 requires a covered platform to exercise reasonable care in the creation and implementation of any design feature to prevent and mitigate harms to minors. The harms are enumerated rather than open ended: anxiety, depression, eating disorders, substance use disorders and suicidal behaviours where linked to compulsive usage; compulsive usage itself; physical violence, bullying and harassment; sexual exploitation and abuse; promotion of drugs, tobacco, gambling and alcohol; and deceptive marketing and financial harms. Two limits apply: the duty attaches to design features rather than content, and it does not require a platform to stop a minor deliberately searching for information.
Safeguards And Default Settings
Section 103 requires safeguards that limit other users’ ability to contact a minor, restrict public access to a minor’s personal data, limit features encouraging prolonged use, allow the minor to opt out of personalised recommendations, and restrict geolocation sharing. The default for each must be the most protective option the platform offers, which is what would visibly change a teenage account out of the box.
Parental Tools, Reporting And Audits
Parents would get tools to manage privacy and account settings, restrict purchases, and see total time spent, on by default for users under 13. A reporting mechanism would need a substantive response within 10 days for platforms with 10 million or more monthly active users in the United States, within 21 days for smaller platforms, and promptly where there is an imminent threat. Section 105 requires platforms above that line hosting user generated content to commission an annual independent audit and publish it.
Enforcement
The Federal Trade Commission would enforce the statute as unfair or deceptive acts or practices. State attorneys general could sue over the safeguards, parental tools and transparency sections, but the duty of care is carved out of state enforcement, a 2024 change answering concerns that attorneys general could use it to pressure platforms over content. There is no private right of action, and the title takes effect 18 months after enactment.
Who KOSA Would Cover
A covered platform is an online platform, online video game, messaging application or video streaming service that is used, or is reasonably likely to be used, by a minor. There is no revenue or user threshold in the core definition, though transparency and audit duties apply only above 10 million United States monthly active users.
The exclusions are specific: common carriers and broadband providers, email, schools, universities, libraries, news and sports sites where video is incidental, business to business software, government entities and certain nonprofits. In practice it reaches social networks, video platforms, messaging apps and games, not the pipes that carry them.
Timeline And Current Status In 2026
KOSA has cleared one chamber, twice cleared a Senate committee, and twice run into a House that wanted a different bill.
Date
Event
Outcome
16 February 2022
KOSA introduced as S. 3663 by Blumenthal and Blackburn
Died with the 117th Congress
2 May 2023
Reintroduced as S. 1409
Approved by Senate Commerce, 27 July 2023
9 April 2024
House companion H.R. 7891 introduced by Rep. Gus Bilirakis
Committee markup cancelled
30 July 2024
Senate agrees to KOSA plus COPPA 2.0 on the S. 2073 vehicle, roll call vote 221
Agreed 91 to 3, sent to the House
18 September 2024
A House subcommittee advances an amended text
Coalition splits, no floor vote
3 January 2025
The 118th Congress ends
The bill dies and must start again
14 May 2025
Reintroduced as S. 1748, joined by Leaders Thune and Schumer
Referred to Senate Commerce
2 December 2025
House Energy and Commerce subcommittee hearing
The House drafts its own bill
29 June 2026
House passes the KIDS Act, H.R. 7757, reported as 267 to 117
Referred to the Senate
5 August 2026
Senate Commerce advances S. 1748 at Executive Session 24
Awaiting Senate floor time
11 September 2026
Date this guide was verified
Not enacted. No KOSA obligation applies
The two live texts are not the same bill. The KIDS Act as passed by the House is a seven title package covering age verification for adult sites, online platforms, social gaming, AI chatbots and COPPA 2.0. The decisive difference sits in Title II: Section 213(a) requires reasonable policies, practices and procedures, and 213(c) then states that nothing in that subsection imposes a duty of care. Senator Blumenthal has called that an abdication of responsibility.
One point deserves correction. Coverage in June 2026, including Axios, described the House package as carrying preemption language limiting state lawsuits, which Senator Maria Cantwell said the Senate would not accept. The engrossed text sent to the Senate contains Section 704, Relationship to State Laws, reading in full: nothing in this Act may be construed to preempt any State law. On the passed text, preemption is not in the House bill.
So the precise status is this. KOSA is not law. The Senate bill has cleared committee, but the fast route of unanimous consent was blocked on 30 September, so it now needs a full floor vote. The Senate is due back for legislative business around 9 November 2026, and any bill not enacted before the current Congress ends on 3 January 2027 has to be reintroduced. The House has passed a competing package, and the two chambers have not settled the duty of care.
The Case For KOSA
The sponsors argue the bill regulates engineering rather than expression. Announcing the 2025 reintroduction, Senator Blackburn’s office stressed that the text was revised to make clear KOSA would not censor, limit or remove content, and gives neither the FTC nor state attorneys general power to sue over speech.
Bereaved parent groups argue voluntary change is too slow. After the committee vote, Parents for Safe Online Spaces called the Senate text the most protective, popular and bipartisan proposal under consideration, and its duty of care essential to forcing platforms to act in children’s best interests.
Sponsors also point to the limits of private settlements. Responding to a reported settlement of nearly 17 billion dollars between Meta and state attorneys general, Senators Blumenthal and Blackburn said on 26 August 2026 that its design changes expire after ten years and cover only Instagram and Facebook, and urged Congress to pass KOSA this year. They also cite the 91 to 3 Senate vote as evidence of bipartisan agreement.
The Case Against KOSA
Opposition comes from civil liberties organisations, some LGBTQ groups, parts of the technology industry and a few legislators in both parties.
The First Amendment objection is that a duty to mitigate harms such as anxiety or compulsive use is too vague to apply without suppressing lawful speech. The Electronic Frontier Foundation argues vague and broad provisions would push platforms to remove lawful material rather than risk liability, the American Civil Liberties Union calls the bill a censorship measure, and Senator Rand Paul has described it as a Pandora’s box of unintended consequences.
The second objection concerns which information disappears in practice. Critics warn that resources on sexual orientation, gender identity and reproductive health are the predictable casualties of a vague standard, because they are already contested. GLAAD dropped its opposition after February 2024 revisions clarified that design features rather than content were the target, then reversed in 2025. Critics also cite a Heritage Foundation statement that KOSA could be used to keep transgender related content from minors as evidence that enforcement discretion is a political risk.
The third objection is about age verification and privacy. Both texts say nothing in them requires age gating. Critics answer that practical effect is what matters. Writing before the August 2026 markup, Kate Ruane of the Center for Democracy and Technology argued the bills would impose or incentivise age verification, restrict young people’s access to lawful information, and risk adults losing accounts after being mistakenly identified as minors.
The fourth objection is practical: several state laws built on similar logic have been blocked in federal court, so a statute likely to be enjoined delivers no protection. Supporters point to the enumerated harms list, the removal of state enforcement of the duty of care, the age verification disclaimer, and Free Speech Coalition v. Paxton, decided 27 June 2025, upholding a Texas age verification law under intermediate scrutiny. Whether that extends to a general design mandate is untested.
What Is Actually In Force Today
While KOSA remains a bill, a substantial body of child safety regulation is already operating, some of it more demanding.
Federal United States
COPPA governs collection of personal information from children under 13 and is enforced by the FTC. The amended COPPA Rule was published in the Federal Register on 22 April 2025, took effect on 23 June 2025, and carried a full compliance date of 22 April 2026. That date has passed, so the new obligations are live: separate parental consent before disclosing a child’s data to third parties or using it for targeted advertising, a written security programme, written retention limits, and an expanded definition of personal information covering biometric identifiers and government issued ID numbers. See the FTC’s children’s privacy guidance.
State United States
State activity has outpaced Congress, and much of it is in litigation. California’s Age-Appropriate Design Code Act was enjoined and is not in effect. Maryland’s Kids Code took effect on 1 October 2024 and faces an industry challenge. South Carolina’s design code took effect on 5 February 2026 and requires annual audits reported to the attorney general, and Nebraska’s amended code followed on 17 July 2026.
App store accountability laws have moved fastest. After the Fifth Circuit lifted a stay, the Supreme Court denied an emergency application against the Texas App Store Accountability Act on 6 July 2026, leaving it in effect during appeal. Utah and Louisiana passed comparable laws in 2025, Alabama’s starts on 1 January 2027, and Colorado and California have taken a related route at the operating system layer. New York’s SAFE for Kids Act published final rules on 28 July 2026, with obligations from 25 January 2027.
International
The United Kingdom’s Online Safety Act is the most operationally demanding regime running. Children’s risk assessments were due by 24 July 2025, and the children’s safety duties and Ofcom’s Protection of Children Codes applied from 25 July 2025, requiring highly effective age assurance for the most harmful content and changes to recommender feeds. Ofcom fined an adult site 730,000 pounds on 4 September 2026. In the European Union, the Commission published guidelines on the protection of minors under Article 28 of the Digital Services Act on 14 July 2025, recommending private accounts by default, recommender changes and proportionate age assurance. Following them is voluntary, but they are the benchmark regulators will use.
Law or bill
Where
Status in September 2026
Core requirement
COPPA and the amended COPPA Rule
US federal
In force. Full compliance since 22 April 2026
Parental consent, data limits for under 13s
Kids Online Safety Act, S. 1748
US federal
Proposed. Advanced by Senate Commerce 5 August 2026
Duty of care, safeguards, parental tools, audits
KIDS Act, H.R. 7757
US federal
Proposed. Passed the House 29 June 2026
Safeguards and defaults, no duty of care
Age-Appropriate Design Code
California
Enacted but enjoined. Not in effect
Impact assessments, default protections
Kids Code
Maryland
In effect since 1 October 2024, challenged
Best interests design standard
Design code, HB 3431
South Carolina
In force since 5 February 2026
Design duties plus annual audits
SAFE for Kids Act
New York
Rules 28 July 2026, obligations from 25 January 2027
Consent for algorithmic feeds and night alerts
App Store Accountability Act
Texas
In force. Emergency application denied 6 July 2026
App store age checks, parental consent
Online Safety Act children’s duties
United Kingdom
In force since 25 July 2025
Risk assessments, age assurance, feed changes
DSA Article 28 guidelines
European Union
Published 14 July 2025, voluntary benchmark
Private accounts by default, age assurance
What KOSA Means For Parents
In the short term nothing changes because of KOSA. No platform owes any duty under it, and even if it were enacted tomorrow the obligations would not begin for 18 months.
What has changed is the surrounding environment. In Texas and Utah, app store age checks and parental consent already apply to downloads by minors. In New York, feed and notification restrictions arrive on 25 January 2027. In the United Kingdom, the age assurance now common on video and social platforms is the Online Safety Act working as designed. Several large platforms have also rolled out teen account defaults globally, so some KOSA style protections already exist.
The practical implication is that today’s controls are platform and device settings, not statutory rights, so reviewing the default privacy, messaging and screen time settings on every account a child uses will do more this year than following a bill. Our walkthrough of how to set up parental controls covers the settings worth changing first, and our roundup of the best parental control apps compares the tools that manage them across devices. For a broader view of the trade offs, our guide to the impact of screen time on mental health covers the research, and our walkthroughs of the BeenVerified opt out and PeopleFinders opt out processes cover household data exposure.
What KOSA Means For Platforms
For an operator in 2026, KOSA is not yet your compliance problem. Four other things are.
The amended COPPA Rule is enforceable now, including separate consent for third party disclosure and targeted advertising, a written security programme and a written retention policy. If your service is likely to be accessed by children in the United Kingdom, the risk assessment and the Protection of Children Codes already bind you, and Ofcom has begun issuing fines. At the app store and operating system layer, Texas and Utah are live and four more states follow by 2028, so age signals will arrive whether or not you asked for them. Among state design codes, South Carolina’s annual audit reported to a state attorney general is an operational commitment, not a policy update.
If KOSA passes in something like the Senate form, the work it adds is mostly documentation and defaults: evidence that design decisions were assessed against the enumerated harms, most protective defaults on minor accounts, a reporting channel with a 10 day response for larger services, and an annual public audit. Teams that built for the UK codes will find much of it familiar. On the buy side, our comparisons of top age verification software, top content moderation companies and top trust and safety platforms cover the vendors operators use to meet the age assurance, reporting and audit duties these regimes already impose.
What To Watch Next
Four things will decide whether there is a kids online safety act to write about in 2027. The first is Senate floor time. The second is the duty of care, since the Senate bill has one and the House bill expressly disclaims one, and there is no obvious middle position.
The third is what else gets attached: reporting in mid 2026 indicated the administration wanted to link children’s online safety to federal preemption of state artificial intelligence laws, which several senators resisted. The fourth is the calendar, since the 119th Congress ends on 3 January 2027 and if nothing is enacted KOSA must be introduced a fifth time. On the state side, 1 January 2027 and 25 January 2027 are the next dates that change what platforms have to do.
Frequently Asked Questions
Is KOSA Law?
No. As of 11 September 2026 it has not been enacted. S. 1748 was advanced by the Senate Commerce Committee on 5 August 2026 and awaits a floor vote, and the House passed a different package, the KIDS Act, on 29 June 2026. Neither has become law.
When Does KOSA Take Effect?
There is no effective date because there is no statute. If S. 1748 were enacted as drafted, the main title would take effect 18 months after enactment. The House package uses staggered dates, with the obscenity title allowing a year.
Does KOSA Require Age Verification?
Not on its face. Both texts state that nothing in them requires age gating or age verification functionality. Critics including the Center for Democracy and Technology argue platforms would adopt age assurance anyway, to know which users the obligations apply to, so the practical effect would be age checks without a mandate. Supporters say the disclaimer is explicit.
What Is The Difference Between KOSA And COPPA?
COPPA is an existing 1998 law about data. It governs collection of personal information from children under 13 and requires verifiable parental consent. KOSA is a proposed law about design. It would apply to users under 17 and make platforms responsible for the foreseeable effects of features such as recommendation feeds, notifications and messaging. COPPA is enforced today and KOSA is not in force at all. COPPA 2.0, which would raise the COPPA age to 16, is a separate proposal.
Did KOSA Pass The Senate?
Yes, once. On 30 July 2024 the Senate agreed to the Kids Online Safety and Privacy Act, combining KOSA and COPPA 2.0, by 91 to 3 on roll call vote 221, using S. 2073 as the vehicle. The House never voted and it expired with the 118th Congress.
Why Did KOSA Stall In The House?
House Republican leadership declined to bring the Senate text to the floor in 2024, citing First Amendment concerns and disagreement over the duty of care. A subcommittee advanced an amended version on 18 September 2024 that diverged further and cost the bill supporters.
What Is The KIDS Act And How Is It Different?
The Kids Internet and Digital Safety Act, H.R. 7757, is the House package passed on 29 June 2026. It is broader in subject matter, covering age verification for adult sites, social gaming, AI chatbots and COPPA 2.0, but narrower on the central question: Section 213(c) states that it does not impose a duty of care, and Section 704 states that nothing in the Act preempts state law.
Would KOSA Restrict LGBTQ Or Reproductive Health Information?
This is contested. Civil liberties groups and some LGBTQ organisations argue a vague harm standard would push platforms to restrict information about sexual orientation, gender identity and reproductive health, and point to statements by some supporters as evidence of intent. The sponsors say the bill regulates design rather than content, bars viewpoint based censorship, and that removing state enforcement of the duty of care closed that avenue. No court has ruled, because the bill is not law.
The Short Version
The kids online safety act is a design regulation bill, not a content law and not a privacy law. It would require covered platforms to exercise reasonable care over design features, turn on the most protective settings for minors by default, give parents management tools, run a reporting channel with fixed response times and, for the largest services, publish an annually audited transparency report. The FTC would enforce it, 18 months after enactment.
It is not law. On 11 September 2026 the Senate bill has cleared committee and is waiting for a floor vote, and the House has passed a competing package that leaves the duty of care out. Anyone who tells you KOSA is in force, or that it takes effect on a particular date, is mistaken. What is in force is COPPA as amended, a patchwork of state design codes and app store laws, the UK Online Safety Act children’s duties, and the EU’s DSA guidelines on minors.
This article is general information about legislation and regulation, not legal advice. Organisations with compliance obligations should take advice on their own circumstances.
