KOSA Is Back Before the Senate — and the Privacy Problems Haven't Gone Away

Key Takeaways

• The Kids Online Safety Act (KOSA) is back before the Senate Commerce Committee, alongside the SCREEN Act, the CHATBOT Act, and the Youth AI Privacy Act.
• The Electronic Frontier Foundation argues KOSA pushes platforms toward age verification by imposing a "duty of care" that only works if platforms know which users are minors — creating new incentives to collect sensitive identity data from everyone.
• The bill's "duty of care" provision gives state attorneys general the power to enforce what counts as harmful content for minors, creating strong incentives for platforms to preemptively remove lawful speech rather than risk prosecution.
• The EFF's position: Congress should pursue comprehensive privacy legislation that protects all users — not bills that undermine privacy and free expression in the name of protecting children.

The Kids Online Safety Act is before the Senate Commerce Committee again, according to an article published August 3, 2026, by the Electronic Frontier Foundation. Alongside three companion bills — the SCREEN Act, the CHATBOT Act, and the Youth AI Privacy Act — KOSA represents what the EFF describes as a package that would "dramatically expand age verification and undermine privacy for everyone."

We covered KOSA when the House passed its own version — the KIDS Act — in a 267-117 vote in June. The Senate version is different in one significant respect: it includes a "duty of care" provision that the House deliberately stripped from its bill. That provision requires online services to avoid exposing young people to content the law deems harmful. 

The KIDS Act dropped it after criticism that it would lead to aggressive censorship of lawful speech. The Senate version keeps it — and the EFF argues that's the provision that makes KOSA most dangerous.

The duty of care only works if platforms know which users are minors. That means platforms have a structural incentive to implement age verification or age estimation — and those systems require collecting sensitive personal data from everyone, not just the minors the law is targeting.

The Privacy Cost Falls on Everyone

The EFF's Joe Mullin — the same analyst who flagged problems with the House KIDS Act in June — is direct about what age verification actually requires: "Whether companies verify ages by checking government IDs, performing facial analysis, checking your bank records, or collecting other personal information, all of these systems require the handing over of more sensitive data, simply to access lawful online speech and services."

We've made this argument across every age verification story we've covered this year — from Iowa's adult content law to France's blanket social media requirement to Australia's under-16 ban. The pattern is consistent: the privacy cost of age verification is borne by every user, not just the minors being protected. Each system creates a new database of sensitive personal information that can be breached, misused, or handed over to governments. The scale of that risk grows with every law that requires it.

KOSA adds a layer beyond the privacy problem. By empowering state attorneys general to enforce the duty of care, the bill puts elected political officials — not families, not schools, not the young people themselves — in charge of deciding what content is harmful enough to restrict. 

The EFF's concern is practical: when platforms face liability for content that someone later claims contributed to harms like anxiety, eating disorders, or substance use, the safest response isn't precise, targeted removal. It's removing lawful speech proactively, or shutting down entire forums where those topics are discussed.

The Cruelest Irony

There's a particular dimension of this argument worth emphasizing. KOSA's duty of care specifically lists things like gambling, drug addiction, and eating disorders as harms platforms must protect minors from. The EFF points out that many of the forums where young people find community, support, and recovery resources for exactly these issues would likely be shut down under the liability pressure the bill creates. 

A bill designed to protect kids from harmful content may end up blocking their access to the communities helping them deal with the harm they've already experienced.

That's not a hypothetical. It's the predictable outcome of giving platforms financial and legal incentives to over-remove rather than under-remove. The safest platform response to liability risk is always to remove more, not less — and the speech most likely to be removed is the contested, difficult, stigmatized content that sits nearest to the legal line. That's exactly where the conversations that matter most often live.

The EFF's ask is clear: reject KOSA and pursue comprehensive privacy legislation that protects everyone. Not just bills that expand the surveillance infrastructure of the internet in the name of children — while leaving the children who need support most without the communities they rely on.