On Tuesday, the Senate passed a pair of bills that could drastically change how the government regulates tech companies and child safety.
The bills, called the Kids Online Safety Act (KOSA) and the Children and Teens’ Online Privacy Protection Act (COPPA 2.0), passed with a strong bipartisan consensus, 91-3.
Despite the support from the Senate, the legislation — aimed at empowering the Federal Trade Commission to better protect American kids’ privacy and safety online — remains deeply divisive within the tech community and among various interest groups.
The bills, which have been floated in various forms for years, now stand a greater chance than ever before to become law. While the House has recessed until September, Speaker Mike Johnson, R-La., told reporters Thursday that he would support KOSA. President Joe Biden appears likely to sign the bills after calling for bipartisan legislation to protect kids’ online safety and privacy online in his State of the Union speech.
While COPPA has been broadly celebrated as an overdue improvement to the country’s meager digital privacy protections, KOSA has been mired in controversy for years.
COPPA 2.0
COPPA 2.0 has faced few critics outside of the advertising industry. It updates a 1998 law that tried to set baseline privacy protections for American children by prohibiting websites from knowingly collecting information on children 12 or younger without their parents’ permission. Since it took effect in 2000, the FTC has settled several dozen lawsuits with companies that it alleged collected or stored basic information on children such as their names, ages, addresses and personal interests without parental consent.
The updated COPPA has three key changes.
It would raise the maximum age of children covered under the law to 17, banning companies from collecting those users’ data without their consent.
It updates the law’s definition of personal information to include biometric indicators such as fingerprints, voiceprints, facial imagery and gait, to better address how technology tracks people in 2024.
It also aims to close a loophole that allows some companies to track kids if they can claim they don’t have “actual knowledge” that their customers are underage.
COPPA 2.0 might not lead to immediate and obvious changes at major sites that serve content to kids, such as YouTube and TikTok, according to experts. Those companies already have large legal teams to assist with COPPA compliance and could simply shift age restrictions up based on the new rules in order to restrict content for teenagers or secure necessary data permissions.
But provisions in the bill could limit how third-party companies advertise to anyone under 17. COPPA 2.0 includes a ban on so-called contextual advertising to young users, forbidding companies from using certain personalized data, such as a person’s phone location or web-surfing history, to send tailored ads to most minors, said Suzanne Bernstein, a law fellow specializing in data protection and consumer privacy at the nonprofit Electronic Privacy Information Center.
“If you were on an Instagram page for horses and you were looking through, if there was an ad on that page for stables nearby, that’s contextual advertising,” she said.
Arielle Garcia, director of intelligence for Check My Ads, a nonprofit watchdog that monitors harms from the digital advertising industry, said that the update is “necessary for COPPA to be effective.”
Some privacy advocates, like the Electronic Frontier Foundation, haven’t endorsed COPPA 2.0 because they prefer prioritizing a comprehensive digital privacy bill for all Americans — not just kids. Different members of Congress have for years tried to get a full privacy bill passed, with no success to date.
The Interactive Advertising Bureau, a trade association, has claimed that COPPA 2.0 will make it harder to accurately serve online ads that help power free internet services, ultimately “creating a data-poor, much less functional, useful internet.”
KOSA
KOSA has garnered both significant support and heavy criticism since it was first introduced in 2022.
KOSA aims to address parents’ complaints that social media feeds can harm children’s health, from internet addiction to abuse. The bill’s core concept is creating a “duty of care” for internet companies, meaning they can be legally liable if they recommend content to kids that can harm their mental health.
It’s supported by a broad range of children’s advocacy and mental and physical health groups, such as the American Psychological Association, the American Academy of Pediatrics, the Eating Disorders Coalition and Mental Health America.
But tech policy experts and many of the bill’s public critics have said that if the bill becomes law, social media platforms may potentially react by proactively overcensoring controversial content. Critics have also raised concerns about how the potential law could be used for political censorship by future presidential administrations who might have interests in blocking information about topics such as reproductive health and LGBTQ issues.
Experts have warned of an unintended consequence: that it could make it harder for kids and adults alike to find information online. The Electronic Frontier Foundation’s analysis of KOSA says that some websites might implement age verification or simply block content on sensitive topics to avoid potential lawsuits.
Critics like the Open Technology Institute, an arm of the New America think tank, have long cautioned that existing age verification methods are often easily circumvented and can create a data trail that could be used to unnecessarily identify children online.
KOSA has weathered two major controversies that have amplified concerns around the measure. Last year, a video interview surfaced where the bill’s Republican sponsor, Tennessee Sen. Marsha Blackburn, said in a short interview that also addressed KOSA that conservative legislators should prioritize “protecting minor children from the transgender in this culture.” Blackburn’s staff later said those comments were not meant to reflect KOSA.
An earlier version of the bill originally authorized state attorneys general, who have broad discretion to pursue partisan goals, to use KOSA to sue tech companies for content they make available to minors. That caused an outcry among civil liberties advocates, who viewed it as an avenue for Republicans to censor LGBTQ and other content.
The bill now gives the FTC, rather than state attorneys general, that power to sue tech companies over content. But critics note that even the FTC, which is traditionally staffed by a 3-2 majority from the president’s party, can be partisan.
Sen. Ron Wyden, D-Ore., a leading civil libertarian on tech issues in the Senate, announced on a BlueSky thread Thursday that while the bill had “improved,” he would still vote no because “a future MAGA administration could still use this bill to pressure companies to censor gay, trans and reproductive health information.”
India McKinney, director of federal affairs at the Electronic Frontier Foundation, which opposes KOSA, said that while that change is welcome, the bill still fundamentally blames internet companies for larger societal problems and will result in a more censored internet.
“I am not prepared to argue that there is not a mental health crisis for teens in the United States. But I don’t think Instagram is the cause of that,” McKinney said.
“I think the cause is all of the absolutely ridiculous stuff that’s happening in the world, like the Dobbs decision, climate change, the Covid pandemic. These are the things we need to be talking about as a way to help our teenagers, not restricting their access to information,” she said.
