Technical corrections only. The diff primarily updates the bill's status from "Engrossed in House" to "Referred in Senate," including the date and committee referral information. There are no substantive policy changes between v2 and v3.
KIDS Act
- Sponsor
- Rep. Guthrie, Brett [R-KY-2]
- Committees
- Energy and Commerce Committee (primary)
- Last action
- Jul 13, 2026
Bottom line
The KIDS Act is a broad legislative effort to enhance online safety and privacy for individuals under 18 by imposing new obligations on a wide range of internet services and data practices.
What it actually does
This omnibus bill establishes a comprehensive framework to regulate online platforms, social gaming, and AI chatbots to protect minors. It mandates age verification for sexually harmful content, requires platforms to implement safeguards against various harms, provides parental control tools, expands children's online privacy protections to include teens, and establishes a registration requirement for data brokers. The bill also mandates several studies and educational campaigns related to minors' online safety and mental health.
Proponents argue
Supporters argue that the bill is a necessary and overdue response to the growing risks minors face online, including exposure to harmful content, exploitation, addiction-inducing design features, and privacy violations. They contend that it empowers parents with essential tools, holds platforms accountable, and promotes a safer digital environment for children and teens, addressing critical public health and safety concerns.
Opponents contend
Critics contend that certain provisions, particularly those related to age verification and content moderation, could infringe on free speech rights, compromise user privacy by requiring more data collection, and be technically challenging or impossible to implement without significant unintended consequences. They also raise concerns about the potential for over-blocking of legitimate content and the impact on smaller platforms and innovation.
The bill is extensive and complex, requiring significant time to read and understand its numerous interconnected provisions across multiple titles. The time given for public review may be insufficient for thorough stakeholder analysis.
Title I, Sec. 103
Technology Verification Measures for Sexually Harmful Material
This provision requires providers of online platforms where more than one-third of the material is sexual material harmful to minors to adopt and utilize commercially available technology verification measures to identify minors. These platforms must then prevent identified minors from accessing such content. The measures must verify age beyond a simple self-attestation and include data security practices for any collected verification data.
Supporters argue
Supporters argue this provision is crucial for shielding children from explicit and inappropriate content, which can have severe psychological and developmental impacts. They contend that current self-attestation methods are ineffective and that robust age verification is a necessary step to create a truly safe online environment for minors.
Critics contend
Critics argue that mandatory age verification systems pose significant privacy risks, as they often require users to submit sensitive personal data. They also contend that such systems can be easily circumvented, lead to over-blocking of legitimate content, and disproportionately affect free speech and access to information for adults.
Tradeoffs
This provision balances the imperative to protect minors from harmful content against concerns about user privacy, data security, and potential restrictions on adult access to lawful material. It also presents a technical challenge for platforms to implement effective and secure age verification without creating new vulnerabilities.
Title II, Subtitle A, Sec. 213-214
Kids Online Safety Act (KOSA) - Harms, Safeguards, and Parental Tools
This subtitle requires covered online platforms to establish policies and procedures to address harms to minors, including physical violence threats, sexual exploitation, drug/alcohol promotion, and financial harm. It mandates platforms to provide minors with easy-to-use safeguards (e.g., limiting communication, restricting geolocation sharing, controlling personalized recommendations) and parental tools (e.g., viewing/managing settings, restricting purchases/time, receiving messaging notifications). Default settings for minors and children must be the most protective.
Title II, Subtitle B, Sec. 233
Stop Profiling Youth and Kids (SPY Kids Act) - Prohibition on Market Research on Minors
This subtitle prohibits providers of covered platforms from conducting market or product-focused research on users or visitors they know are minors. Exceptions are made if the research is solely to improve the privacy, security, transparency, or safety of the platform (including design features or safeguards), or if it's necessary for compliance with federal or state law. It clarifies that measuring or reporting advertising/content performance, reach, or frequency is not limited.
Title III, Sec. 303
Safer GAMING Act - Safeguards for Online Video Game Providers
This title requires online video game providers to offer parents of minor users safeguards to limit communication between their child and other users. These safeguards must be accessible, easy to use, and enabled by default at the most protective level. Additionally, providers must offer safeguards to prevent minor profiles/personal information from being recommended to non-minors, restrict purchases/financial transactions by minors, and limit time spent by minors on the game.
Title IV, Sec. 403-405
SAFE BOTs Act - AI Chatbot Regulations for Minors
This title prohibits chatbot providers from falsely claiming to be licensed professionals to minor users. It requires clear and conspicuous disclosures to minors that the chatbot is an AI system and not a natural person, and provides resources for crisis intervention hotlines when suicide is prompted. Chatbot providers must also implement policies to advise minors to take breaks after 3 hours of continuous interaction and address sexual exploitation, gambling promotion, and drug/alcohol promotion for minors.
Title V, Subtitle A, Parts 1-4
Research on Minors' Online Use and Mental Health
This subtitle mandates several studies: the FTC and HHS to report on social media use by minors (personal info collection, algorithms, mental health effects); the FTC and HHS to report on minors' access to fentanyl through social media; the FTC to review industry efforts on online safety tools; and the Secretary of Health and Human Services (NIH) to conduct a 4-year longitudinal study on the risks and benefits of chatbots on minors' mental health.
Title V, Subtitle B and C
Education and Best Practices for Online Safety
This subtitle amends the Protecting Children in the 21st Century Act to mandate a public awareness and educational campaign by the FTC and partners to promote safe internet use for minors, including best practices for educators, platforms, minors, and parents. It also requires the FTC to develop educational resources for parents, educators, and minors on safe and responsible chatbot use. Additionally, it establishes the Kids Internet Safety Partnership within the Department of Commerce to coordinate stakeholders, identify risks/benefits, publish reports, and develop a playbook for providers on best practices.
Title VI, Subtitle A, Sec. 602
COPPA 2.0 - Expanded Online Privacy Protections for Children and Teens
This subtitle significantly amends the Children's Online Privacy Protection Act (COPPA) by expanding its scope to include 'teens' (individuals aged 14 to under 18) in addition to 'children' (now defined as under 14). It broadens the definition of 'personal information' to include persistent identifiers, geolocation, biometric data, and certain audio/video files. It prohibits individual-specific advertising to children or teens, requires verifiable consent from parents (for children) or teens themselves (for teens) for data collection/use, and mandates reasonable security practices. It also introduces new rights for teens to access, delete, and correct their personal information.
Title VI, Subtitle B, Sec. 612
Data Broker Disclosures - Registration Requirement
This subtitle requires 'covered data brokers' (entities that sell, license, or otherwise make available personal data of minors they know to be minors, which they did not collect directly from the minor) to register annually with the FTC. The registration statement must include the broker's legal name, contact information, categories of personal data sold, whether a purchaser credentialing process is used, and any reported incidents of unauthorized data access. The FTC is mandated to establish a publicly available, searchable registry of these data brokers.
Title VII, Sec. 701, 702, 704
General Provisions - Enforcement, Judicial Review, and State Laws
This title establishes that violations of the Act are treated as unfair or deceptive acts under the Federal Trade Commission Act, granting the FTC enforcement powers. It also allows State Attorneys General to bring civil actions on behalf of their residents, with notice to the FTC. Exclusive jurisdiction for constitutional challenges is granted to the U.S. District Court for the District of Columbia. Importantly, the Act preempts conflicting state laws but explicitly allows states to enact or enforce laws that provide *greater* protection to minors.
The definition of 'minor' varies significantly across different titles and subtitles of the Act. For example, 'minor' is generally under 17 (Sec. 2(8)), but 'child' is under 13 in KOSA (Sec. 212(1)), 'child' is under 14 in COPPA 2.0 (Sec. 602(a)(1)), and 'teen' is 14-17 (KOSA) or 14-18 (COPPA 2.0 and Data Brokers). 'Minor' in Title I (SCREEN Act) and Title III (GAMING Act) is under 17, while in Title VI, Subtitle B (Data Broker Disclosures) it is under 18.
Sec. 2(8), Sec. 102(2), Sec. 212(1), Sec. 212(8), Sec. 302(a)(5), Sec. 602(a)(1), Sec. 602(a)(17), Sec. 611(3)
Why it matters:This is likely a result of combining multiple legislative proposals (each with its own definitions) into an omnibus bill, rather than a deliberate attempt to obscure. However, it creates significant complexity for compliance.
Case for: Supporters might argue that different age-based protections are appropriate for different types of online activities or harms, reflecting developmental stages and legal precedents (e.g., COPPA's original age of 13).
Case against: Critics would contend that the inconsistent age definitions create a confusing and burdensome regulatory landscape for platforms, making compliance difficult and potentially leading to uneven protection for minors. It complicates the development of unified age-gating or verification systems.
Estimated impact: This inconsistency could lead to significant compliance challenges for platforms, requiring them to implement different age-based rules for different aspects of their services, and may create legal ambiguities.
The definition of 'know' or 'knows' also varies across different subtitles. In KOSA (Sec. 212(6)), GAMING (Sec. 302(a)(4)), and SAFE BOTs (Sec. 402(3)), it means 'to know or should have known' (a constructive knowledge standard). However, in SPY Kids (Sec. 232) and Data Broker Disclosures (Sec. 611(2)), it means 'to have actual knowledge or to have acted in willful disregard' (a higher standard of culpability). For COPPA 2.0, it's 'actual knowledge or should have known' (Sec. 602(a)(20)).
Sec. 212(6), Sec. 232, Sec. 302(a)(4), Sec. 402(3), Sec. 602(a)(20), Sec. 611(2)
Why it matters:This is likely a result of combining different legislative proposals, each with its own preferred standard of knowledge. It could also be a tactical choice to apply a stricter standard ('actual knowledge or willful disregard') to certain provisions (like market research or data brokers) where the intent to harm or exploit might be harder to prove under a 'should have known' standard, or where the industry successfully lobbied for a higher bar for liability.
Case for: Proponents of the 'should have known' standard argue it places a reasonable burden on platforms to actively identify and address risks to minors, preventing them from turning a blind eye. Proponents of 'actual knowledge or willful disregard' argue it protects platforms from liability for harms they could not reasonably foresee or detect, focusing on deliberate misconduct.
Case against: Critics of 'should have known' argue it creates an overly broad liability standard, potentially leading to excessive content moderation and chilling effects on speech. Critics of 'actual knowledge or willful disregard' argue it sets too high a bar for accountability, allowing platforms to avoid responsibility for harms that are evident but not 'willfully disregarded.'
Estimated impact: The varying 'knows' definitions will significantly impact the burden of proof for enforcement actions and the level of proactive monitoring and mitigation required from different types of online entities.
Rules of construction explicitly state that nothing in Subtitle A (KOSA) or the amended COPPA (COPPA 2.0) may be construed to require a provider of a covered platform to implement an age gating or age verification functionality. Additionally, Sec. 703(10) states nothing in the Act requires the affirmative collection of any personal information with respect to age that is not already collected in the normal course of business.
Sec. 220, Sec. 605(f), Sec. 703(10)
Why it matters:This is likely a tactical maneuver to mitigate industry opposition and address concerns from privacy advocates who fear mandatory age verification could lead to intrusive data collection. It allows the bill to mandate 'safeguards' and 'technology verification measures' (Title I) without explicitly requiring a universal age-gating system for all platforms covered by KOSA or COPPA 2.0, creating a nuanced and potentially ambiguous compliance landscape.
Case for: Proponents argue this avoids a 'one-size-fits-all' mandate that could be technically challenging, costly, and privacy-invasive. It allows platforms flexibility in how they achieve age-appropriate experiences without forcing a specific, potentially flawed, technology solution.
Case against: Critics argue that without explicit age verification, many of the bill's protections for minors (especially those that depend on 'knowing' a user's age) will be difficult to enforce effectively. They contend that this loophole undermines the intent of the bill and leaves minors vulnerable.
Estimated impact: This provision creates a significant tension: platforms are required to provide age-based protections but are not explicitly required to verify age, except for platforms with sexually harmful material (Title I). This could lead to varied and potentially inconsistent application of safeguards across the internet.
Rules of construction state that no requirement under Subtitle A (KOSA) to restrict features or provide messaging controls may be construed to override any protection for an encrypted communication, and providers shall adhere to requirements 'to the maximum extent technically feasible' through means that do not compromise 'strong encryption.' Furthermore, nothing in the entire Act may be construed to decrypt or ensure an ability to decrypt an encrypted communication or preclude the use of any form of encryption, including end-to-end encryption.
Sec. 221, Sec. 703(7), (8)
Why it matters:This is a tactical maneuver to address concerns from privacy advocates and technology companies about potential 'backdoors' or weakening of encryption, which is a highly contentious issue. By explicitly protecting strong encryption, the bill attempts to garner broader support while still pursuing child safety goals, albeit with a 'technically feasible' caveat.
Case for: Proponents argue that strong encryption is fundamental for privacy, security, and free speech online, protecting all users, including minors, from surveillance and malicious actors. They contend that weakening encryption would create vulnerabilities that outweigh any potential benefits for child safety.
Case against: Critics argue that strong encryption, particularly end-to-end encryption, can create 'safe havens' for child sexual abuse material (CSAM) and other illicit activities, making it difficult for law enforcement and platforms to detect and report such content. They contend that child safety should sometimes take precedence over absolute encryption.
Estimated impact: This provision seeks to protect encryption, which could limit the ability of platforms to moderate content within encrypted communications, potentially creating a challenge for enforcing some of the bill's child safety mandates within those contexts.
COPPA 2.0 significantly expands the definition of 'personal information' to include persistent identifiers (like IP addresses, device serial numbers, unique device identifiers), geolocation information, biometric data (fingerprints, voice prints, facial templates, DNA, gait), and certain audio/video files containing a child's or teen's image or voice. It also includes information linked or reasonably linkable to a child/teen or parent.
Sec. 602(a)(8)
Why it matters:This is a substantively consequential change, as it dramatically broadens the scope of data considered 'personal information' under COPPA, bringing many more types of data under its protective umbrella. While not 'buried' to obscure, its technical nature makes it less immediately apparent to a casual reader.
Case for: Proponents argue that the original definition of 'personal information' in COPPA was outdated and failed to account for modern tracking technologies and data collection practices. This expansion is necessary to provide meaningful privacy protections against pervasive digital profiling and surveillance of minors.
Case against: Critics argue that such a broad definition could create immense compliance challenges for platforms, requiring them to treat a vast array of data as sensitive and subject to strict consent requirements. This could stifle innovation and make it difficult to provide many online services that rely on these types of data for functionality.
Estimated impact: This expanded definition will have a profound impact on how online platforms collect, use, and store data from minors, requiring significant changes to data governance, privacy policies, and technical infrastructure.