For years, American lawmakers have promised to “do something” about the harms young people face online. The Kids Online Safety Act (KOSA) is a proposed answer: a federal bill that would impose a new legal “duty of care” on covered online services, including social media platforms, messaging applications, online video games, and streaming services used by minors. Although its provisions have varied across the chambers of Congress, the legislation generally seeks to reduce harm by requiring platforms to adopt preventative safety measures and modify certain features of their services. Its sponsors promise “safety by design” and present the bill as a way to protect minors from addictive feeds and harmful content.
However, such broad, ambiguously defined tech regulation can encourage censorship and surveillance. In its Senate formulation, KOSA requires that platforms “exercise reasonable care” to prevent foreseeable harms. Yet, that leaves room for disagreement over which safeguards are sufficient, underscoring the need for precisely defined, evidence-based obligations.
Policymakers should prioritize targeted interventions that protect minors without compromising privacy, free expression, or their developing autonomy, rather than relying on sweeping mandates that overlook the varied experiences and needs of young people.
The Trouble with “Reasonable Care”
Under its Senate formulation, KOSA is set to create a new “duty of care” for platforms that are used, or reasonably likely to be used, by minors under seventeen years old. These services would be required to exercise reasonable care to prevent or mitigate a sweeping list of harms, including eating disorders, substance use disorders, suicidal behaviors, and clinically diagnosable anxiety and depression linked to compulsive platform usage. Platforms that fail to meet these obligations could face Federal Trade Commission (FTC) enforcement, including civil penalties, because KOSA treats violations as “breaches of a rule defining an unfair or deceptive act or practice under the FTC Act.” Given the ambiguity of what constitutes “reasonable care,” platforms might be pushed to adopt restrictive default settings or redesign features to minimize liability.
What constitutes content that “promotes” harm? Could information about gender-affirming care or discussions of police violence and civilian protests be interpreted as harmful when recommended to minors? In a polarized country, these answers change dramatically across state lines—and administrations. By codifying an inherently fluid standard of harm into law, KOSA could all but guarantee that platforms will err on the side of taking down or burying anything that could be construed as controversial, thus limiting public access.
Failing Safety Filters
Moderating content at scale encourages platforms to rely on automated systems, which can screen vast volumes of content faster. Yet these systems have repeatedly struggled to distinguish harmful material from legitimate speech. YouTube’s automated moderation system deleted thousands of Syrian war videos that human rights groups were using as evidence of possible war crimes, alongside actual extremist propaganda. During the COVID-19 pandemic, Facebook initially identified claims that the virus was man-made or emerged from a lab as misinformation, before reversing that policy as calls for further investigation gained traction. YouTube’s Restricted Mode, marketed as a tool to shield children from inappropriate content, ended up hiding a wide range of LGBTQ+ videos—including coming-out stories and educational content—treating identity-affirming material as suspect even when no explicit imagery was found. As currently written, KOSA’s “duty of care” will exacerbate these existing deficiencies by making such automated systems an easy means to avoid liability, therefore restricting youth access to lawful, potentially valuable content.
Age Verification’s Hidden Costs
The prospect of age verification compounds these risks to free expression and access to information. Platforms will be under enormous pressure to know who is a minor and who is not, because KOSA draws sharp legal lines around users under the age of seventeen. To do so, they may turn to a range of age-assurance methods, from government-issued IDs and facial analysis to behavioral inferences and third-party credentials.
In 2026, the FTC issued a Children’s Online Privacy Protection Act (COPPA) enforcement policy explicitly designed to incentivize use of age verification technologies by offering platforms a limited safe harbor when they collect and process personal data to determine a user’s age. Unlike COPPA’s explicit legal incentive, however, KOSA’s pressure arises through its knowledge standard. Legal analysts have likewise warned that this standard—which holds platforms responsible not only for what they know about users’ ages, but also for what they reasonably should have known—would make widespread age-verification the clearest path toward demonstrating compliance, even without an explicit legislative mandate.
The implications for privacy and civil liberties are deeply troubling. A world in which accessing mainstream social media platforms requires uploading a government ID, passing a face scan, or submitting to behavioral profiling is a world in which the freedom to participate anonymously and to explore one’s identity, interests, and beliefs—a freedom essential to adolescent development—becomes increasingly difficult to preserve.
It is also a world in which sensitive information about young people’s identities, bodies, and online behavior risks becoming concentrated in the hands of the companies responsible for verifying their ages. Those systems will not be neutral. They will make mistakes, and those mistakes will not be evenly distributed across demographic groups, with particular consequences for racial minorities and young people with disabilities.
Beyond a One-Size-Fits-All Framework
KOSA was not built from a nuanced understanding of how young people actually use the internet. Teenage life online is not neatly divided into harmful and wholesome buckets. The same platform can expose someone to cyberbullying and to shared-interest communities; the same search terms can lead to the creation of or recovery from an eating disorder. Hot-button topics—mental health, politics, sexuality, and identity—are intertwined in these messy, overlapping spaces, and each young person engages with them differently. Vague legislation, along with leaving enforcement details to third parties, effectively asks platforms to suppress risk through the suppression of visibility.
A more discerning model of tech regulation would begin by mapping specific, evidence-based patterns of harm and then tailoring obligations to address those patterns. Instead of treating all uncomfortable or controversial content as a liability, KOSA should distinguish between content that is merely distressing and platform design features associated with measurable harms. Such a model would recognize that young people themselves have firsthand knowledge of how online spaces shape their experiences, and that those perspectives should inform the policies designed to protect them.
This calls for an adaptive regulatory approach, one that evolves alongside emerging technologies and evidence of harm instead of imposing predetermined mandates. Regulators should require large platforms to conduct and publish regular risk assessments of how their systems and design choices affect minors, with particular attention to vulnerable groups. Youth advisory councils and structured consultations with educators and students could be built into product design and policy review. Narrowly targeted obligations—such as limits on certain engagement-maximizing design features that target young users—could be updated as new evidence emerges, rather than fixed in statute based on today’s evidence and assumptions. It is crucial for any comprehensive approach to prioritize transparency and accountability over vague mandates to prevent harm in the abstract.
Adapting KOSA
None of this is to deny that there are real and urgent problems with how social media and other online services affect young people. Compulsive use, body image, and suicidality are not inventions of moral panic, and companies have often been too slow to address harmful design features, but the existence of a problem does not justify just any solution.
KOSA should reflect a model of tech governance that takes youth safety seriously without sacrificing autonomy, privacy, and access. This means acknowledging that some of the most powerful interventions might not be legal at all, but educational. A study of digital literacy instruction across American ninth-grade classrooms found significant improvement in students’ ability to evaluable the credibility of online information, demonstrating the potential of teaching discernment. Such programs can teach students to navigate algorithms critically, and school policies that treat online life as part of civic education rather than a separate threat.
KOSA asks Americans to trust that broad, undefined obligations enforced unevenly across the fifty states will somehow deliver a safer internet for kids. The better question is whether we are willing to do the hard work of listening to young people, studying what actually helps, and crafting narrowly tailored, adaptive rules to protect them. If we care about freedom in tandem with safety, laws like KOSA are warning signs, not solutions. Protecting young people online requires building institutions and policies capable of protecting them without stripping away the autonomy our laws claim to protect.
