Kid’s privacy bills passed by US Senate; House path unclear

The U.S. Senate overwhelmingly passed in a decisive 93 to 1 vote two landmark bipartisan bills that represent the first major reform of the tech industry since 1998, and which will “make meaningful progress toward reducing the very real risks that children and youth encounter in the online environment today.”

The two bills are the Kids Online Safety and Privacy Act (KOSPA) and the Children’s and Teens Online Protection Act (COPPA 2.0).

Both bills aim to create baseline requirements to hold social media companies accountable for keeping kids safe online, and have the support of more than 240 organizations, including parents, child safety advocates, tech experts, faith leaders, pediatricians, and child psychologists.

KOSPA combines an amended version of COPPA 2.0 and the Kids Online Safety Act (KOSA). The Filter Bubble Transparency Act (FBTA) was also incorporated into the final package of legislation.

COPPA 2.0 covers children under age 17, while KOSA applies to children under 13. COPPA 2.0 revises and modernizes the existing Children’s Online Privacy Protection Act of 1998 and includes the creation of a centralized mechanism for individuals to request that data brokers delete their personal information, puts restraints on targeted advertising and nonconsensual data collection of minors 13-16, and a revised “actual knowledge” standard for website visits.

KOSPA, on the other hand, raises requirements for privacy-by-default standards, opt-outs of personalized algorithmic recommendations, parental controls over children’s online activities, and risk audits.

The FBTA sets forth requirements for large online platforms that use algorithms applying AI or machine learning to user-specific data to determine the way content is displayed to users.

KOSA was first introduced in 2022 as the Kids Online Safety Act by Senators Richard Blumenthal, Democrat, and Marsha Blackburn, a Republican, following reporting by the Wall Street Journal and after five hearings by the Senate Committee on the Judiciary’s Subcommittee on Privacy, Technology, and the Law at which the repeated failures by tech giants to protect kids on their platforms were highlighted. The legislation failed to gain traction, however.

Blumenthal is chairman of the subcommittee. Blackburn is a minority member.

KOSPA requires platforms to enable the strongest privacy settings by default, force platforms to prevent and mitigate specific dangers to minors, provide parents and educators new controls to help protect children, and require independent audits and research into social media companies.

“This legislation is the product of months of bipartisan negotiations and engagement with civil society, with important changes being made to protect speech and to reduce unintended consequences,” said Democratic Senator Ben Cardin, noting that the legislation will “create tools, safeguards, and transparency requirements applicable to social media, social networks, multiplayer online video games, social messaging applications, and video streaming services.”

Similarly, COPPA 2.0 will modernize and strengthen the existing COPPA statute, which instituted basic privacy protections for users under the age of 13, including notice and parental consent requirements.

“Together, these pieces of legislation make meaningful progress toward reducing the very real risks that children and youth encounter in the online environment today,” Cardin said, adding, “we hope the House of Representatives will pass quickly upon their return” from summer recess.

“This moving and historic day marks a major win for our children,” Blumenthal said. “Anyone who doubted whether we’d reach this milestone has never met our advocates – the parents who have lost children and the young people who refused to be treated like big tech piggy banks. We are excited now to work with our champions in the House of Representatives. I am confident that the support of our large, diverse, determined coalition will get this bill across the finish line. It will be the first internet safety reform in nearly three decades – a resounding bipartisan achievement showing democracy still works.”

“The Senate took a crucial bipartisan step forward to make our kids safer online,” said President Joe Biden said in a statement, saying “there is undeniable evidence that social media and other online platforms contribute to our youth mental health crisis. Today our children are subjected to a wild west online and our current laws and regulations are insufficient to prevent this. It is past time to act. While my administration has taken important steps to address the harms of social media and online platforms, we need action by Congress to protect our kids online and hold big tech accountable for the national experiment they are running on our children for profit. This bill answers the call from the Unity Agenda of my first State of the Union Address, when I said it was time to strengthen privacy protections, ban targeted advertising to children, and demand tech companies stop collecting personal data on our children.”

Biden emphasized that “the last time Congress took meaningful action to protect children and teenagers online was in 1998 – before the ubiquity of social media and smartphones. Our kids have been waiting too long for the safety and privacy protections they deserve and which this bill would provide … I encourage the House to send this bill to my desk for signature without delay.”

But despite the diverse and bipartisan support, opponents are just as vociferous.

“Parents need solutions that are legal and meaningful, but [KOSPA] is neither,” said NetChoice Vice President and General Counsel Carl Szabo. He said, “data privacy, cybersecurity, censorship, and constitutional risks remain unaddressed,” and that “lawmakers must recognize that an unconstitutional law will help no one.”

Szabo said “better policy solutions are still available for consideration, including adequately funding law enforcement to appropriately prosecute online predators through the bipartisan Invest in Child Safety Act.”

Ash Johnson, the Information Technology and Innovation Foundation’s senior policy manager, called the legislation “flawed.” She said the “bills will not effectively protect children and will only make the regulatory landscape worse for businesses and consumers. KOSA aims to protect minors on social media platforms from content that is harmful to children, but in so doing opens the door to censorship by the [U.S. Federal Trade Commission], which would have the power to decide what qualifies as harmful, and platforms, which may over-censor content to avoid liability.”

“Meanwhile,” Johnson added, “COPPA 2.0 would build on existing children’s privacy legislation, creating additional protections for teens,” but that it also “includes some provisions that would be overly burdensome to businesses that already comply in good faith with existing children’s privacy laws, such as a ban on targeted advertising to anyone under 17, [and] cutting off revenue for ad-supported online services targeted at teenagers.”

The Electronic Frontier Foundation’s Senior Policy Analyst, Joe Mullin, is equally unimpressed with the legislation. “We can’t rely solely on lawsuits and courts to protect us from the growing wave of anti-speech internet legislation … We need to let the people making the laws know that the public is becoming aware of their censorship plans – and won’t stand for them,” he said.

The American Civil Liberties Union also isn’t supportive. Senior Policy Counsel Jenna Leventoff said the bill “compounds nationwide attacks on young people’s right to learn and access information, on and offline. As state legislatures and school boards across the country impose book bans and classroom censorship laws, the last thing students and parents need is another act of government censorship, deciding which educational resources are appropriate for their families.”

“The House must block this dangerous bill before it’s too late,” she said.

Passage of KOSPA in the House certainly remains … uncertain, and is where the battle could be lost, especially if the legislation isn’t taken up after the August recess before the elections and the end of the current session of Congress in January. Backers and supporters of the bill are hoping that the strong bipartisan vote in the Senate will encourage the House to act.

While “Senate passage was the easiest part of legislative equation for the KOSPA – the Senate showed a clear appetite for this particular children’s online safety package – the House is in a different place,” said the International Association of Privacy Professionals (IAPP).

IAPP said “House lawmakers have spent the majority of the year grappling with comprehensive privacy legislation, which includes its own version of the COPPA 2.0 that may ultimately differ from the one passed by Senate. The House is also considering the KOSA separately and debate regarding a bipartisan framework is ongoing … House lawmakers, now in recess until September with a general election looming in November, have not indicated next steps for either the APRA or the KOSA since the canceled markup.”

House Speaker Mike Johnson told CNBC that he “love[s] the idea behind” the Senate’s COPPA 2.0 and KOSPA bills, and that he is “looking forward to reviewing the details of the [Senate] legislation … It is time for Americans to have greater control over their privacy online, especially for the safety of our children.”

While Johnson signaled that he’s “committed to working to build consensus in the House,” he has not said whether he will bring the legislation to the House floor for a vote.

Johnson reportedly earlier threatened to prevent the American Privacy Rights Act (APRA) bill – and, subsequently COPPA 2.0 – from reaching a floor vote if they were reported out of the House Committee on Energy and Commerce.

The committee’s Subcommittee on Data, Innovation, and Commerce had approved an updated APRA draft on May 23 and sent it to the full committee. A subsequent draft of the bill was circulated on June 20 proceeding a scheduled June 27 markup by the committee. But that meeting was unceremoniously cancelled at the last-minute following stakeholder pushback and Republican disagreement over the June 20 draft.

Article Topics

children  |  COPPA  |  data privacy  |  Kids Online Safety Act (KOSA)  |  legislation  |  social media