Congress Overreaches with the KIDS Act

Given the growing sense of urgency that Congress finally needs to do something to address the safety of children and teens online, the U.S. House of Representatives has passed a cobbled-together package of legislation dubbed the Kids and Internet Digital Safety (KIDS) Act. While this conglomeration contains some proposals that on their own would be praiseworthy, taken as a whole it represents a huge government overreach into online platform design that is likely to degrade platform usefulness and free speech for all internet users, while doing little to actually protect minors. The House is trying to solve the complex issue of youth safety online, but its approach to addressing it will create unintended consequences and exacerbate existing ones by imposing a sweeping and vague set of regulations that will require companies to collect more data, and therefore, compromise individual freedoms and create additional safety risks.

The KIDS Act is an omnibus bill that combines portions of nearly a dozen smaller bills. These include (among others) the Keeping Online Abuse to a Reasonable Experience (KOSA) Act, the Stop Enabling Sex Traffickers Act (SESTA), the Allow States and Victims to Fight Online Sex Trafficking Act (FOSTA), the Children's Online Privacy Protection Act (COPPA), the Safe Social Media Act, the Assessing Safety Tools for Parents and Minors Act, and the study on chatbots and mental health of minors. To the credit of House Republicans who have been working on this bill for some time, the amended version of KOSA omits its unworkable 'duty of care' provision that would have forced platforms to take down a great deal of constitutionally protected speech. However, this is still a watered down bill that has more flaws than fixes to address online youth safety concerns.

This amended version of the bill, however, contains a mandate on platform design, requiring that covered sites default to whatever settings provide 'the most protective level of control with respect to privacy and safety'. This would require sites to disable features like endless scrolling, personalized recommendations, autoplay, and direct messaging by default for anyone the platform 'knows or should have known' is a minor. This knowledge standard is a low bar for holding sites liable, and therefore many covered platforms will be confronted with the option of either: 1) implementing these safeguards for all users, thereby making their platforms less useful by default, or 2) enacting some form of age verification in order to separate or exclude minors. The fact that the revised KOSA contains a clause clarifying that it does not require age verification is likely to be rendered moot by the realities of compliance.

Other components of the KIDS Act complicate this further. For example, the revisions it contains to the COPPA raise the age of minors protected under that long-standing law from 13 to 16, while making compliance with the law's protections on data collection more confusing. As a letter by the Electronic Frontier Foundation (EFF) correctly inquires, 'How does a site comply with a law that says not to collect personal information on specific ages of users without knowing anything about the age of its users?' The likely answer, they conclude, is that 'litigation-averse companies are likely to implement some kind of age-verification process to avoid running afoul of the law.' The Federal Trade Commission (FTC) has already pushed in this direction by issuing a policy statement that encourages companies to adopt age verification in return for less scrutiny by the FTC. This creates a chicken-and-egg problem where companies might be forced to implement age verification just to comply with existing laws, rather than the actual intent of the lawmakers to protect minors online.

The SAFE BOTS Act places similar pressure for artificial intelligence (AI) chatbot providers to use age verification to restrict access to their products. Similarly, under the GAMING Act, video game platforms would be forced to ban communications with other users by default for anyone they 'know or should have known' to be a minor, incentivizing age verification for access to those services as well. Even if the FTC were to allow platforms to merely estimate, rather than truly verify, the age of their users, platforms which do not already collect enough data to make a solid estimate of the age of an individual user would be forced to do so, or skip straight to more intrusive verification methods like facial scans or documentary verification instead. As a result, this means that users could be forced to undergo additional steps to log in to their accounts or participate in online discourse, which could result in widespread age segregation online.

Moreover, some of the bill's components also raise further questions. The revisions to the Children's Online Privacy Protection Act (COPPA) could have unintended consequences on data collection. How does a site comply with a law that says not to collect personal information on specific ages of users without knowing anything about the age of its users? If companies are to implement these changes without any clear understanding or guidance on how to implement these amendments, they are likely to be faced with a myriad of legal questions and potential legal liability for violating provisions. In turn, we may see a wave of unnecessary litigation against companies that don't adhere to these new regulations.

Fortunately, the bill does contain some beneficial provisions including several study proposals. The government will be acquiring data to help Congress make better informed decisions about how to improve youth safety online. For instance, the Safe Social Media Act, the Assessing Safety Tools for Parents and Minors Act, and the study on 'chatbots and the mental health of minors' are designed to help address and study these issues in a more constructive and less destructive manner. The government can also play a role in empowering both parents and minors through educational materials and campaigns as proposed in the included Promoting a Safe Internet for Minors Act and the AI Resources for Education (AWARE) Act. This educational approach focuses on educating both children and parents on how to navigate the online world safely.

The tools that parents need to limit their children's access to social media, AI chatbots, video games, and the internet in general already exist and are easy to access and use. A top-down government mandate to redesign all these products to duplicate online safety tools that the market has already provided would be an unnecessary and likely unconstitutional government intrusion into online free speech. Congress can salvage the portions of the KIDS Act that are consistent with these principles and scrap the rest. It is essential for lawmakers to prioritize caution, careful consideration, and thoughtful debate before enacting a bill that could have far-reaching implications.