KOSA (and Children’s Privacy) on the Move

The Kids Online Safety Act (KOSA) is gaining traction in the U.S. Senate after the most recent round of revisions were released this month by Senators Richard Blumenthal and Marsha Blackburn. This follows on the heels of proposed changes to the Children’s Online Privacy Protection Act (COPPA) Rule being released at the end of last year. 

Both the proposed changes to the COPPA Rule and these new revisions to KOSA, which intends to create guidelines for the protection of children under 17 on social media platforms, are making waves in conversations about how to best protect children’s privacy in a digital-first age, and BBB National Programs’ Children’s Advertising Review Unit (CARU) is paying close attention. 

Here are some high-level takeaways from the KOSA revisions, summarizing the changes and sharing some CARU insight into each revision.

Changing Definitions

The revised draft incorporates a new definition of “Design Feature,” which limits KOSA’s applicability to only features or components of a covered platform that will encourage or increase the frequency, time spent, or activity of minors on the covered platform. KOSA specifically lists the following features: 

1. Infinite auto play; 
2. Rewards for time spent on the platform;
3. Notifications;
4. Personalized recommendation systems;
5. In-game purchases; and
6. Appearance altering filters.

The revision did not change the knowledge standard governing a platform’s obligations when it knows a user is a minor. “Know or knows” is defined as “actual knowledge or knowledge fairly implied on the basis of objective circumstances,” a definition that may inadvertently discourage companies from collecting or inferring data that may be beneficial in protecting children, since it is broader than the “actual knowledge” standard outlined in COPPA. However, it is more concrete than “knows or reasonably should know,” which is more ambiguous and subjective. 

Further, lawmakers are requiring the FTC to provide guidance to covered platforms on when the FTC believes “knowledge fairly implied on the basis of objective circumstances” would apply.

Otherwise, the definitions are better aligned with COPPA. “Parent” and “Personal Data,” for example, reference COPPA directly.

Covered Platforms

Covered platforms are now required to exercise “reasonable care” in the creation and implementation of any design features. Reasonable care has been litigated in other contexts and is generally defined (in tort law) as “the level of care that a reasonable person would exercise in similar circumstances.” This change removes the requirement that covered platforms “know or reasonably should know” their platforms are used by minors.

Covered platforms now must also generally restrict the sharing of geolocation of a minor. Previously, KOSA only restricted sharing the geolocation of a minor with other users on the platform. This change is in line with recent FTC cases and other legislative, post-Dobbs activity protecting location data. 

Regarding existing accounts on covered platforms, lawmakers created a carve-out allowing for no changes to parental tools if a covered platform provided parental tools that would otherwise comply with the parental tools section, and the parent opted out of enabling such tools. Although this likely makes it easier for covered platforms to comply with KOSA (given the high cost to making design changes and notifying parents of those changes to existing accounts), this carve-out puts the onus on parents to opt in to parental tools.

Also worth noting is that lawmakers have curtailed a Department of Commerce-led independent research provision found in previous KOSA drafts. However, Congress would now direct the FTC to conduct 6(b) studies of covered platforms, working with the National Academy of Sciences and the Department of Health and Human Services, to publish no fewer than five comprehensive studies addressing the relationship between online platforms and mental health outcomes, substance abuse, sexual exploitation, and addictive behaviors. 

Reflecting civil society concerns about politically motivated enforcement of KOSA, lawmakers have proposed rescinding the power of state Attorneys General to prosecute covered platforms for not complying with the “duty of care” provision (Section 102 of the Act). State AGs would still retain authority to enforce sections 103, 104, and 105, as in previous drafts.

Communications & Research

In the world of notifications, KOSA’s novel disclosure and parental notification requirements have been revised to better harmonize with parental notice and verifiable consent requirements under COPPA.

In communicating consent, lawmakers are requiring the FTC and Department of Commerce to conduct market research to provide a standard consent form in English and the top five non-English languages used in the US. The top five non-English languages requirement is a new limitation; the prior language required informed consent “in the language the parent uses.” 

The push for more research in this area indicates that lawmakers believe we need more information on the impact covered platforms have on minor’s safety and the best ways to mitigate any harmful effects, including the impact on mental health, addiction, bullying/harassment, sexual exploitation, the marketing of narcotic drugs, and deceptive marketing.

Streaming Services

Lawmakers added a section outlining when KOSA applies to video streaming services. KOSA will not apply to video streaming services that predominantly consist of news, sports, entertainment, or other programming that is preselected by the provider. KOSA would apply, however, to video streaming services that host user-generated content.

Patchwork of U.S. Laws

KOSA would preempt any state laws, rules, or regulations that directly conflict with a provision of KOSA; however, nothing in KOSA should prohibit a state from enacting a law, rule, or regulation that provides greater protections to minors. Indeed, KOSA will act as a floor for minors’ online safety provisions in the states.

These revisions to KOSA demonstrate that there is still work to be done to identify the right blend of hard and soft law to protect children in an online environment. Due to our 50 years of leadership in the children’s space, including helping craft the privacy soft law that led to the development of COPPA in the 1990s, CARU takes great pride in supporting responsible businesses who choose to participate in our COPPA Safe Harbor Program, and we welcome other companies operating in the children’s space to join us.