The U.S. Senate seized upon years of increasing momentum for children's privacy and online safety reform with passage of the Kids Online Safety and Privacy Act. The bipartisan bill, which received a 91-3 vote in the Senate 30 July, combines the proposed Kids Online Safety Act, the Children and Teen's Online Privacy Protection Act, and the Filter Bubble Transparency Act.
Each piece of legislation sets out to accomplish online safety goals for different age ranges. COPPA 2.0 covers children under age 17 while KOSA applies to children under 13.
COPPA 2.0 and KOSA may prove to be the most impactful to consumers and businesses alike if the U.S. House can pass the proposed package before the end of the year.
"Young people will take back their online lives. Parents will have tools to safeguard those young people," U.S. Sen. Richard Blumenthal, D-Conn., said in a press conference after the vote. "We are on the cusp of a new era. It is an era of accountability for Big Tech. The first major significant legislation in almost three decades.
"No longer will we rely on Big Tech when it says 'trust us.' They betrayed that trust," he added.
The COPPA 2.0 aims to revise and modernize the Children's Online Privacy Protection Act of 1998. The updates provided under COPPA 2.0 include bans on targeted advertising and nonconsensual data collection of minors 13-16, a revised "actual knowledge" standard for website visits, and a data deletion mechanism.
The KOSA raises requirements for privacy-by-default standards, opt-outs of personalized algorithmic recommendations, parental controls over children's online activities and risk audits.
The FBTA establishes requirements for large online platforms that use algorithms applying artificial intelligence or machine learning to user-specific data to determine the manner in which content is displayed to users
Despite the work on the KOSPA package over multiple years, the full groundswell of support only revealed itself in recent months. The Senate majority that voted to pass COPPA 2.0 and KOSA committed to the package in February and April. Along with lawmaker support came the backing of stakeholders ranging from industry players Snap, Microsoft and the social platform X to entities across civil society.
Co-sponsors of both the COPPA 2.0 and KOSA indicated the focus of these bills were to prevent and mitigate the increasing risks the internet is posing to children and teen's mental health via perceived exploitation and deceptive practices.
"This is Congress being at its best and responsive both to a societal need and those of individuals," Sen. Bill Cassidy, R-La., said at the presser.
The impacts
With the COPPA 2.0, it will first boil down to covered entities examining whether their COPPA compliance needs to be altered for a new age range.
"This is, if you will, the interval update," Cassidy said, referencing the time lapse between COPPA enhancements. "Taking that age of protection to from less than 13 up to (under) 17. Why? Because back (in 1998) we didn't have everything penetrating into the person's mind without parents having the access to what they were seeing."
Sen. Ed Markey, D-Mass., led the drafting of the original COPPA framework in 1998. His efforts with Cassidy on this modernization focused on data minimization principles that can be found in U.S. state privacy law and Congress' latest attempt at comprehensive privacy legislation, the proposed American Privacy Rights Act.
"COPPA 2.0 just says no. It's no to targeting the kids and no to gathering information in the first place," Markey said. "That data is the oxygen for these social media companies to be able to target these kids and it must end."
Besides the increased coverage, the actual knowledge adjustment may prove most impactful to businesses. A prior loophole in the COPPA allowed companies to escape alleged violations for knowingly engaging with covered minors on their website.
Addressing that workaround in the COPPA 2.0 may prove to be the linchpin to sweeping changes to data collection practices, according to Fairplay Policy Counsel Haley Hinkle.
"We know that online platforms use massive amounts of data to estimate user age and target advertisements and content," Hinkle told the IAPP. "Tech companies make very clear to advertisers and partners that they have sophisticated targeting capabilities. This new knowledge standard will allow enforcers to hold the platforms responsible for what they already know about user ages. As for age verification, the legislation is clear that it does not require an age verification regime."
House uncertainty
Senate passage was the easiest part of legislative equation for the KOSPA. While the Senate showed a clear appetite for this particular children's online safety package, the House is in a different place.
House lawmakers have spent the majority of the year grappling with comprehensive privacy legislation, which includes its own version of the COPPA 2.0 that may ultimately differ from the one passed by Senate. The House is also considering the KOSA separately and debate regarding a bipartisan framework is ongoing.
The House Committee on Energy and Commerce was set to vote on the APRA and the KOSA in June before disagreements across the aisle and among House Republicans over the comprehensive privacy bill forced the cancellation of a planned markup. House lawmakers, now in recess until September with a general election looming in November, have not indicated next steps for either the APRA or the KOSA since the canceled markup.
However, House Speaker Mike Johnson, R-La., issued a statement to CNBC offering a window into his potential preferences on the path forward, which likely focus more on the Senate package than what the House was previously considering.
"I love the idea behind them," Johnson said of the Senate's COPPA 2.0 and KOSA bills. "I am looking forward to reviewing the details of the legislation that comes out of the Senate. It is time for Americans to have greater control over their privacy online, especially for the safety of our children.
"I am committed to working to build consensus in the House," Johnson added.
Talk of consensus comes after Johnson himself reportedly threatened to prevent the House's APRA proposal, and subsequently the COPPA 2.0, from reaching a floor vote if it emerged from the Energy and Commerce Committee.
Meanwhile, the White House is firmly behind getting the KOSPA package to the finish line.
President Joe Biden made several calls for Congress to address children's online privacy and safety, including specific remarks in three State of the Union addresses.
"We need action by Congress to protect our kids online and hold Big Tech accountable for the national experiment they are running on our children for profit," Biden said in a statement. "Our kids have been waiting too long for the safety and privacy protections they deserve and which this bill would provide. This is more important than ever with the growing use of AI."
Vice President Kamala Harris, the presumptive 2024 Democratic presidential nominee, also made clear her support of the KOSPA.
"I applaud the Senate for passing the Kids Online Safety and Privacy Act today. This bipartisan legislation will help protect children's mental health, safety, and privacy online," Harris posted on X. "I have spent my entire career fighting for the wellbeing of children, and I urge Congress to pass this bill as we continue to invest in our children and their health."
Joe Duball is the news editor for the IAPP.
