The House of Representatives is days away from voting on the Kids Internet and Digital Safety Act — a 115-page package that bundles more than a dozen child safety bills into a single legislative vehicle. At its center is a revised version of the Kids Online Safety Act (KOSA), rewritten to drop an explicit "duty of care" while adding a knowledge-based liability trigger that applies whenever a platform "knows or should have known" a user is under 13, or between 13 and 16. The result is a bill that technically disclaims mandatory age verification while making it the only commercially viable response.
The Case Legislators Are Making
Before analyzing the legislation's structural flaws, it's worth naming what is driving it. More than 93 percent of American teenagers use at least one social media platform, according to Pew Research Center data from December 2024, and nearly half say they are online almost constantly. The harms legislators are responding to are real: algorithmic amplification of eating-disorder content, fentanyl sales conducted through direct messages, and correlational research linking heavy social media use to depression and anxiety among adolescent girls. The impulse to give parents better tools and require platforms to treat minors differently from adults is not irrational — and bipartisan compromise from House Energy and Commerce Committee Chairman Brett Guthrie (R-Ky.) and Ranking Member Frank Pallone Jr. (D-N.J.) reflects genuine pressure from both parties to act.
What the 'Should Have Known' Standard Actually Requires
The problem is not the goal but the mechanism. The KIDS Act's liability trigger — "knows or should have known" — is a negligence standard borrowed from tort law. Under it, a platform that fails to apply mandatory safety settings to a 15-year-old bears legal exposure even if that teenager claimed to be 25 when signing up. The only way a platform can plausibly demonstrate it did not "should have known" something is to verify, systematically and in advance, who its users actually are.
The Electronic Frontier Foundation identified this consequence directly in its June 2026 analysis: special protections, messaging limits, algorithm restrictions, and parental controls are required for covered users whenever this knowledge threshold is met, incentivizing platforms to deploy driver's license checks, passport scans, or AI-based age-estimation systems across their entire user base — not just for minors. The verification falls on everyone because the only way to identify a 15-year-old is to examine every account.
The Verification Cascade
This outcome is not incidental — it is structural. The KIDS Act creates three distinct compliance tiers: under-13, 13-16, and over-16 users each face different default settings, parental-control obligations, and algorithmic restrictions. A platform cannot apply those tiers without knowing which category each user falls into. The result is a legally mandated classification of every user by age, maintained continuously, in order to manage negligence exposure.
Age-estimation technology is the most likely deployed tool, but EFF has noted these systems "fail more frequently for people of color, people with disabilities, and trans and nonbinary people" — compounding the civil liberties cost and raising equal protection questions beyond the First Amendment. An ID checkpoint at the door of the internet is a significant architectural change to a medium that has historically permitted anonymous and pseudonymous participation as a civil liberties feature, not a bug.
What FSC v. Paxton Does and Does Not Settle
Courts will be the ultimate test of this structure. The Supreme Court's June 2025 ruling in Free Speech Coalition v. Paxton upheld a Texas law requiring age verification for sexually explicit content, applying intermediate scrutiny on the grounds that such requirements only "incidentally burden" adults' protected speech while regulating obscene-for-minors material that states have long had authority to restrict.
But Justice Thomas's majority opinion was explicit about its limits. FSC v. Paxton applied to content minors have no First Amendment right to access. The KIDS Act targets general social media platforms involving fully protected expression — discussions of harm reduction, mental health, addiction recovery, and political speech that the government cannot constitutionally restrict for adults. Whether intermediate scrutiny extends to age-gating protected speech, rather than obscene content, is a question FSC v. Paxton deliberately left open. The ongoing NetChoice v. Fitch challenge to Mississippi's broader social-media age-verification law is the more directly applicable test case, and that litigation has yet to reach the Supreme Court.
Encryption and the Unlabeled Speech Problem
The bill's treatment of private communications adds another dimension. The KIDS Act contains a carve-out stating that its messaging restrictions "shall not override any protection for an encrypted communication." But that carve-out does not extend to KOSA's core requirement that platforms "address" a list of harms — including drug discussions, gambling, and financial fraud — occurring in private messages. The bill never explains how a platform is supposed to address harms inside encrypted messages it cannot read, creating pressure to restrict private messaging features for users in covered age tiers or to weaken encryption itself.
Senate Friction and the Preemption Problem
The bill's path forward is contested. Senate KOSA co-sponsors including Senators Maria Cantwell and Richard Blumenthal have declared the House version unacceptable, arguing that removing the duty-of-care provision installs a weak knowledge standard that functions as a liability shield for large platforms. In the House Energy and Commerce Committee, Democrats voted 28-24 against advancing the package, with Pallone objecting to a state preemption clause that would block states from passing stronger laws and undercut existing litigation against Meta, Roblox, and other platforms.
The preemption concern is substantive. California, Texas, and Florida have passed minor-protection requirements stronger than what the KIDS Act imposes federally. Legislation that preempts those laws while substituting a weaker standard is a net reduction in enforcement, not an upgrade.
What Proportionate Looks Like
None of this means Congress should do nothing. Targeted obligations — requiring platforms to set default algorithm restrictions for verified minors, improving transparency about engagement design targeting children, and expanding FTC enforcement authority over deceptive patterns — can protect minors without converting every adult's online experience into a document check. The KIDS Act's data broker registry, requiring annual FTC registration and public disclosure at a minimum $22,500 fee, is a comparatively proportionate accountability measure that does not require platform-wide surveillance.
The KIDS Act represents Congress taking seriously a problem worth taking seriously. But the "should have known" liability trigger is a structural choice with consequences its drafters have not fully confronted: it creates universal age verification without saying so, applies content-moderation pressure to lawful speech, and raises First Amendment questions that the Supreme Court's 2025 Paxton ruling did not answer. Proportionate regulation of how platforms treat children online is achievable. This particular mechanism is not the path there.