KOSA Bill Is A Data Collection Trojan Horse! (S. 1748)
How’s it going, everybody? Welcome back. Today, let’s talk about the Kids Online Safety Act (KOSA), also known as S. 1748, a bill introduced by Senator Marsha Blackburn, a Republican out of Tennessee. My goal here is to give you a clear picture of what this bill will actually do if passed and enforced — and I promise you, it’s not what you think.
On the surface, this bill looks like it’s designed to protect our children from harmful online content. But underneath that shiny exterior lies a completely different reality, one that could open the floodgates to a level of data collection and surveillance most people wouldn’t be comfortable with. Let’s break it down.
What KOSA Claims To Do
On paper, the bill looks like it does a lot of good. It’s aimed at restricting certain types of content from being shown to children on platforms like Facebook, Instagram, TikTok, YouTube, and other social media or content delivery platforms. We’re talking about a broad range of content — everything from pornography to material promoting eating disorders (like extreme weight loss tips or “thinspiration” content).
In addition to content restrictions, the bill includes provisions requiring these platforms to default to the most restrictive settings possible whenever they determine that a user is a child. In other words, if you install Instagram and the platform believes the user is a minor, it would automatically switch on the strictest privacy and content settings available for that account. We’ll come back to that word “believes” in a minute, because it’s the crux of the whole issue.
Why This Sounds Good… At First
Honestly, I don’t know if I’m fully for or against these particular provisions. As a parent, my approach has always been to teach my kids what kind of material is inappropriate and to make sure they feel comfortable coming to me if something questionable pops up on their screen. My kids know they won’t be punished for telling me, “Hey Dad, this showed up and it’s not okay.” That opens the door for me to take action without them feeling like they need to hide things from me.
I also believe parents need to take a proactive approach rather than relying entirely on legislation or big tech to police content. For example, I personally use Google Family Link, a free parental control app from Google that lets parents manage their children’s devices remotely. With it, I can:
- Control and limit screen time
- Disable the phone entirely if needed
- Remotely reset the device
- Get notified when new apps are installed
- Require my approval before any app can be installed
- Review an app’s description and permissions (including what data it collects) before approving it
I actually use this as a teaching tool. I show my kids how to check an app’s data collection practices before they even ask me to approve it. Empowering kids with this kind of knowledge is, in my opinion, far more effective than any government bill could ever be — because let’s be honest, kids are smart. They will find workarounds for almost anything a bill like this tries to enforce.
The Real Problem: “Knew or Should Have Known”
Now let’s get into why this bill could actually backfire in a big way. KOSA operates on a “knew or should have known” standard. This means platforms can be held legally liable if they should have known a user was a minor, even if they didn’t explicitly know it.
Here’s an example to illustrate the problem. Let’s say a 13-year-old is using Instagram, and the platform serves up an inappropriate ad — maybe something for an adult product, a dating site, or some other content clearly not meant for children. If the parent finds out, they could sue the platform, claiming Instagram “should have known” the user was a minor and failed to protect them accordingly.
This is where things get messy. The bill doesn’t explicitly require platforms to verify a user’s age through any specific method. It simply says platforms are liable if they don’t make a “best effort” to determine the user’s age. And that vague requirement is exactly what opens the door to the real problem: mass data collection as a legal shield.
How Platforms Will Respond: More Data, Not Less
Since the bill doesn’t specify how platforms should verify age, and only requires a “best effort,” these companies are going to do exactly what any liability-conscious business would do: collect as much data as possible to build a profile that helps them guess a user’s age with reasonable confidence.
And this data collection won’t stop at the platform level. It will extend to the device itself. Let’s use TikTok as an example, since it’s a great illustration of how deep this could go. Once installed on your phone, depending on the permissions it requests (and depending on your device’s security settings), an app like TikTok could potentially access:
- Text messages
- GPS location data
- Call logs (who you’re calling and when)
- Photos stored on your device
- Browsing history and other app usage patterns
Why would they need all this? Because under KOSA’s “should have known” standard, platforms now have an internal incentive to gather as much evidence as possible to prove they made a genuine effort to determine a user’s age. That could mean scanning your photo library for selfies to estimate age, analyzing text messages or private conversations for language patterns typical of minors, or tracking whether you’re visiting educational websites versus other types of content.
In essence, this creates a justification for platforms to intercept and analyze incredibly personal data, all under the guise of “child safety compliance.”
A Bill Too Broad For Its Own Good
The core issue here is that the bill is far too vague and broad. It doesn’t lay out a clear, standardized process for verifying age — something like requiring a parent to input a child’s age during device setup, or a simple, transparent age verification step during account creation. Instead, it just says platforms can be held liable if they didn’t try hard enough to figure it out.
Because of that ambiguity, platforms are incentivized to err on the side of over-collection. It’s a classic case of good intentions paving the way for a much bigger, unintended consequence: a massive expansion of surveillance, both at the platform level and the device level.
Final Thoughts
So, to sum it all up: KOSA looks great on the surface. It claims to restrict harmful content and push default privacy settings for young users. But when you dig into the actual mechanics of the bill — specifically the “knew or should have known” liability standard — you realize it’s essentially handing platforms a green light to collect as much personal data as possible, just to cover themselves legally.
This bill, as written, risks becoming a Trojan horse for a massive expansion of data collection and surveillance, all under the banner of protecting children. And ironically, the people most affected won’t just be kids — it’ll be every single user on these platforms, since this data collection won’t be selective.
That’s it for this one, folks. Thanks for watching, and I’ll see you in the next video.
