Congress Converges on Children's Online Safety as House Passes KIDS Act and Court Revives California Design Code
The House advanced the 12-bill KIDS Act on a party-line vote, the Senate passed COPPA 2.0 unanimously, and the Ninth Circuit revived California's design code, setting up a collision between federal preemption and state enforcement.
Overview
March 2026 may be remembered as the month the United States government stopped debating whether to regulate children’s online experiences and started arguing about how. In the span of a single week, both chambers of Congress advanced competing children’s safety legislation, a federal appeals court revived key provisions of California’s pioneering Age-Appropriate Design Code, and the CEO of a major social media platform called for an outright ban on social media for anyone under 16. The convergence signals that federal legislation is no longer a question of if but of which framework will prevail — and whether the infrastructure required to enforce it will create new risks for the very populations it aims to protect.
The House KIDS Act: Twelve Bills, One Vote, No Bipartisan Consensus
On March 5, the House Energy and Commerce Committee advanced H.R. 7757, the Kids Internet and Digital Safety (KIDS) Act, on a party-line vote of 28 to 24. The package bundles twelve individual measures into a single legislative vehicle, including a revised version of the Kids Online Safety Act (KOSA), provisions requiring AI chatbots to disclose their non-human status to minors and provide crisis hotline resources during conversations about self-harm, and bans on ephemeral messaging features and targeted market research directed at children.
The bill also includes the AI Warnings and Resources for Education (AWARE) Act and the Safeguarding Adolescents From Exploitative BOTs (SAFEBOTs) Act, both authored by Representative Erin Houchin. These provisions reflect growing congressional concern about the intersection of AI chatbots and child safety, a policy area that barely existed when the original KOSA was first introduced in 2022.
But the committee vote exposed a deep partisan rift. Democrats objected to two structural changes that distinguish the House version from the Senate’s bipartisan original. First, the House bill removed the “duty of care” standard — the hallmark provision of the Senate KOSA that would have created a legal obligation for platforms to proactively minimize harm to minors, analogous to safety standards applied to toy manufacturers. In its place, the House version requires companies to maintain “reasonable policies” to address harms like violence and sexual abuse and to submit to annual audits — a shift critics describe as replacing enforceable standards with self-certification.
Second, the KIDS Act contains federal preemption language that could override stronger protections already enacted at the state level. With Virginia, California, Utah, Louisiana, Texas, and Alabama all enforcing or preparing to enforce their own children’s online safety laws, the preemption question is no longer theoretical. Democrats argued the provision would gut a decade of state-level progress in exchange for weaker federal requirements.
The Senate’s Parallel Track: COPPA 2.0 Passes Unanimously
On the same day the House committee voted, the Senate passed COPPA 2.0 by unanimous consent. The bill, sponsored by Senator Edward Markey, extends data protections to children and teens under 17, closing a longstanding gap in the original 1998 law that only covered children under 13. The unanimous vote stands in sharp contrast to the House’s party-line split and underscores that bipartisan agreement on children’s digital privacy remains possible — at least when the legislation focuses on data collection rather than content moderation.
However, the House Energy and Commerce Committee deferred its own markup of COPPA 2.0 during the same session, with Chair Brett Guthrie indicating that bipartisan negotiations were ongoing. The postponement means the two chambers are advancing complementary but structurally different legislative packages with no clear path to reconciliation.
The Ninth Circuit Revives California’s Design Code
One week after the congressional votes, the U.S. Court of Appeals for the Ninth Circuit issued a split ruling on March 12 that narrowed the injunction blocking California’s Age-Appropriate Design Code Act (AADC). The court found that NetChoice — the industry group representing Amazon, Google, Meta, Netflix, and X — was unlikely to succeed in its facial challenge to the law’s age-estimation requirement, reasoning that the provision does not clearly restrict speech because businesses can simply default to child-protective settings for all users.
The ruling allows several key provisions to take effect, including requirements for companies to estimate user ages, strict limits on collecting and sharing minors’ geolocation data, and mandates to configure default settings that provide a “high level of privacy” for minors. However, the court upheld the injunction against certain data-use and dark-patterns restrictions on constitutional vagueness grounds.
The decision is significant beyond California. If the AADC survives further proceedings, it would demonstrate that state-level design code legislation can withstand First Amendment scrutiny — precisely the kind of state regulation the House KIDS Act’s preemption language is designed to override. The tension between federal preemption and judicially validated state laws is likely to become a central point of contention as the KIDS Act moves toward a full House vote.
Age Verification: The Enforcement Bottleneck
All of these legislative and judicial developments converge on a single technical question: how to determine whether a user is a child. The answer, increasingly, is age verification — and the implementation is raising alarms.
Half of U.S. states now mandate some form of age verification for accessing social media or adult content. Virginia’s law, which took effect January 1, limits children under 16 to one hour of daily social media use unless a parent grants additional time. But early enforcement has revealed the gap between legislative intent and technical reality: platforms are complying by displaying pop-up warnings that children can bypass with a single tap labeled “ignore limit for today.”
Meanwhile, the surveillance infrastructure being built to support these mandates is pulling millions of adults into mandatory identity checks. Civil liberties organizations including the ACLU and the Electronic Frontier Foundation have warned that concentrating identity data among a small number of verification vendors creates attractive targets for hackers and government demands. The concern is not hypothetical: Discord disclosed a breach that exposed identity documents belonging to approximately 70,000 users through a compromised third-party verification service.
Colorado lawmakers are considering legislation that would shift verification responsibility to the operating system level, where a device would verify a user’s age once and share an age signal with apps and websites. The approach could reduce repeated identity checks but would embed age verification into the fundamental architecture of personal computing.
Industry Breaks Ranks
The regulatory momentum has begun to fracture the technology industry’s unified opposition. Pinterest CEO Bill Ready published an opinion piece in TIME on March 19 calling on governments worldwide to ban social media for children under 16. “The cost of inaction is a generation of young people overwhelmed by anxiety and depression,” Ready wrote, criticizing engagement-driven design and the incorporation of AI chatbots into platforms used by minors.
Ready’s statement arrived while a trial is underway in Los Angeles in which Google and Meta face allegations that their platforms are fueling a youth mental health crisis. Pinterest itself still allows sign-ups from age 13, but Ready argued the company has stripped social features from younger accounts, making them private by default and walled off from strangers. The distinction between Pinterest’s “inspiration platform” and competitors’ social feeds is central to Ready’s argument — and to the company’s regulatory positioning.
The move echoes a pattern seen in other industries where companies with less exposure to a proposed regulation publicly support it as a competitive weapon against larger rivals. Whether Pinterest’s support for an under-16 ban reflects genuine concern or strategic positioning, it signals that the industry’s previously monolithic stance against regulation is cracking.
What Comes Next
The legislative landscape is now shaped by at least four simultaneous forces: the House KIDS Act heading to a floor vote with its weakened duty of care and federal preemption; the Senate’s bipartisan COPPA 2.0 awaiting House action; the Ninth Circuit’s validation of state-level design codes; and a patchwork of state laws that are already being enforced with varying degrees of effectiveness.
The most consequential unresolved question is whether federal legislation will preempt state laws. If the KIDS Act passes with its current preemption language, it would replace what California, Virginia, and other states have built over the past several years with a framework that critics view as weaker. If COPPA 2.0 advances instead, it would layer new federal data protections on top of existing state regimes without displacing them.
The April 22 deadline for the FTC’s expanded COPPA rules adds another variable. Companies are preparing to comply with stricter data retention limits, expanded definitions of personal information, and new security mandates — while simultaneously lobbying Congress for a federal framework that may supersede those very requirements.
For the children these laws aim to protect, the irony is that the current regulatory landscape may be creating the worst of both outcomes: age verification systems that are easily circumvented by minors but that effectively surveil the adults around them.