The epistemological mismatch of KOSA’s constructive knowledge standard

The Senate Commerce Committee has scheduled a markup on Wednesday for several online child safety bills, including the Kids Online Safety Act (S. 1748), Youth AI Privacy Act (S. 4199), CHATBOT Act (S. 4407), and the SCREEN Act (S. 737).

The centerpiece of the markup is Sen. Marsha Blackburn’s (R-TN) Kids Online Safety Act (KOSA), which would impose a “duty of care” on platforms to ensure certain design features don’t contribute to harms like eating disorders or compulsive use among minors. The duty of care obligations would kick in when a platform has actual knowledge or “knowledge fairly implied on the basis of objective circumstances” indicating that a user is under the age of 17.

This vague constructive knowledge standard represents a new regulatory phenomenon in kids’ online safety and is also present in Sen. Ed Markey’s (D-MA) Youth AI Privacy Act and Sens. Ted Cruz (R-TX) and Brian Schatz’s (D-HI) Children’s Health, Advancement, Trust, Boundaries, and Oversight in Technology (CHATBOT) Act. Although the text of all three bills claims that age verification by way of collecting government IDs will not be mandated, fear of falling out of compliance will likely leave companies with no other choice.  

The language “knowledge fairly implied on the basis of objective circumstances” is lifted from a Federal Trade Commission (FTC) Act provision governing unfair or deceptive acts or practices (15 U.S.C. 45(m)(1)(A)), which states,

The Commission may commence a civil action to recover a civil penalty in a district court of the United States against any person, partnership, or corporation which violates any rule under this subchapter respecting unfair or deceptive acts or practices . . . with actual knowledge or knowledge fairly implied on the basis of objective circumstances that such act is unfair or deceptive and is prohibited by such rule. (emphasis added)

This knowledge standard, as used in the FTC Act, requires companies to make a deductive or compliance-based judgment by applying known legal rules to known corporate actions, like evaluating whether a marketing claim is false or misleading. When applied to age determination, however, the judgment is essentially reversed. Companies must make an inductive or probabilistic judgment by inferring unknown facts about users from digital signals like gaming habits or active hours. It’s an epistemological mismatch that transplants an FTC Act trade practice rule standard onto age inferences.

This not only creates uncertainty for companies as to whether they are following the law, but it also ensures that there will be false negatives and false positives, as some adult users will be flagged as minors while some underage users will be mistaken for adults.

The risk will likely be so high that companies have little choice but to verify age using government IDs, regardless of the stipulations in the bills saying that age verification is not required. The bills create “de-facto age verification requirements” that raise significant First Amendment concerns, according to Ben Sperry, senior scholar and lead counsel at the International Center for Law & Economics. For the Senate version of KOSA, with its expansive “duty of care” obligations, companies may see banning all kids from their platforms as their only option for fear of liability.

Ultimately, while Congress is aiming to protect young users online, the reliance on this ill-fitted knowledge standard presents what will likely be an impossible legal dilemma. Whether companies are forced to engage in age estimation, assurance, or verification, these mandates will prove ineffective at achieving their primary objective. And they will trigger even worse second-order effects for user privacy and free expression.