US Senate Commerce approves KOSA, children's AI safety bills

Members of the U.S. Senate Committee on Commerce, Science and Transportation voted to advance a slate of children's online privacy legislation, including the Kids Online Safety Act and several bills promoting children's privacy with respect to artificial intelligence, during a 5 Aug. markup session. 

Beyond KOSA, senators also advanced the Youth AI Privacy Act, Children's Health, Advancement, Trust, Boundaries, and Oversight in Technology Act and the Children's Artificial Intelligence Toy Safety Act. 

"Almost all parents today struggle (with) permitting their children to use and benefit from new technology," said U.S. Sen. Ted Cruz, R-Texas, the committee chairman. "The bills before us are meant to give parents more control and assurance that their vulnerable children won't be exposed to the worst possible elements of social media and AI chatbots."

KOSA moves again

The new version of KOSA, which was passed by the Senate in the prior Congress 91-3, would impose a duty of care requirement on technology companies. The bill also mandates social media companies limit addictive design features and set protective default settings for minor users. 

Prior to the vote, U.S. Sen. Daniel Sullivan, R-Alaska, considered adding an amendment to KOSA that would have included the Advancing Digital Support for Mental Health Services Act, requiring digital platforms to disclose the volume of public service advertisements published on their websites to the Federal Trade Commission. However, Sullivan ultimately withdrew it to ensure KOSA could pass as "a clean bill."

KOSA "imposes a duty of care requirement on social media platforms, so that these companies have to take reasonable care to make sure they're not creating harm, and implementing products that harm kids," Senate Commerce Ranking Member Maria Cantwell, D-Wash., said. "We need more responsibility from social media companies and KOSA gives parents the tools that help make them accountable when they prioritize engagement over keeping our kids safe."

Several major advocacy groups came out on opposite sides of the KOSA vote, with Fairplay touting the measure's passage. Executive Director Josh Golin said, "By imposing a duty of care on online platforms, KOSA would be the most important new law to protect children online in nearly 30 years."

The Electronic Frontier Foundation and NetChoice both oppose KOSA.

In a statement, the EFF said the duty of care requirement represents a major step toward requiring age verification to access online services. 

KOSA is "not a bill that increases privacy — it's one that creates new privacy problems," the statement reads. "Whether companies verify ages by checking government IDs, performing facial analysis, checking your bank records, or collecting other personal information, all of these systems require the handing over of more sensitive data, simply to access lawful online speech and services."

Tackling AI privacy

The Youth AI Privacy Act, CHATBOT Act and the Children's Artificial Intelligence Toy Safety Act each passed with voice votes. 

The CHATBOT Act would require AI chatbot providers to allow for the creation of family accounts and verifiable parental consent for minors to use the service. The Children's Artificial Intelligence Toy Safety Act would direct the National Academies of Sciences, Engineering and Medicine to lead a study on the impacts of embedding AI into children's toys. 

Before the YAIP Act vote, Cruz moved to add an amendment that proposes eliminating the bill's 30-day maximum retention period for a chatbot to recall interactions with a child user and an automatic deletion by default clause.

Cruz's amendment ultimately passed 15-13 along party lines. 

"The bill proposes a one-size fits all limit on how long a chatbot may remember its interactions with a child (by) capping overall memory protection at 30 days," Cruz said. "A default period for memory retention makes sense, but parents must also be able to choose a different period or opt out of automatic deletion. Long-term memory can make these tools more useful in certain circumstances."

U.S. Sen. Ed Markey, D-Mass., the YAIP Act sponsor, said he opposed Cruz's amendment, but was willing to allow for up to a 30-day extension of a chatbot's memory retention period. He also agreed to drop a provision that would have required the FTC to engage in rulemaking under the law. 

"The Youth AI Privacy Act, as originally introduced, directed the Federal Trade Commission to establish limits on how long an AI chatbot could use a minor's personal data to shape its responses," Markey said. "Those limits prevent a chatbot from endless drawing on a child's responses to personalized future conversations. The extended, highly personalized interactions, can deepen a child's emotional attachment to a chatbot and make safeguards less effective."

U.S. Sen. Marsha Blackburn, R-Tenn., said the overall package of bills passed during the hearing sends a "message to Big Tech that the era of profiting off our children is over."

"Congress is moving forward to make certain that (technology companies) have to accept responsibility for the foreseeable harms that their products cause," Blackburn said. "We have arrived at a time where we are going to pass this legislation. We are going to get it signed into law, and we will do it in spite of all the money that they have spent opposing this legislation."