On June 29, 2026, the US House of Representatives did something it had never done before: it voted, as a full chamber, on a children’s online safety bill. The Kids Internet and Digital Safety Act — the KIDS Act, H.R. 7757 — passed 267–117 with bipartisan support and now heads to the Senate.
For two years, this conversation lived in subcommittee markups and competing draft bills. We covered that earlier stage when KOSA, an earlier KIDS Act draft, and COPPA 2.0 were all moving in parallel and nobody could say which would survive. That ambiguity is now mostly resolved on the House side. The bill that actually passed is a consolidated package, and it is broader than the porn-site age-verification headline most outlets led with. If your service is “likely to be accessed by” minors — which is most consumer platforms — the obligations reach you whether or not you host adult content.
This post is about what is actually in the version that passed, what changed from the bills it was assembled from, and which capabilities are worth building now rather than waiting for the Senate to finish arguing.
What the House actually passed
The KIDS Act is not a single idea. It is several previously separate bills welded into one package, which is why its scope is wider than any one summary suggests. The core components:
Default protective settings for minors. Social media services must set minors’ accounts to the strongest available safety and privacy configuration by default, expand parental controls, and change design features that drive compulsive use. This is the surviving core of KOSA’s design-and-defaults approach.
Age verification for adult content. Sites that primarily host pornographic material must use age-verification technology to keep minors out. The bill is explicit that companies cannot be forced to collect government IDs, but they must use “effective, commercially available methods” to confirm a user is an adult before serving harmful material. This codifies, at the federal level, the same standard the Supreme Court blessed for Texas in Free Speech Coalition v. Paxton.
AI chatbot safeguards (the SAFEBOTs provisions). Chatbot providers must clearly disclose to minors when they are talking to an AI rather than a person, must not let a bot falsely claim to be a licensed professional such as a doctor or therapist, must surface crisis-hotline information when a minor raises suicide or self-harm, and must issue break prompts after extended sessions. This is the first time a passed House bill has tied AI chatbot rules to a knowledge-of-age requirement.
Direct-messaging limits. Private messaging is blocked for children under 13, and disappearing-message features are blocked for teens under 17.
Data and advertising limits. The package restricts the use of minors’ data for targeted advertising and adds new data protections for younger users, echoing COPPA 2.0’s direction.
Gaming safeguards. Interactive video game platforms get their own set of minor-protection guardrails.
Full text is on Congress.gov; the House passage was reported by The Hill and Axios.
The detail that determines who is in scope: constructive knowledge
The single most consequential phrase in the bill is not “age verification.” It is “knows or should have known.” Throughout the package, the protective obligations — strongest-default settings, messaging limits, AI disclosures, advertising restrictions — attach whenever a service “knows or should have known” that a user is a child (under 13) or a teen (13–16).
That constructive-knowledge standard is what pulls ordinary platforms into scope. You do not have to market to children. You do not have to host adult content. If a reasonable operator should have known a given account belonged to a 14-year-old and you treated it like an adult account, you have a compliance gap — regardless of what that user actually saw or did.
This is the same trap the UK ICO sprang on Reddit. As we wrote when self-declaration was ruled legally insufficient, once a regulator adopts a “should have known” posture, an unanswered age question stops being a neutral unknown and becomes evidence of a failed control. A date-of-birth dropdown does not discharge a “should have known” duty, because the regulator already knows the dropdown can be lied to. The KIDS Act imports that logic into US federal law for the first time.
The practical reading: the bill does not just require age checks on adult sites. It requires every consumer platform to have a defensible, current answer to “what age band is this user, and how do you know?” — because the strength of the settings, the messaging rules, and the ad restrictions you owe each user all depend on that answer.
What changed: the duty of care came out
The most important deletion in this package is KOSA’s duty of care. Earlier KOSA drafts would have legally required platforms to “exercise reasonable care” to prevent a list of harms to minors. The bipartisan House deal stripped that provision out, which is precisely why it could pass with Republican support — and precisely why it now faces a fight.
KOSA’s Senate co-authors, Richard Blumenthal and Marsha Blackburn, have argued for years that the duty of care is the heart of the bill, not an optional add-on. Removing it is what makes the Senate path uphill: the House passed a version that some of KOSA’s own champions consider gutted, while digital-rights and free-speech groups argue the bill still goes too far on age verification and speech. Both critiques can be true at once, and both make the final shape uncertain.
For platform teams, the strategic point is this: the duty of care is the part most likely to move in the Senate. The age-assurance and constructive-knowledge machinery is the part that has survived every version of every bill — KOSA, the KIDS Act drafts, COPPA 2.0, the state patchwork, and the App Store Accountability Acts already live in Texas and Louisiana. Build against the durable layer, not the contested one.
Why “we can’t be forced to collect IDs” is the most misread line in the bill
The bill’s assurance that companies cannot be required to collect government IDs reads like relief. It is actually a design constraint, and teams that misread it will build the wrong thing.
It does not mean age checks are optional. It means you must achieve an effective result without mandatory ID collection as the only path. That is a harder engineering problem than “scan everyone’s passport,” not an easier one. A platform that responds by building a centralized vault of customer IDs has satisfied nothing and created a fresh liability — a breach magnet that runs directly against the bill’s own data-minimization provisions and against every parallel privacy regime.
The resolution is the same architecture we keep returning to because regulators keep converging on it: age assurance that does not become surveillance. Verify the fact you need — is this user over or under the relevant line — and return that decision, not a stored identity. Privacy-preserving techniques exist precisely so “effective” and “non-invasive” stop being in tension. The bill’s no-mandatory-ID language is, in effect, Congress telling you to build the privacy-preserving version on purpose.
What to build now
Senate timing is unknowable and the final text will move. But the capabilities that satisfy the KIDS Act are the same ones the UK, the EU, Australia, and a dozen US states already demand, so building them is not a bet on this one bill clearing the Senate — it is the lowest-regret move regardless of what the Senate does. Four properties carry the load.
Establish an age band, not a birthday. The obligations key off whether a user is a child, a teen, or an adult. The right primitive is a threshold classification — over/under 13, 16, 18 — produced by a method stronger than a self-asserted dropdown. For high-assurance cases, escalate to document plus NFC chip verification. The band is what drives every downstream setting.
Drive defaults from the band, automatically. “Strongest settings by default for minors” is not a policy page; it is a runtime decision. The age band must flow into account configuration — messaging permissions, ad targeting, session limits, AI-disclosure behavior — so that a minor account is provisioned protectively without a human in the loop. A “should have known” standard is unanswerable if your settings don’t react to what you know.
Return a decision, retain evidence — not identity. Keep a per-decision record of that a check ran, which method produced it, and what assurance level it reached. That evidence trail is the artifact you hand a regulator. The underlying ID image or date of birth is the liability you should not be holding when the breach notification template comes out.
Verify once, reuse the result. Re-collecting identity on every interaction is both bad UX and bad data hygiene. A reusable, user-held credential lets a returning user re-prove the same fact without your platform re-acquiring sensitive data each time — which matters more, not less, when the same fact now gates messaging, advertising, AI behavior, and content access simultaneously.
How Xident handles it
Xident is built for exactly the obligation the KIDS Act formalizes: knowing the age band of your users, on a “should have known” standard, without becoming the ID database the bill’s own data-minimization provisions warn against. The first gate is client-side facial age estimation under liveness, returning a threshold classification — over or under 12, 15, 16, 18, 21, or 25 — rather than a self-asserted birthday. Where the result is uncertain or the surface is high-risk, the flow escalates automatically to document OCR, face match, and NFC chip verification, so the boundaries the bill cares about are enforced by methods a minor cannot simply type past.
Because the obligations cascade from the age band, the band is the integration point. Xident returns a decision your platform can route directly into account provisioning — protective defaults for minors, messaging and disappearing-message limits, ad-targeting restrictions, and AI-disclosure behavior — so “strongest settings by default” becomes an automatic consequence of the check rather than a manual policy. The system is designed to produce a decision and an audit record, not a data hoard: results are threshold classifications logged with method and assurance level, with no retained date of birth or ID image beyond the check. A reusable Xident token lets returning users prove the same fact without re-collecting identity. The result is a defensible answer to the question the KIDS Act, the ICO, Ofcom, and the state patchwork are all now asking in unison: do you know the age of your users, and can you prove how?
The House vote does not make the KIDS Act law — the Senate fight over the duty of care could still reshape or stall it, and the timeline is genuinely open. But it removes the excuse that federal children’s-safety regulation is hypothetical. A full chamber of Congress has now voted yes on age verification, constructive-knowledge obligations, AI chatbot rules, and protective defaults for minors. Every previous version of every competing bill kept the same age-assurance core, and so does this one. The teams that treat June 29 as the moment to start building age-band infrastructure are not over-reacting to one House vote; they are getting ahead of the one requirement that has never been negotiated away.
Children’s online safety is a sensitive and fast-moving area of law. This post is general information about pending federal legislation, not legal advice; the bill text and its obligations may change as it moves through the Senate, so consult qualified counsel for your specific obligations.
