Lawmakers are debating legislation that would create a surveillance and censorship regime — a prospect that should alarm anyone who values privacy and free expression, writes India McKinney of the Electronic Frontier Foundation.

The Kids Internet and Digital Safety (KIDS) Act is presented as a measure to shield children from online harm. In reality, the package combines more than a dozen privacy-invasive, censorship-friendly requirements that could endanger minors and all internet users alike.

The legislative package, which includes a revised version of the Kids Online Safety Act (KOSA), passed the House on June 29 and is now under consideration in the Senate. If enacted, it would incentivize platforms to require all users — adults and minors alike — to hand over personal information linking their offline identity to their online activity.

Multiple sections of the bill require online providers to establish and enforce policies preventing children and teenagers from accessing broadly defined categories of content. Violators could face significant legal action from the Federal Trade Commission and state attorneys general, making the Senate’s handling of the bill especially consequential for how broadly these duties would apply across online services.

A New Mass Surveillance System

To avoid legal exposure, websites and social media platforms may decide to age-gate all users — verifying, guessing, or estimating ages across the board. This would effectively establish a new mass surveillance apparatus.

Regardless of one's assessment of U.S. privacy protections, current online activity is not necessarily linked to a specific identity. If this bill passes, that will likely change.

This is not a benign form of digital "carding." If enacted, the gatekeeper becomes an online entity that electronically captures personal information and stores it in a database for an unspecified duration. Surrendering identifying details would become the price of accessing legal, First Amendment-protected content or communicating with others online.

Once that information is turned over, it becomes vulnerable to leaks, data theft, and misuse. This is not hypothetical: breaches of age verification providers have already occurred.

Multiple Pathways to Age-Gating

The KIDS Act contains several provisions that lead toward universal age verification. For example, a section tied to the SAFE BOTS Act mandates that if a service "knows or should have known" a user is underage, it cannot offer certain chatbot features. The SCREEN Act section requires hosts of sexually explicit content to determine whether users are "more likely than not" underage before granting access.

Under the bill, platforms are liable for walling off minors from targeted content categories. The consequences of that liability extend beyond children: platforms will be pressured to make adults prove their age, making everyone's online experience less private.

The legislation will also push online services to adopt moderation policies against lawful speech — separating users from content that some legislators deem harmful to minors. As past experience demonstrates, while lawmakers may be clear about their intent during debate, platforms are notoriously poor at distinguishing discussions about harmful activities from discussions about seeking help.

Consider a 15-year-old expressing concern about a friend's drinking, or a 13-year-old searching for information on helping a parent quit smoking. Both would be engaging in lawful speech about topics the KIDS Act labels as harmful. While such posts are not intended to be banned, platforms tasked with preventing minors from accessing content about alcoholism or smoking will likely remove those topics entirely or restrict them to adult-only spaces. The threat of legal action consistently pushes platforms to over-remove or restrict content.

Encryption and Ephemeral Messaging Under Pressure

Several provisions of the bill also create new rules around encrypted messages, direct messages, disappearing or "ephemeral" messages, and AI chat services. While the text states that KOSA requirements should not override strong encryption, this protection may prove meaningless because it does not apply to KOSA's mandate that services "address" content lawmakers consider harmful to minors.

Platforms cannot address content in messages they cannot see. That creates pressure to weaken or limit encrypted messaging. Other provisions similarly target ephemeral or disappearing messages — such as those on Signal or WhatsApp — for the same reasons.

End-to-end encryption and ephemeral messages are not superfluous design choices. They are critical privacy tools that sustain real-world conversations online without making them accessible to service providers, data brokers, or permanent databases. The practical question for lawmakers is whether any final bill preserves those protections in operation, not merely in statutory language.

A Privacy-First Alternative

There are numerous ways to protect young people online without requiring everyone to surrender personal information, compromise anonymity, or accept government-directed content moderation affecting lawful speech. Lawmakers could address the problems that age-gating claims to solve by passing a comprehensive federal data privacy law — one that gives individuals control over data collected about them and, by extension, over how platforms' algorithms are deployed against them.

Instead, Congress is seriously considering the KIDS Act, which seeks to protect children at the expense of privacy and free expression for all internet users.

Note: The views expressed in this column are those of the author and do not necessarily reflect those of CoinDesk, Inc. or its owners and affiliates.