KOSA is a bill, not a law
The Kids Online Safety Act is still moving through Congress. S.1748 was ordered reported by the Senate Commerce Committee on 5 August 2026 and awaits a full Senate vote. The House passed a related but different child safety package earlier in 2026, and the two texts have not been reconciled. Source: S.1748 on Congress.gov.
That matters for how you plan. Until a single text is enacted, the duty of care, the definition of a covered platform, the harm list and the enforcement model can all still change. Nobody can sell you KOSA compliance today, because there is nothing final to be compliant with.
What you can do is get ready, using obligations that are already in force. Almost everything a plausible KOSA text would ask for is already required somewhere else.
What is actually in force today
--- · --- · ---
EU Digital Services Act · In force · Risk assessments for minors, no profiling ads to minors, notice and action, transparency reporting
UK Online Safety Act · In force, phased · Children's risk assessments, proportionate systems against priority harms, highly effective age assurance for some content
COPPA (and the amended FTC rule) · In force · Verifiable parental consent, data minimisation and retention limits for under-13s
State design codes (e.g. California AADC) · Partly in force, partly litigated · High-privacy defaults for minors, design impact assessments
GDPR Article 8 / UK GDPR · In force · Lawful basis and consent age rules for children's data
KOSA · Bill · Nothing yet. Prepare, do not certify
If you build for the DSA, the UK OSA and COPPA, you will have covered most of what any enacted version of KOSA is likely to demand, and you get enforceable value today rather than a hedge on a floor vote.
The harm categories in the current draft
The Senate text as reported lists harms a covered platform's design would need to address. Treat these as the drafted list, not a statutory checklist, and re-read them when the final text lands.
--- · ---
Eating disorders · Pro-ana and extreme restriction content, comparison loops
Suicide and self-harm · Ideation, method-seeking, encouragement
Harassment and bullying · Targeted abuse, pile-ons, exclusion
Sexual exploitation · Grooming, sextortion, CSAM
What "readiness" actually means
Readiness is evidence, not a badge. Four things carry over regardless of which text passes:
- Know where minors are. Age signals, age assurance where the UK OSA already requires it, and a written record of how you decided.
- Detect the harms in the drafted list. Automated detection with reviewable output, not keyword lists.
- Have a documented response. Who sees an alert, what happens next, escalation paths, and time to action.
- Keep the paper trail. Risk assessments, model documentation, transparency reporting, and dated decisions. Every regime above asks for this, and any enacted KOSA will too.
Penalties: what we will and will not tell you
You will see "$50,000 per violation" quoted around KOSA. That figure comes from draft text and commentary, not from law, and we will not use it to sell you anything. The enforcement exposure that exists today is real and already quantified elsewhere: DSA fines up to 6% of global turnover, UK OSA fines up to £18m or 10% of qualifying worldwide revenue, and FTC civil penalties per COPPA violation.
Where Tuteliq fits
Tuteliq is detection infrastructure. We do not make you compliant with a bill, and we do not issue KOSA certificates. We give you the detection layer and the evidence trail that in-force regimes already expect, and that a future KOSA would build on.
--- · ---
Eating disorders · /safety/unsafe
Substance use · /safety/unsafe
Suicide and self-harm · /safety/unsafe, /safety/distress-signals
Depression and anxiety patterns · /analysis/emotions
Compulsive usage · Platform-side signals plus /analysis/emotions context
Harassment and bullying · /safety/bullying
Sexual exploitation · /safety/grooming
Typical end-to-end response is 1.1 to 1.5 seconds on shared infrastructure. Dedicated deployment removes shared-tenancy and prompt-assembly overhead; internal testing on dedicated hardware measured typical 1.1 to 1.5s response. Submitted content is deleted immediately after inference and is never used for training.
A defensible plan
- Map your minor population and write down the basis for that assessment.
- Comply with what is in force: DSA, UK OSA, COPPA, applicable state design codes.
- Add detection across the drafted harm areas so a change in the final text is a configuration change, not a rebuild.
- Document response and outcomes so you can show reasonable care to any regulator.
- Re-verify KOSA's status against Congress.gov before you make any public claim about it.
Conclusion
Buying "KOSA compliance" today buys a claim nobody can honour. Buying readiness, anchored to laws already in force, gives you protection for young users now and a short path to whatever the final text says.
Ready to start? Get your free API key and add child-safety detection in under five minutes.