Where it stands
Checked October 2026KIDS ActH.R. 7757 · U.S. Congress
Passed the House267–117 on June 29, 2026; in the Senate Commerce Committee since July 13.[1]
Kids Online Safety ActS. 1748 · U.S. Senate
Out of committeeSenate Commerce approved it on August 5, 2026.[2] On September 30 an attempt to pass it without a recorded vote drew an objection.[3]
S.B. 73Utah
Law, partly blockedIn effect since May 6, 2026; a federal judge blocked its location rule on September 24.[4] The case is paused until after the 2027 legislative session.[5]
Children’s Wellbeing and Schools Act 2026United Kingdom
LawRoyal Assent April 29, 2026.[6] It gives ministers a power to make internet providers restrict children’s access to certain services; the Lords’ outright VPN ban was struck.[7]
The goal, and what gets built in its name
Protecting children online is a real goal. It’s also the most effective way to pass a law few would accept on its own terms. This page keeps the two apart: the aim, and the machinery it authorizes.
“We’re keeping children safe online.”
How
By requiring every person to prove their identity to log on, and letting platforms scan private messages before they’re sent.
A justification this strong barely has to argue
The harm here is real and monstrous, and no one should pretend otherwise. That’s exactly what makes the argument so powerful — and why it’s worth watching how the argument is built, not just whether we care about kids. It tends to run in four moves:
Start with a harm no one defends
Child exploitation is unspeakable. Naming it ends most debates before they begin — which is precisely why it’s reached for.
Offer a fix that sounds small
“Just check ages.” “Just scan for known abuse images.” Each sounds narrow — and each requires building something that touches everyone.
Make objection unthinkable
Anyone raising a civil-liberties concern is recast as caring more about privacy than about children. The debate stops being about the mechanism.
Keep the machinery after the fear cools
The checkpoint, the ID requirement, the scanning — they stay. And a system built to look for one thing can be pointed at another.
None of this means the harm isn’t real. It means a real harm is doing double duty as the reason to build something permanent.
A reason no one dares argue with is a reason no one examines.
The same promise, written as a system spec
Read the reassuring version, then the version an engineer would have to implement. The difference between them is the whole story.
These aren’t caricatures — they’re what the leading proposals actually require. The disagreement isn’t about the goal. It’s about who else gets caught in the net, and for how long.
Everyone reaches for this key
This isn’t one party’s idea or one country’s. Versions of it have moved across the political spectrum and around the world — which is the point. A tactic that works everywhere isn’t a partisan talking point; it’s a pattern worth naming.
US United States
Federal proposals to push age checks down to the app-store layer.
UT Utah
Among the first states to move on app-store age verification.
CA California
Age-assurance requirements aimed at the device and app layer.
UK United Kingdom
Online-safety rules pushing platforms toward age assurance.
EU European Union
Debated rules that would scan private messages for illegal content.
AU Australia
Moved to keep younger teens off social media entirely.
To verify Jurisdiction descriptions are general and drawn from memory; exact bill names, dates, and current status need a web check before this goes live.
The promise it keeps making — and can’t keep
The newest and largest version cleared the U.S. House on June 29, 2026: the KIDS Act[1], passed 267–117. It’s worth reading closely, because it shows the move in miniature. The bill’s own text says it does not require age verification — while imposing duties that only work if a platform can tell who is a minor, which pushes services to check everyone anyway. It says one thing and builds another. In the Senate, the KIDS Act has been in the Commerce Committee since July 13[1]. The Senate has its own version, the Kids Online Safety Act, which cleared that committee on August 5[2]; on September 30, one senator’s objection stopped an attempt to pass it without a recorded vote[3].
Whether the checks even work is a separate question, and where they already run the answer is mostly no. Months into Australia’s under-16 social-media ban, the large majority of under-16s were still on the platforms — often just by entering a different birthday. Independent testers fooled a face-scan with a moving video-game character. The gate is trivial to pass and trivial to fail.
Sources: Australia usage study[8] · UK VPN surge[9] · UK petition figure still to verify.
The loudest proof isn’t a study — it’s the stampede around the gate. A checkpoint this easy to step around protects few children; it mostly logs the adults who comply. And when people route around it, the response hasn’t been to reconsider the checkpoint — it’s to outlaw the detour, an escalation we trace on the age verification page.
There is a quieter path that keeps the decision with families: the parental controls already built into phones, game consoles, and browsers, switched on by a parent for their own child. Most of these mandates skip it — routing the whole household through a checkpoint every adult has to clear too. The disagreement was never whether to help parents. It’s whether “helping” should mean a permanent checkpoint over everyone.
As of October 2026 — bill status and enforcement dates move quickly; the specifics here reflect the latest we could confirm.
A gate built for children is still a gate
The honest version of the other side is serious: some harms are severe enough that people accept real tradeoffs to reduce them, and reasonable people land there. We take that seriously. Our point is narrower — that a mandate should be judged on its full reach and its permanence, not only on its best-case intent.
Because the intent fades and the infrastructure stays. An identity checkpoint and a message scanner don’t know why they were built; they’ll enforce whatever they’re later told to. That’s the same shape we trace across every issue here: a sympathetic reason that hardens into permanent control. Age verification is the mechanism; child safety is the argument that installs it.
Separate the goal from the machine — out loud
You can support protecting kids and still ask what a specific law actually builds. That distinction is the whole job: keep the aim, interrogate the mechanism, and say so while the rules are still being written.
The mechanism
Who builds the gate, and who holds the key
Verifying age online means proving identity to someone. That someone — a government ID system, a private verification vendor, a platform — becomes the keyholder: the party that can know who you are, what you tried to open, and when. The deeper the check is wired into the stack, the more it can see and the harder it is to route around.
Where the checkpoint sits is the whole ballgame:
Each service checks its own users
Fragmented and leaky — but the checkpoint stays inside one service. It doesn’t gate everything at once.
The store vets you before you install
One company becomes a chokepoint for every app on the phone — a single point that can allow or deny at scale.
The device verifies you for everything
Identity checked once, at the layer everything runs on, then passed to every app. The broadest reach of all — hardest to avoid, easiest to expand.
The proposals drawing the most attention would push the check down to the app-store or operating-system layer — the versions with the most reach.
The pattern
Nobody votes for a surveillance internet. It arrives one reasonable step at a time
This is the part worth watching. The changes don’t show up labeled “surveillance.” They arrive as sensible, popular, hard-to-oppose measures — and each step makes the next one look small. A privacy commentator reflecting on these talks called it the boiling-frog problem: by the time the water is hot, moving is expensive.
The usual justification is protecting children. That’s a real goal and a real debate — the first half of this page takes it up — but a justification and a mechanism are different things, and it’s the mechanism that outlives the headline.
The next step
When routing around the gate becomes the crime
Age verification didn’t stay at the gate. Once people slipped past the checks with a VPN, the next move was predictable: go after the tool that makes the gate irrelevant. It’s happening in several countries at once, and it escalates.
First, the speech about the workaround
Platforms can face enforcement for promoting VPN workarounds aimed at young users[10]. When the House of Lords added an outright ban on VPN services for under-18s, the Commons struck it and gave ministers a power to make internet providers restrict children’s access to certain online services instead[7]; that version became law on April 29, 2026[6]. The first target isn’t the tool; it’s talking about the tool.
Then the site is liable for your workaround
A 2026 law (SB 73[11]) treats anyone physically in the state as local no matter what a VPN says, makes covered sites liable when a user bypasses with a VPN, and bars them from explaining how VPNs work. It pressures sites to block VPN traffic or verify everyone. On September 24, 2026, a federal judge blocked the location rule, finding it likely burdens commerce far outside Utah[4]. The ban on explaining VPNs wasn’t part of the challenge, so it remains in effect[12]. The case is now paused until after the legislature’s 2027 session, when lawmakers may rewrite the rule[5] — and other states are weighing similar proposals[12].
Approved providers only
Where the goal is openly control rather than child safety, governments skip the justification and allow only state-approved VPNs — then inspect the traffic routed through them. The “protect children” road and the “approved providers” road arrive at the same place.
None of this took a dramatic vote. Each step was narrow — a rule about speech, a rule about liability, a rule about licensing. What they build together is not: an internet where reaching for a privacy tool is first a risk, then a liability, and finally a thing you need permission for. A network where your VPN requires government approval is one where private communication exists only with permission.
As of October 2026. Legislative status changes quickly; the specifics above reflect the latest we could confirm.
What’s at stake
A society fixes itself only while it can still act in private
The deeper danger isn’t a teenager blocked from a website. It’s what a permanent identity checkpoint does to everyone else. Free societies correct their own mistakes through people who can act without being watched — and that only works while private communication, association, and transaction still exist. Take those away and the repair mechanisms fail one by one:
- Whistleblowers go quiet. Exposure isn’t worth the risk.
- Journalists lose sources. No one can reach them safely.
- Organizers are mapped early. Dissent is visible before it starts.
- Everyone self-censors. The safest move becomes saying nothing.
None of this needs a villain or a dramatic new law. A gate built to check age is a gate that can check anything — and a public that got used to proving who it is just to log on is a public that’s easier to police. The alarming part is how reasonable every step looks on its own.
What you can do
Learn the mechanism, then push on it
You can’t opt out of a mandate by yourself. What you can do is understand how the checkpoint works, choose tools that reveal as little identity as possible, and make noise while the rules are still being written.
References12 sources
Every source this page cites, numbered in the order it first appears. Each number in the text links here; each ^ links back.
- ^ a b c Congress.gov, H.R. 7757 (119th Congress), KIDS Act congress.gov/bill/119th-congress/house-bill/7757
- ^ a b CNBC, Aug. 5, 2026, on the Kids Online Safety Act clearing the Senate Commerce Committee cnbc.com/2026/08/05/kosa-privacy-social-media-senate…
- ^ a b Congressional Record, Senate, Sept. 30, 2026, p. S5213: unanimous-consent request on the Kids Online Safety Act congress.gov/119/crec/2026/09/30/172/155/CREC-2026-09-30…
- ^ a b Aylo Freesites Ltd v. Utah Division of Consumer Protection, No. 2:26-cv-00340 (D. Utah Sept. 24, 2026), order granting a preliminary injunction courthousenews.com/wp-content/uploads/2026/09/aylo-freesites-u…
- ^ a b Utah Public Radio, Oct. 13, 2026, on the case pausing until after the 2027 session upr.org/utah-news/2026-10-13/daily-news-pornhub-law…
- ^ a b Children’s Wellbeing and Schools Act 2026 (c. 21), Royal Assent April 29, 2026 legislation.gov.uk/ukpga/2026/21/introduction
- ^ a b UK Parliament, Children’s Wellbeing and Schools Bill: Commons disagreement to Lords Amendments 37 and 38 (VPN ban), with amendments 38A–38D in lieu bills.parliament.uk/publications/66095/documents/8226
- ^ The Conversation, on most Australian children still using social media despite the ban theconversation.com/85-of-kids-are-still-using-social-media-des…
- ^ Tom’s Hardware, on Utah targeting VPN use with age verification tomshardware.com/software/vpn/utah-becomes-first-us-state-to…
- ^ UK Parliament, Hansard (House of Lords), Dec. 4, 2025: “Children: Age Verification and Virtual Private Networks” hansard.parliament.uk/lords/2025-12-04/debates/4ECC433F-7DB4-43ED…
- ^ Utah Legislature, S.B. 73 (2026), enrolled bill le.utah.gov/Session/2026/bills/enrolled/SB0073.pdf
- ^ a b Electronic Frontier Foundation, Oct. 1, 2026, on the Utah ruling eff.org/deeplinks/2026/10/court-agrees-eff-utahs-vp…
Get involved
It’s free, open to everyone at Pitt, and joining takes about a minute.
No dues, no experience needed. Come to a meeting, or leave your name and we’ll tell you when the next one is.