Congress should make children’s privacy the on-ramp to a national privacy law for all
The Senate Commerce Committee marked up five children’s online safety bills on Aug.
参议院商业委员会于 8 月 17 日批准了五项儿童在线安全法案。
5, unanimously advancing the Kids Online Safety Act (KOSA).
5、一致推进《儿童在线安全法案》（KOSA）。
The markup came five weeks after the U.S. House of Representatives passed the Kids Internet and Digital Safety (KIDS) Act on June 29 by a 267-117 vote, marking the first time any version of the Kids Online Safety Act (KOSA) has cleared the chamber.
五周前，美国众议院于 6 月 29 日以 267 比 117 票通过了《儿童互联网和数字安全 (KIDS) 法案》，这标志着《儿童在线安全法案》(KOSA) 的任何版本首次获得通过。
The package, assembled from portions of 14 bills , bundles a revised KOSA with an updated Children and Teens’ Online Privacy Protection Act (COPPA 2.0), new rules for artificial intelligence (AI) chatbots and gaming platforms, data broker disclosure requirements, and age verification mandates for websites where more than one-third of the material is harmful to minors.
该方案由 14 项法案的部分内容组成，将修订后的 KOSA 与更新后的《儿童和青少年在线隐私保护法》(COPPA 2.0)、人工智能 (AI) 聊天机器人和游戏平台的新规则、数据经纪人披露要求以及针对其中三分之一以上材料对未成年人有害的网站的年龄验证要求捆绑在一起。
Its prospects in the Senate remain uncertain .
它在参议院的前景仍然不确定。
The Senate’s KOSA co-authors have called the House version unacceptable for dropping the “duty of care” provision.
参议院 KOSA 的共同作者称众议院版本放弃“注意义务”条款是不可接受的。
Sen.
参议员。
Marsha Blackburn (R-Tenn.) is negotiating with the White House to pair the Senate’s KOSA with federal preemption of some state AI laws.
Marsha Blackburn（田纳西州共和党人）正在与白宫谈判，将参议院的 KOSA 与联邦政府对某些州人工智能法律的优先权结合起来。
Children’s privacy would be better protected as a component of comprehensive privacy legislation, because the practices that put children at risk, including invasive inference, profiling, brokered data flows, and engagement-optimized design, also cause harm to all ages.
作为全面隐私立法的一部分，儿童的隐私将得到更好的保护，因为将儿童置于危险之中的做法，包括侵入性推理、分析、代理数据流和参与优化设计，也会对所有年龄段的人造成伤害。
Putting this cart before the horse might also have implications on establishing a national data privacy standard.
本末倒置也可能对建立国家数据隐私标准产生影响。
However, current comprehensive data privacy proposals do not have bipartisan support, leading to a more specific children’s package to move , and it can create targeted protections in the absence of a stronger comprehensive bill.
然而，目前全面的数据隐私提案没有得到两党的支持，导致需要提出更具体的儿童一揽子计划，并且可以在缺乏更强有力的综合法案的情况下创建有针对性的保护。
If done correctly, a bill targeting children’s privacy can become the on-ramp to a national privacy law, rather than a detour.
如果做得正确，针对儿童隐私的法案可以成为国家隐私法的入口，而不是绕道。
The central risk to children’s privacy online is exposure to digital environments organized around surveillance and monetization incentives, not just access to content.
儿童在线隐私的主要风险是暴露于围绕监视和货币化激励组织的数字环境，而不仅仅是访问内容。
Online services that children use are shaped by business models that reward more data through deepened inferences, online engagement, and longer online retention times.
儿童使用的在线服务受到商业模式的影响，这些商业模式通过深化推理、在线参与和更长的在线保留时间来奖励更多数据。
A Harvard study estimated that major social media platforms earned more than $11 billion in U.S. advertising revenue from minors in 2022.
哈佛大学的一项研究估计，到 2022 年，美国主要社交媒体平台从未成年人身上获得的广告收入将超过 110 亿美元。
So long as minors are a material revenue source, platforms will not be able to (or want to) meaningfully mitigate harms to children without changing core revenue structures.
只要未成年人是物质收入来源，平台就无法（或不想）在不改变核心收入结构的情况下有意义地减轻对儿童的伤害。
While COPPA has provided the basis for protecting children online, children’s digital lives have changed faster than the law has been updated.
虽然 COPPA 为保护上网儿童奠定了基础，但儿童数字生活的变化速度快于法律的更新速度。
Social media became the default social infrastructure for teens.
社交媒体成为青少年默认的社交基础设施。
Now these platforms have been optimized for engagement in ways that magnify data collection.
现在，这些平台已经过优化，可以放大数据收集的方式进行参与。
COPPA requires operators to obtain verifiable parental consent before collecting personal information from children under 13, but it applies only to services that are directed at children or that have actual knowledge that they have child users.
COPPA 要求运营商在收集 13 岁以下儿童的个人信息之前获得可验证的父母同意，但它仅适用于针对儿童或实际知道自己有儿童用户的服务。
The proposed legislation also focus on children under 13, but the reliance on an “actual knowledge” standard has long created predictable gaps, especially for mixed-age services.
拟议的立法也关注 13 岁以下的儿童，但对“实际知识”标准的依赖长期以来造成了可预见的差距，特别是在混合年龄服务方面。
In its 2022 case against Epic Games, the Federal Trade Commission (FTC) alleged that Fortnite’s privacy policy disavowed being directed to children while the company avoided learning users’ ages.
在 2022 年针对 Epic Games 的案件中，联邦贸易委员会 (FTC) 声称，《堡垒之夜》的隐私政策否认针对儿童，而该公司则避免了解用户的年龄。
Unwinding that took a $520 million resolution, including the largest civil penalty the agency has ever obtained for a rule violation, to change one company’s privacy options.
为了改变一家公司的隐私选项，该机构花费了 5.2 亿美元的决议，其中包括该机构因违反规则而获得的最大民事罚款。
The FTC took action against TikTok and ByteDance in 2024 alleging repeated COPPA violations despite years of prior regulatory scrutiny.
美国联邦贸易委员会 (FTC) 于 2024 年对 TikTok 和字节跳动采取了行动，指控其一再违反 COPPA，尽管此前已经进行了多年的监管审查。
Firm-by-firm enforcement at that scale is not shifting industry-wide incentives.
如此大规模的逐家执法并没有改变整个行业的激励措施。
Nor does the youth digital ecosystem stop at social media feeds.
青年数字生态系统也不仅仅停留在社交媒体上。
It extends to app stores, games, advertising technology, data brokers, and AI chatbots marketed as companions .
它扩展到应用商店、游戏、广告技术、数据经纪人和作为伴侣营销的人工智能聊天机器人。
Recent data-broker enforcement actions show how downstream markets can turn seemingly mundane signals, including sensitive location data, into high-risk datasets.
最近的数据经纪人执法行动表明下游市场如何将看似平凡的信号（包括敏感位置数据）转变为高风险数据集。
The Federal Trade Commission’s (FTC) September 2024 social media surveillance report similarly found that major platforms engaged in extensive data collection and monetization practices while providing inadequate safeguards for children and teens.
美国联邦贸易委员会 (FTC) 2024 年 9 月的社交媒体监控报告同样发现，主要平台从事广泛的数据收集和货币化做法，同时为儿童和青少年提供的保障不足。
A statute that governs only services likely to be accessed by minors would leave the resale market intact.
仅管理未成年人可能访问的服务的法规将使转售市场完好无损。
Additionally, it would not protect adults’ data flows, from which information about children can be inferred .
此外，它不会保护成年人的数据流，从中可以推断出有关儿童的信息。
Research supports these conclusions: A 2023 surgeon general’s advisory concluded that the effects of social media on youth mental health are real but heterogeneous, and that current safeguards and transparency are insufficient relative to the scale of use.
研究支持了这些结论：2023 年卫生局局长的一份咨询报告得出的结论是，社交媒体对青少年心理健康的影响是真实的，但具有异质性，而且相对于使用规模，当前的保障措施和透明度还不够。
The National Academies of Sciences, Engineering, and Medicine reached a similar conclusion in their 2024 consensus report: Platform design and data practices—not access alone—are meaningful levers for reducing risk.
美国国家科学院、工程院和医学院在其 2024 年共识报告中得出了类似的结论：平台设计和数据实践（而不仅仅是访问）是降低风险的有意义的杠杆。
If children become the “exception” the law protects, platforms will still have incentives to build surveillance-based advertising and recommendation systems for everyone else, then those systems should be adapted around more complicated age gates.
如果儿童成为法律保护的“例外”，平台仍然有动力为其他人建立基于监控的广告和推荐系统，那么这些系统应该围绕更复杂的年龄门槛进行调整。
Blanket bans on children’s internet or social media use can push activity to less regulated corners of the internet, increase pressure for intrusive age-verification requirements, and invite constitutional challenges .
对儿童互联网或社交媒体使用的全面禁令可能会将活动推向互联网监管较少的角落，增加侵入性年龄验证要求的压力，并引发宪法挑战。
In recent years, Congress has recognized the need to protect children’s privacy and update COPPA: In July 2024, the Senate passed a children’s online safety package by a 91-3 vote, but the House never acted.
近年来，国会已经认识到保护儿童隐私并更新 COPPA 的必要性：2024 年 7 月，参议院以 91 比 3 的投票通过了儿童在线安全一揽子计划，但众议院从未采取行动。
In March, the Senate passed its own version of COPPA 2.0, and the House Energy and Commerce Committee advanced an earlier, party-line version of the KIDS Act.
3 月，参议院通过了自己版本的 COPPA 2.0，众议院能源和商业委员会提出了早期的党派路线版本的 KIDS 法案。
After Chairman Brett Guthrie (R-Ky.) and Ranking Member Frank Pallone (D-N.J.) struck a bipartisan deal on revised text in late June, the full House passed the package a week later.
六月下旬，主席布雷特·格思里（肯塔基州共和党）和高级议员弗兰克·帕隆（新泽西州民主党）就修订后的文本达成两党协议后，一周后众议院全体通过了该方案。
This package would extend COPPA-style protections to teens through age 17, adopt a “know or should have known” knowledge standard, restrict targeted advertising to minors, and set a federal floor that preserves stronger state protections.
该计划将把 COPPA 式的保护范围扩大到 17 岁以下的青少年，采用“知道或应该知道”的知识标准，限制针对未成年人的定向广告，并设定一个联邦下限，以保留更强有力的州保护。
Understanding that the current KIDS Act package may be the most politically viable path does not mean that the current draft meets the standard to meaningfully protect children.
了解当前的《儿童法案》一揽子计划可能是政治上最可行的路径，并不意味着当前的草案符合有效保护儿童的标准。
The administration’s own National Policy Framework for Artificial Intelligence, released in March, argues that Congress should create “commercially reasonable, privacy protective, age-assurance requirements” for AI services “likely to be accessed by minors,” and “affirm that existing child privacy protections apply to AI systems, including limits on data collection for model training and targeted advertising.” There are two constraints that could block the legislation’s success.
政府自己的国家人工智能政策框架于三月份发布，认为国会应该为“未成年人可能访问”的人工智能服务制定“商业上合理的、隐私保护的、年龄保证的要求”，并“确认现有的儿童隐私保护适用于人工智能系统，包括限制模型训练和定向广告的数据收集。”有两个限制因素可能会阻碍立法的成功。
The first is the constitutional record, which has narrowed the options for online safety regulations.
首先是宪法记录，它缩小了网络安全监管的选择范围。
In Free Speech Coalition v.
在言论自由联盟诉。
Paxton, the Supreme Court upheld Texas’ age-verification requirement for sites publishing material obscene to minors, applying intermediate rather than strict scrutiny on the theory that the law only incidentally burdens adults’ access to protected speech.
在帕克斯顿案中，最高法院维持了德克萨斯州对发布未成年人淫秽材料的网站的年龄验证要求，对这一理论进行了中间而非严格的审查，即该法律只是偶然地对成年人获得受保护的言论施加了负担。
In March, the 9th U.S. Circuit Court of Appeals held that NetChoice had not carried its burden of showing that the California Age-Appropriate Design Code Act’s coverage definition or its age estimation mandate is facially unconstitutional under the First Amendment, and it lifted the injunction as to those provisions.
今年 3 月，美国第九巡回上诉法院裁定，NetChoice 没有承担证明《加州适龄设计规范法案》的覆盖范围定义或其年龄估计授权在第一修正案下明显违宪的责任，并解除了针对这些条款的禁令。
The court affirmed the preliminary injunction against the act’s four data use restrictions and dark patterns prohibition, which it found likely too vague to enforce.
法院确认了针对该法案四项数据使用限制和暗色图案禁令的初步禁令，法院认为该禁令可能过于模糊而无法执行。
Arkansas’s social media age-verification law was also blocked by the U.S. District Court in 2025 on First Amendment and vagueness grounds; the state’s appeal is now pending before the 8th U.S. Court of Appeals.
阿肯色州的社交媒体年龄验证法也于 2025 年被美国地方法院以第一修正案和模糊性为由否决；该州的上诉目前正在美国第八上诉法院审理。
These mixed constitutional rulings have prolonged uncertainty.
这些混合的宪法裁决带来了长期的不确定性。
The second constraint is political.
第二个制约因素是政治因素。
Children’s safety has become a bargaining chip in a larger AI federalism fight .
儿童安全已成为一场更大的人工智能联邦制斗争中的讨价还价筹码。
The White House is working with Blackburn on a package that would pair the Senate’s version of KOSA—including its duty of care provision—with the NO FAKES Act , age-verification requirements, and the preemption of some state AI laws.
白宫正在与 Blackburn 合作制定一项计划，将参议院版本的 KOSA（包括其注意义务条款）与《无假货法案》、年龄验证要求以及一些州人工智能法律的优先权结合起来。
KOSA’s Democratic co-author has rejected linking the two, arguing preemption should not be part of kids’ safety legislation.
KOSA 的民主党合著者拒绝将两者联系起来，认为先发制人不应成为儿童安全立法的一部分。
A better approach for policymakers would be to focus on the underlying data and design incentives that create risk cutting across young people and adult online users.
对于政策制定者来说，更好的方法是关注基础数据并设计激励措施，以消除年轻人和成年在线用户的风险。
Treating data minimization as a duty and not a consumer right means that if a service is likely to be used by minors, it should not be allowed to collect, infer, or retain data beyond what is necessary to provide the requested service.
将数据最小化视为一种义务而不是消费者权利意味着，如果一项服务可能由未成年人使用，则不应允许该服务收集、推断或保留超出提供所请求服务所需的数据。
Rules built around necessity, proportionality, and use limitations are more effective than rules built around barring children, and adults, from particular services.
围绕必要性、相称性和使用限制制定的规则比围绕禁止儿童和成人使用特定服务制定的规则更有效。
FTC changes to the COPPA rule have focused on limiting companies’ ability to monetize children’s data as a condition of access and on tightening consent requirements for disclosures and targeted advertising—items that point in the right direction.
FTC 对 COPPA 规则的修改重点是限制公司将儿童数据货币化作为访问条件的能力，并收紧对信息披露和定向广告（指向正确方向的项目）的同意要求。
The House-passed KIDS Act is perhaps a good mirror for more effective legislation by expanding age coverage into adolescence, restricting behavioral advertising to children and teens, and adding new data broker obligations.
众议院通过的《儿童法案》或许是更有效立法的一面镜子，该法案将年龄覆盖范围扩大到青春期，限制针对儿童和青少年的行为广告，并增加了新的数据经纪人义务。
While legislating for age assurance may be appropriate in narrow contexts, privacy-preserving approaches remain institutionally difficult.
虽然年龄保证立法在狭隘的背景下可能是适当的，但保护隐私的方法在制度上仍然很困难。
If lawmakers make age-gating the main compliance mechanism, they will put more pressure on online platforms and intermediaries to collect sensitive information such as personal identification factors, biometrics, or other persistent identifiers that can have discriminatory outputs.
如果立法者将年龄限制作为主要合规机制，他们将对在线平台和中介机构施加更大压力，要求其收集敏感信息，例如个人身份因素、生物识别信息或其他可能产生歧视性输出的持久标识符。
Further, the KIDS Act’s age verification mandate for adult websites has drawn warnings from digital rights groups that compliance could require all users to submit personal information to verify their age.
此外，《儿童法案》对成人网站的年龄验证规定引起了数字权利组织的警告，称合规可能要求所有用户提交个人信息以验证其年龄。
Companies would likely need to build a de facto identity layer of the internet to comply with these laws, even as data breaches and misuse risks remain persistent .
即使数据泄露和滥用风险仍然存在，公司可能需要建立一个事实上的互联网身份层来遵守这些法律。
If Congress responds by only building age gates, it will leave these underlying incentives intact, while creating pressure for more intrusive identity verification systems across the internet, and the rules might also be invasive to vulnerable populations who lack verifiable identification resources.
如果国会仅通过建立年龄限制来应对，那么它将完好无损地保留这些潜在的激励措施，同时为互联网上更具侵入性的身份验证系统带来压力，而且这些规则也可能会侵入缺乏可验证身份资源的弱势群体。
Any age-assurance system should be proportionate, secure, and prohibited from being repurposed for advertising or unrelated profiling through strict use limitations.
任何年龄保证系统都应该是相称的、安全的，并且通过严格的使用限制，禁止被重新用于广告或不相关的分析。
The current House-passed package sets a federal floor that preserves stronger state protections, unlike the approach of the Republican-led comprehensive privacy bill, the SECURE Data Act .
目前众议院通过的一揽子计划设定了联邦下限，保留了更强有力的国家保护，这与共和党领导的全面隐私法案《安全数据法案》的做法不同。
Preemption remains a large obstacle to bipartisan comprehensive legislation, and enacting a children’s privacy bill with a floor would demonstrate that a national standard need not set the ceiling on privacy protections.
优先权仍然是两党全面立法的一大障碍，制定有下限的儿童隐私法案将表明国家标准无需为隐私保护设定上限。
While passing a children’s privacy bill could help the passage of a comprehensive bill by resolving certain political sticking points on data privacy, it may diminish some of the present political urgency toward acting on data privacy.
虽然通过儿童隐私法案可以通过解决数据隐私方面的某些政治症结来帮助全面法案的通过，但它可能会削弱目前对数据隐私采取行动的政治紧迫性。
When it’s all said and done, children’s online privacy bills should be tied to getting a national privacy baseline.
总而言之，儿童的在线隐私法案应该与国家隐私基线挂钩。
A children-first strategy may be the most politically viable path forward right now, but it should be treated as the beginning of a more comprehensive discussion that results in everyone being protected from online threats.
儿童优先战略可能是目前政治上最可行的道路，但它应该被视为更全面讨论的开始，从而保护每个人免受网络威胁。
Otherwise, Congress will have created a protected class of users while normalizing the idea that privacy protections are optional for adults.
否则，国会将创建一个受保护的用户类别，同时规范隐私保护对于成年人来说是可选的想法。