https://forums.wdwmagic.com/attachments/thinkchild-jpg.561669/

https://www.eff.org/deeplinks/2022/11/kosa-would-let-government-control-what-young-people-see-online
NOVEMBER 17, 2022

KOSA Would Let the Government Control What Young People See Online

The latest version of the Kids Online Safety Act (KOSA) is focused on removing online information that people need to see—people of all ages. Letting governments—state or federal—decide what information anyone needs to see is a dangerous endeavor. On top of that, this bill, supposedly designed to protect our privacy, actually requires tech companies to collect more data on internet users than they already do.

EFF has long supported comprehensive privacy protections, but the details matter. KOSA gets the details consistently wrong, and that’s why we’re calling on members of Congress to oppose this bill.

Although KOSA has been revamped since lawmakers introduced it in February, and improved slightly, it’s still a dangerous bill that presents censorship and surveillance as a solution to some legitimate, and some not-so-legitimate, issues facing young internet users today.

The Good

KOSA is a sweeping update to the Children’s Online Privacy Protection Act, also known as COPPA. COPPA is the reason that many websites and platforms ask for you to confirm your age, and why many services require their users to be older than 13—because the laws protecting data privacy are much stricter for children than they are for adults. Legislators have been hoping to expand COPPA for years, and there have been good proposals to do so. KOSA, for its part, includes some good ideas: more people should be protected by privacy laws, and the bill expands COPPA’s protections to include minors under 16. That would do a world of good, in theory: the more people we can protect under COPPA, the better. But why stop with protecting the privacy of minors under 16? EFF has long supported comprehensive data privacy legislation for all users.

Another good provision in KOSA would compel sites to allow minor users to delete their account and their personal data, and restrict the sharing of their geolocation data, as well as provide notice if they are tracking it. Again, EFF thinks all users—regardless of their age—should have these protections, and expanding them incrementally is better than the status quo.

The Bad

But KOSA’s chief focus is not to protect young people’s privacy. The bill’s main aim is to censor a broad swath of speech in response to concerns that young people are spending too much time on social media, and too often encountering harmful content. KOSA requires sites to “prevent and mitigate mental health disorders,” including by the promotion or exacerbation of “self-harm, suicide, eating disorders, and substance use disorders.” Make no mistake: this is a requirement that platforms censor content.

This sweeping set of content restrictions wouldn’t just apply to Facebook or Instagram. Platforms covered by KOSA include “any online platform that connects to the internet and that is used, or is reasonably likely to be used, by a minor.” As we said before, this would likely encompass everything from Apple’s iMessage and Signal to web browsers, email applications and VPN software, as well as platforms like Reddit, Facebook, and TikTok—platforms with wildly different user bases and uses, and with hugely varying abilities, and expectations, to monitor content.

A huge number of online services would thus be forced to make a choice: overfilter to ensure no one encounters content that could be construed as ambiguously harmful, or raise the age limit for users to 17. Many platforms may even do both.

Let’s be clear about the dangerous consequences of KOSA’s censorship. Under its vague standard, both adults and children will not be able to access medical and health information online. This is because it will be next to impossible for a website to make case-by-case decisions about which content promotes self-harm or other disorders and which ones provide necessary health information and advice to those suffering from them. This will disparately impact children who lack the familial, social, financial, or other means to obtain health information elsewhere. (Research has shown that a large majority of young people have used the internet for health-related research.)

Another example: KOSA also requires these services to ensure that young people do not see content that exacerbates a substance use disorder. On the face of it, that might seem fairly simple: just delete content that talks about drugs, or hide it from young people. But how do you find and label such content? Put simply: not all content that talks about drugs exacerbates their use.

There is no realistic way to find and filter only that content without also removing a huge swath of content that is beneficial. For just one example, social media posts describing how to use naloxone, a medication that can reverse an overdose from opioids, could be viewed as either promoting self-harm, because it can reduce the potential danger of a fatal overdose, or as providing necessary health information. But KOSA’s vague standard means that a website owner is in a better position legally if they remove that information, which avoids a potential claim later that the information is harmful. That will reduce the availability of important and potentially life-saving information online. KOSA pushes website owners toward government-approved censorship.

The Ugly

To ensure that users are the correct age, KOSA compels vast data collection efforts that perversely result in even greater potential privacy invasions..

KOSA would authorize a federal study on creating a device or operating system level age verification system, “including the need for potential hardware and software changes.” The end result would likely be an elaborate age-verification system, run by a third-party, that maintains an enormous database of all internet users’ data.

Many of the risks of such a program are obvious. They require every user—including children—to hand private data over to a third-party simply to use a website if that user ever wants to see beyond the government’s “parental” controls.

Moreover, the bill lets Congress decide what’s appropriate for children to view online. This verification scheme would make it much harder for actual parents to make individual choices for their own children. Because it’s so hard to differentiate between minors having discussions about many of these topics in a way that encourages them, as opposed to a way that discourages them, the safest course of action for services under this bill is to block all discussion and viewing of these topics by younger children and teenagers. If KOSA passes, instead of allowing parents to make the decision about what young people will see online, Congress will do it for them.

A recent study on attitudes toward age verification showed that most parents “are willing to make an exception or allow their child to bypass the age requirement altogether, but then require direct oversight of the account or discussions about how to use the app safely.” Many also fudge the numbers a bit, to ensure that websites don’t have the specific birthdays of their children. With the hard-wired, national age verification system imagined by KOSA, it will be much harder, if not impossible, for parents to decide for themselves what sites and content a young person can encounter. Instead, the algorithm will do it for them.

KOSA also fails to recognize the reality that some parents do not always have their childrens’ best interest in mind, or are unable to make appropriate decisions for them. Those children suffer under KOSA’s paternal regime, which requires services to set parental controls to their highest levels for those under thirteen.

KOSA is a Poor Substitute for Real Privacy Online

KOSA’s attempt to improve privacy and safety will in fact have negative impacts on both. Instead of using super-powered age-verification to determine who gets the most privacy, and then using that same determination to restrict access to huge amounts of content, Congress should focus on creating strict privacy safeguards for everyone. Real privacy protections that prohibit data collection without opt-in consent address the concerns about children’s privacy while rendering age-verification unnecessary. Congress should get serious about protecting privacy and pass legislation that creates a strong, comprehensive privacy floor with robust enforcement tools.

On 11/19/2022 7:29 AM, Ed Stasiak wrote:
> https://forums.wdwmagic.com/attachments/thinkchild-jpg.561669/
>
> https://www.eff.org/deeplinks/2022/11/kosa-would-let-government-control-what-young-people-see-online
> NOVEMBER 17, 2022
>
> KOSA Would Let the Government Control What Young People See Online
>
> The latest version of the Kids Online Safety Act (KOSA) is focused on removing online information that people need to see—people of all ages. Letting governments—state or federal—decide what information anyone needs to see is a dangerous endeavor. On top of that, this bill, supposedly designed to protect our privacy, actually requires tech companies to collect more data on internet users than they already do.

Let alone, that it's a First Amendment violation.
>
> EFF has long supported comprehensive privacy protections, but the details matter. KOSA gets the details consistently wrong, and that’s why we’re calling on members of Congress to oppose this bill.
>
> Although KOSA has been revamped since lawmakers introduced it in February, and improved slightly, it’s still a dangerous bill that presents censorship and surveillance as a solution to some legitimate, and some not-so-legitimate, issues facing young internet users today.
>
> The Good
>
> KOSA is a sweeping update to the Children’s Online Privacy Protection Act, also known as COPPA. COPPA is the reason that many websites and platforms ask for you to confirm your age, and why many services require their users to be older than 13—because the laws protecting data privacy are much stricter for children than they are for adults. Legislators have been hoping to expand COPPA for years, and there have been good proposals to do so. KOSA, for its part, includes some good ideas: more people should be protected by privacy laws, and the bill expands COPPA’s protections to include minors under 16. That would do a world of good, in theory: the more people we can protect under COPPA, the better. But why stop with protecting the privacy of minors under 16? EFF has long supported comprehensive data privacy legislation for all users.
>
> Another good provision in KOSA would compel sites to allow minor users to delete their account and their personal data, and restrict the sharing of their geolocation data, as well as provide notice if they are tracking it. Again, EFF thinks all users—regardless of their age—should have these protections, and expanding them incrementally is better than the status quo.
>
> The Bad
>
> But KOSA’s chief focus is not to protect young people’s privacy. The bill’s main aim is to censor a broad swath of speech in response to concerns that young people are spending too much time on social media, and too often encountering harmful content. KOSA requires sites to “prevent and mitigate mental health disorders,” including by the promotion or exacerbation of “self-harm, suicide, eating disorders, and substance use disorders.” Make no mistake: this is a requirement that platforms censor content.
>
> This sweeping set of content restrictions wouldn’t just apply to Facebook or Instagram. Platforms covered by KOSA include “any online platform that connects to the internet and that is used, or is reasonably likely to be used, by a minor.” As we said before, this would likely encompass everything from Apple’s iMessage and Signal to web browsers, email applications and VPN software, as well as platforms like Reddit, Facebook, and TikTok—platforms with wildly different user bases and uses, and with hugely varying abilities, and expectations, to monitor content.
>
> A huge number of online services would thus be forced to make a choice: overfilter to ensure no one encounters content that could be construed as ambiguously harmful, or raise the age limit for users to 17. Many platforms may even do both.
>
> Let’s be clear about the dangerous consequences of KOSA’s censorship. Under its vague standard, both adults and children will not be able to access medical and health information online. This is because it will be next to impossible for a website to make case-by-case decisions about which content promotes self-harm or other disorders and which ones provide necessary health information and advice to those suffering from them. This will disparately impact children who lack the familial, social, financial, or other means to obtain health information elsewhere. (Research has shown that a large majority of young people have used the internet for health-related research.)
>
> Another example: KOSA also requires these services to ensure that young people do not see content that exacerbates a substance use disorder. On the face of it, that might seem fairly simple: just delete content that talks about drugs, or hide it from young people. But how do you find and label such content? Put simply: not all content that talks about drugs exacerbates their use.
>
> There is no realistic way to find and filter only that content without also removing a huge swath of content that is beneficial. For just one example, social media posts describing how to use naloxone, a medication that can reverse an overdose from opioids, could be viewed as either promoting self-harm, because it can reduce the potential danger of a fatal overdose, or as providing necessary health information. But KOSA’s vague standard means that a website owner is in a better position legally if they remove that information, which avoids a potential claim later that the information is harmful. That will reduce the availability of important and potentially life-saving information online. KOSA pushes website owners toward government-approved censorship.
>
> The Ugly
>
> To ensure that users are the correct age, KOSA compels vast data collection efforts that perversely result in even greater potential privacy invasions.
>
> KOSA would authorize a federal study on creating a device or operating system level age verification system, “including the need for potential hardware and software changes.” The end result would likely be an elaborate age-verification system, run by a third-party, that maintains an enormous database of all internet users’ data.
>
> Many of the risks of such a program are obvious. They require every user—including children—to hand private data over to a third-party simply to use a website if that user ever wants to see beyond the government’s “parental” controls.
>
> Moreover, the bill lets Congress decide what’s appropriate for children to view online. This verification scheme would make it much harder for actual parents to make individual choices for their own children. Because it’s so hard to differentiate between minors having discussions about many of these topics in a way that encourages them, as opposed to a way that discourages them, the safest course of action for services under this bill is to block all discussion and viewing of these topics by younger children and teenagers. If KOSA passes, instead of allowing parents to make the decision about what young people will see online, Congress will do it for them.
>
> A recent study on attitudes toward age verification showed that most parents “are willing to make an exception or allow their child to bypass the age requirement altogether, but then require direct oversight of the account or discussions about how to use the app safely.” Many also fudge the numbers a bit, to ensure that websites don’t have the specific birthdays of their children. With the hard-wired, national age verification system imagined by KOSA, it will be much harder, if not impossible, for parents to decide for themselves what sites and content a young person can encounter. Instead, the algorithm will do it for them.
>
> KOSA also fails to recognize the reality that some parents do not always have their childrens’ best interest in mind, or are unable to make appropriate decisions for them. Those children suffer under KOSA’s paternal regime, which requires services to set parental controls to their highest levels for those under thirteen.
>
> KOSA is a Poor Substitute for Real Privacy Online
>
> KOSA’s attempt to improve privacy and safety will in fact have negative impacts on both. Instead of using super-powered age-verification to determine who gets the most privacy, and then using that same determination to restrict access to huge amounts of content, Congress should focus on creating strict privacy safeguards for everyone. Real privacy protections that prohibit data collection without opt-in consent address the concerns about children’s privacy while rendering age-verification unnecessary. Congress should get serious about protecting privacy and pass legislation that creates a strong, comprehensive privacy floor with robust enforcement tools.
>

On Saturday, November 19, 2022 at 11:25:40 AM UTC-5, suzeeq wrote:
> On 11/19/2022 7:29 AM, Ed Stasiak wrote:
> > https://forums.wdwmagic.com/attachments/thinkchild-jpg.561669/
> >
> > https://www.eff.org/deeplinks/2022/11/kosa-would-let-government-control-what-young-people-see-online
> > NOVEMBER 17, 2022
> >
> > KOSA Would Let the Government Control What Young People See Online
> >
> > The latest version of the Kids Online Safety Act (KOSA) is focused on removing online information that people need to see—people of all ages. Letting governments—state or federal—decide what information anyone needs to see is a dangerous endeavor. On top of that, this bill, supposedly designed to protect our privacy, actually requires tech companies to collect more data on internet users than they already do.

> Let alone, that it's a First Amendment violation.

First they came for your free speech right to boycott and you said nothing....

.... because you thought the worst thing in the world was to be called an antisemite

https://www.google.com/search?q=thirty-five+anti-bds+state+laws

On 2022-11-19 10:29 a.m., Ed Stasiak wrote:
[snip]

Why are you making sense? Did you recently suffer a stroke or a blow to
the head? Or perhaps it's a sign of the Apocalypse ...

--
"To explain the unknown by the known is a logical procedure; to explain
the known by the unknown is a form of theological lunacy." ~David Brooks
"I get fooled all the time by the constant hosiery parade
in here." ~Checkmate

On Nov 19, 2022 at 7:29:51 AM PST, "Ed Stasiak" <edstasiak1067@gmail.com>
wrote:

> https://forums.wdwmagic.com/attachments/thinkchild-jpg.561669/
>
>
> https://www.eff.org/deeplinks/2022/11/kosa-would-let-government-control-what-young-people-see-online
> NOVEMBER 17, 2022
>
> KOSA Would Let the Government Control What Young People See Online
>
> The latest version of the Kids Online Safety Act (KOSA) is focused on
> removing online information that people need to see—people of all ages.
> Letting governments—state or federal—decide what information anyone needs to
> see is a dangerous endeavor. On top of that, this bill, supposedly designed
> to protect our privacy, actually requires tech companies to collect more data
> on internet users than they already do.

> Let’s be clear about the dangerous consequences of KOSA's censorship. Under
> its vague standard, both adults and children will not be able to access
> medical and health information online. This is because it will be next to
> impossible for a website to make case-by-case decisions about which content
> promotes self-harm or other disorders and which ones provide necessary health
> information and advice to those suffering from them. This will disparately
> impact children who lack the familial, social, financial, or other means to
> obtain health information elsewhere. (Research has shown that a large
> majority of young people have used the internet for health-related
> research.)
>
> Another example: KOSA also requires these services to ensure that young
> people do not see content that exacerbates a substance use disorder. On the
> face of it, that might seem fairly simple: just delete content that talks
> about drugs, or hide it from young people. But how do you find and label such
> content? Put simply: not all content that talks about drugs exacerbates their
> use.

And drugs aren't the only substances that are abused. What about alcohol? Will
web sites now be required to enter into a kind of neo-Prohibition, where
alcohol can't even be mentioned?

Once again, in the universe of Bad Ideas, California is there first. Much of
this KOPA bill is a direct copy-paste of California's own AB 2273 - the
Age-Appropriate Design Code Act. Think about this when Newsom runs for
president and proudly announces that he wants to bring California to the rest
of America.

https://www.techdirt.com/2022/06/29/california-legislators-seek-to-burn-down-the-internet-for-the-children/

The bill pretextually claims to protect children, but it will change the
internet for EVERYONE. In order to determine who is a child, websites and apps
will have to authenticate the age of ALL consumers before they can use the
service. NO ONE WANTS THIS. It will erect barriers to roaming around the
internet. Bye bye casual browsing. To do the authentication, businesses will
be forced to collect personal information they don't want to collect and
consumers don't want to give, and that data collection creates extra privacy
and security risks for everyone. Furthermore, age authentication usually also
requires identity authentication, and that will end anonymous/unattributed
online activity.

Second, even if businesses treated all consumers (i.e., adults) to the
heightened obligations required for children, businesses still could not
comply with this bill. That's because this bill is based on the U.K.
Age-Appropriate Design Code. European laws are often aspirational and
standards-based (instead of rule-based), because European regulators and
regulated businesses engage in dialogues, and the regulators reward good
tries, even if they aren't successful. We don't do "A-for-Effort" laws in the
U.S., and generally we rely on rules, not standards, to provide certainty to
businesses and reduce regulatory overreach and censorship.

Third, this bill reaches topics well beyond children's privacy. Instead, the
bill repeatedly implicates general consumer protection concerns and, most
troublingly, content moderation topics. This turns the bill into a trojan
horse for comprehensive regulation of internet services and would turn the
privacy-centric California Privacy Protection Agency/CPPA) into a general
purpose internet regulator.

So the big takeaway: this bill's protect-the-children framing is designed to
mislead everyone about the bill's scope. The bill will dramatically degrade
the internet experience for everyone and will empower a new censorship-focused
regulator who has no interest or expertise in balancing complex and competing
interests.

Who's Covered

The bill applies to a "business that provides an online service, product, or
feature likely to be accessed by a child". "Child" is defined as under-18, so
the bill treats teens and toddlers identically.

The phrase "likely to be accessed by a child means it is reasonable to expect,
based on the nature of the content, the associated marketing, the online
context, or academic or internal research, that the service, product, or
feature would be accessed by children". Compare how COPPA handles this issue;
it applies when services know (not anticipate) users are under-13 or direct
their services to an under-13 audience. In contrast, the bill says that if
it's reasonable to expect ONE under-18 user, the business must comply with its
requirements. With that over-expansive framing, few websites and apps can
reasonably expect that under-18s will NEVER use their services. Thus, I
believe all websites/apps are covered by this law so long as they clear the
CPRA quantitative thresholds for being a "business". [Note: it's not clear how
this bill situates into the CPRA, but I think the CPRA's "business" definition
applies.]

What’s Required

The bill starts with this aspirational statement: "Companies that develop and
provide online services, products, or features that children are likely to
access should consider the best interests of children when designing,
developing, and providing that service, product, or feature." The "should
consider" grammar is the kind of regulatory aspiration found in European law.
Does this statement have legal consequences or not? I vote it does not because
"should" is not a compulsory obligation. So what is it doing here?

More generally, this provision tries to anchor the bill in the notion that
businesses owe a "duty of loyalty" or fiduciary duty to their consumers. This
duty-based approach to privacy regulation is trendy in privacy circles, but if
adopted, it would exponentially expand regulatory oversight of businesses'
decisions. Regulators (and private plaintiffs) can always second-guess a
business' decision; a duty of "loyalty" gives the regulators the unlimited
power to insist that the business made wrong calls and impose punishments
accordingly. We usually see fiduciary/loyalty obligations in the professional
services context where the professional service provider must put an
individual customer's needs before its own profit. Expanding this concept to
mass-market businesses with millions of consumers would take us into uncharted
regulatory territory.

The bill would obligate regulated businesses to:

--Do data protection impact assessments (DPIAs) for any features likely to be
accessed by kids (i.e., all features), provide a "report of the assessment" to
the CPPA, and update the DPIA at least every 2 years.

--"Establish the age of consumers with a reasonable level of certainty
appropriate to the risks that arise from the data management practices of the
business, or apply the privacy and data protections afforded to children to
all consumers." As discussed below, this is a poison pill for the internet.
This also exposes part of the true agenda here: If a business can't do what
the bill requires (a common consequence), the bill drives businesses to adopt
the most restrictive regulation for everyone, including adults.

--Configure default settings to a "high level of privacy protection", whatever
that means. I think this meant to say that kids should automatically get the
highest privacy settings offered by the business, whatever that level is, but
it's not what it says. Instead, this becomes an aspirational statement about
what constitutes a "high level" of protection.

--All disclosures must be made "concisely, prominently, and using clear
language suited to the age of children likely to access" the service. The
disclosures in play are "privacy information, terms of service, policies, and
community standards". Note how this reaches all consumer disclosures, not just
those that are privacy-focused. This is the first of several times we'll see
the bill's power grab beyond privacy. Also, if a single toddler is "likely" to
access the service, must all disclosures must be written at toddlers' reading
level?

--Provide an "obvious signal" if parents can monitor their kids' activities
online. How does this intersect with COPPA?

--"Enforce published terms, policies, and community standards established by
the business, including, but not limited to, privacy policies and those
concerning children." This language unambiguously governs all consumer
disclosures, not just privacy-focused ones. Interpreted literally, it's
ludicrous to mandate businesses enforce every provision in their TOSes. If a
consumer breaches a TOS by scraping content or posting violative content--
which can happen thousands of times per day-- does this provision require
businesses to file thousands of lawsuits every day to enforce their provisions
for breach of contract? More generally, this provision directly overlaps AB
587, which requires businesses to disclose their editorial policies and gives
regulators the power to investigate and enforce any perceived or alleged
deviations how services moderate content. See my excoriation of AB 587. This
provision is a trojan horse for government censorship that has nothing to do
with protecting the kids or even privacy. Plus, even if it weren't an
unconstitutional provision, the CPPA, with its privacy focus, lacks the
expertise to monitor/enforce content moderation decisions.

Ed Stasiak <edstasiak1067@gmail.com> wrote:

>https://www.eff.org/deeplinks/2022/11/kosa-would-let-government-control-wha=
>t-young-people-see-online

>NOVEMBER 17, 2022

>KOSA Would Let the Government Control What Young People See Online

>. . .

>The Bad

>But KOSA=E2=80=99s chief focus is not to protect young people=E2=80=99s pri=
>vacy. The bill=E2=80=99s main aim is to censor a broad swath of speech in r=
>esponse to concerns that young people are spending too much time on social =
>media, and too often encountering harmful content. KOSA requires sites to =
>=E2=80=9Cprevent and mitigate mental health disorders,=E2=80=9D including b=
>y the promotion or exacerbation of =E2=80=9Cself-harm, suicide, eating diso=
>rders, and substance use disorders.=E2=80=9D Make no mistake: this is a req=
>uirement that platforms censor content.

It's not just censorship but utterly deluded. How do you demonstrate
that content is possibly harmful? Someone could read an entirely
truthful medical report discussing mortality by accident and use that to
consider methods of suicide, or a report on substance abuse to learn
what drugs being abused are currently widely available for sale.

Or, someone could read a terrible story of a tragic death due to
substance abuse and think, I'm going to change my life to avoid that
likely outcome.

How do you predict the future outcome for good or ill?

Terrible terrible proposed legislation. Thanks for pointing it out.

>. . .