EFF argues the KIDS Act's 'covered platform' definition is so broad it sweeps in Discord, GitHub, Stack Overflow, indie forums, and blog comment sections — anywhere users connect over UGC. They contend 'reasonable measures' is a euphemism that inevitably collapses into government ID uploads, third-party verification vendors, or face scans, because self-attestation by definition fails the standard.
By submitting the EFF piece under the framing 'Kids Act would require age checks to get online,' the submitter endorses the reading that the bill's reach extends far past social media into general web access. The 195-point score reflects HN's broad agreement that the scope is the story.
The editorial frames KIDS as the federal sibling to already-passed Utah, Texas, and Mississippi laws, noting the Supreme Court's Free Speech Coalition v. Paxton ruling narrowed the First Amendment ceiling against age-gating. With bipartisan sponsorship, the piece argues age verification will become a default web primitive — the next GDPR-style global UX tax that developers will have to build around regardless of their politics.
The Electronic Frontier Foundation published a deep-dive on the Kids Off Social Media Act (KIDS Act), the latest federal attempt to bolt age verification onto the open web. The piece hit 195 on Hacker News, with the comment thread doing what HN threads do best on this topic: methodically taking apart the bill's definition of a 'covered platform' and finding that it doesn't stop at TikTok.
The bill's text would require platforms to take 'reasonable measures' to determine whether a user is under 13 (banned outright) or under 17 (defaults to no algorithmic feed, no targeted ads, restricted hours). The covered-platform definition pulls in any service that 'connects users' and serves user-generated content — a description that, read literally, covers Discord, GitHub discussions, Stack Overflow, Substack comments, your indie forum, and the comment section on a recipe blog. EFF's argument is that 'reasonable measures' is a euphemism: once a regulator has to define it, it converges on government ID, third-party verification vendors, or face scans — because self-attestation is, by definition, not reasonable.
This is not the first run at this. Utah, Texas, and Mississippi have already passed state-level versions; the Supreme Court upheld Texas's HB 1181 in *Free Speech Coalition v. Paxton* last year, sharply narrowing the First Amendment ceiling on age-gating. The KIDS Act is the federal sibling, and it's moving with bipartisan sponsorship — which is the part that should make you pay attention regardless of which way you vote.
The framing in most coverage is civil liberties: anonymous speech, surveillance, the chilling effect on adults who don't want to upload a driver's license to read a blog. That framing is correct but incomplete. The more immediate consequence for anyone building product is that age verification becomes a default primitive of the web stack — the same way GDPR turned cookie banners into a global UX tax that nobody asked for and everybody implements badly.
Look at how France's *vérification d'âge* mandate played out for adult sites in 2024: the major platforms geo-blocked France rather than build verification. The smaller ones either complied with sketchy third-party vendors or quietly shipped a checkbox and waited to get sued. The EU's *Digital Services Act* age-assurance pilot is heading the same direction — toward a 'wallet' model where users prove age via a government-issued credential and sites query it. That sounds clean on a slide. In practice, it means a new oracle that every site has to integrate with, a new vendor market full of startups that will eventually get breached, and a new chokepoint that authoritarian governments love because once age is verifiable, so is identity.
The HN thread surfaced the other quiet problem: enforcement asymmetry. A US federal age-verification regime would be enforced against US-incorporated platforms first, which means Mastodon instances run by a hobbyist in Vermont and the side-project SaaS you're building right now. The platforms that genuinely host the harms the bill claims to address — large foreign-controlled apps with sophisticated legal teams — will fight, settle, or geo-fence. The compliance burden lands hardest on small operators who can't afford a vendor like Yoti or Persona, which is the opposite of what the bill's authors say they want.
It's worth comparing the KIDS Act to the UK's Online Safety Act, which started shipping its age-assurance requirements in 2025. Bluesky, Reddit, and Wikipedia have all publicly described the implementation cost in engineer-quarters and legal-review hours. Wikipedia's foundation has openly said it may pull out of UK access rather than comply, because the act's definition of 'high-risk content' is broad enough to swallow the encyclopedia. The KIDS Act's drafting has the same problem — broad definitions, narrow safe harbors, enforcement by FTC.
If you ship anything with a signup form, here's the concrete checklist this bill would force onto your roadmap. Every anonymous read path becomes a liability your legal team has to either price or eliminate, and every account creation becomes a KYC flow with a vendor in the loop.
First, your auth layer changes. The 'sign in with Google' button is no longer sufficient because Google's age signal is self-attested. You either integrate a verification vendor (Yoti, Persona, Stripe Identity, Veriff — pick your future RIF target) or you build the integration in-house against a state-issued credential API that doesn't fully exist yet. Either way, you're adding a 200ms-to-3s blocker on signup, which will tank conversion. Plan for it now if you're a B2C company; talk to your auth provider about their roadmap if you're not.
Second, your data retention story gets harder. The bill, like its state cousins, doesn't explicitly require you to *store* the ID — but compliance auditors will want proof you checked, which means you store a hash, a token, a vendor attestation, or all three. Each of those is a new field on your user table, a new GDPR/CCPA disclosure, a new breach-notification surface. The minimum viable defensive posture is to outsource the storage entirely to the vendor and keep only a boolean — but that locks you into a vendor that will raise prices the moment regulation is final.
Third, the rate of legal change accelerates. State laws are already a patchwork (Utah doesn't match Texas doesn't match California's recent AB 1043 push). A federal law would preempt some but not all of it, and the interaction with the EU's DSA and the UK's OSA means you're now tracking three regulatory regimes for the same feature. If you're a 20-person startup, this is the kind of overhead that historically meant 'don't ship in jurisdiction X.' Expect more geo-blocking.
The bill's odds of passing this session are unclear, but the direction is not — every Western jurisdiction is converging on mandatory age assurance, and the technical infrastructure to support it is being built whether the KIDS Act passes or not. The question for practitioners isn't whether to plan for this but when to start. Treat verifiable credentials and age-assurance vendor integration the way you treated GDPR consent management in 2017: a thing you wish wasn't your problem, but one that will be a checkbox on every enterprise sales call within 18 months.
So.. https://www.congress.gov/bill/119th-congress/house-bill/7757...Find your rep on congress.gov, and write them.Sponsors: Brett Guthrie (R-KY) CoSponsors: Frank Pallone (D-NJ)Find and write your congress member: https://www.congress.gov/Guthrie is spons
I just listened to a radio program on my local NPR station about the topic of kids and social media. From what was presented, the research shows (longitudinal study) that there is very little evidence of social media impacting mental health--which is shocking because a majority of adults think there
This should be up to parents to parent. If their child has social media, or viewing sites that are for adults then the parents should be fined. In the US every weekend teens are shooting each other, i think we have bigger concerns than them being online
I remember when the advice was to NOT give out your personal information online.Now it's "present your personal info when demanded or else".
Top 10 dev stories every morning at 8am UTC. AI-curated. Retro terminal HTML email.
Anybody else think it is weird that suddenly all Western countries suddenly want to lockdown the internet to "protect the children"? There is surely an international special interest group lobbying for this?