# OCSS — Open Child Safety Specification

> OCSS (the Open Child Safety Specification) is an open, vendor-neutral, royalty-free standard for how parental-control apps, platforms, schools, and regulators exchange and enforce verified child-safety signals. It defines a sealed signal envelope, a four-role trust framework, a governed registry of 133 enforceable rule categories across nine capabilities, a conformance suite, and a receipt rail — mapping 91 child-safety statutes to implementable rules.

Buildable by anyone, owned by no one. The specification, the rule registry, and governance are open and royalty-free. Build child-safety protections once; enforce them everywhere.

## The standard

- [The Standard](https://openchildsafety.org/standard): the OCSS specification — the sealed envelope, the four roles, the four verbs, the abuse-signal vocabulary, and the binary conformance contract
- [Trust & Conformance](https://openchildsafety.org/trust): the Trust List, the three accreditation lanes, and the conformance suite that verifies every claim
- [Governance](https://openchildsafety.org/governance): stewardship, succession, the change process, and the anti-capture rules that keep OCSS vendor-neutral
- [Resources & Docs](https://openchildsafety.org/resources): read the standard and the developer documentation

## The rule registry

The governed registry defines 133 enforceable rule categories across nine capabilities — Age (11), Tier (22), Consent (16), Block (28), Privacy (14), Alert (21), Audit (13), Receipt (8). 64 are provisional (forward-looking, no mapped statute yet); the rest are statute-anchored, and every rule traces to the statutes it helps enforce.

## Compliance

- 91 child-safety statutes across US federal and state, EU, UK, and international jurisdictions (54 enacted, 37 pending), each mapped to OCSS rule categories.

## Join

- [Join the Coalition](https://openchildsafety.org/join): help shape the taxonomy, the conformance contract, and how trust is granted
- [Status](https://openchildsafety.org/status): conformance-suite progress and the ship-gate
- [Changelog](https://openchildsafety.org/changelog): what changed across drafts

## All 133 rule categories, by capability

### Age (11)

- `rating_age_gate` — provisional (no statutes yet)
- `age_gate` — 34 statute(s)
- `adult_site_av_required` — 22 statute(s)
- `app_store_age_attestation` — 3 statute(s)
- `os_age_signal_ingest` — 2 statute(s)
- `age_signal_broadcast` — 1 statute(s)
- `hard_id_verification_escalation` — provisional (no statutes yet)
- `social_media_min_age` — 7 statute(s)
- `ai_chatbot_age_assertion` — 4 statute(s)
- `teen_minimum_age_16_gate` — 1 statute(s)
- `age_appropriate_profile_mode` — 8 statute(s)

### Tier (22)

- `content_rating` — 4 statute(s)
- `violence_threshold` — provisional (no statutes yet)
- `sexual_content_threshold` — provisional (no statutes yet)
- `profanity_threshold` — provisional (no statutes yet)
- `commercial_pressure_threshold` — 1 statute(s)
- `substance_content_threshold` — provisional (no statutes yet)
- `recognized_seal_allowlist` — provisional (no statutes yet)
- `social_chat_control` — provisional (no statutes yet)
- `web_filter_level` — 6 statute(s)
- `privacy_rating_tier_gate` — provisional (no statutes yet)
- `privacy_rating_score_threshold` — provisional (no statutes yet)
- `privacy_rating_dimension_gate` — provisional (no statutes yet)
- `privacy_seal_required` — provisional (no statutes yet)
- `unrated_privacy_default` — provisional (no statutes yet)
- `ai_chatbot_tier_gate` — 2 statute(s)
- `ai_product_classification_gate` — 1 statute(s)
- `ai_safety_rating_threshold` — provisional (no statutes yet)
- `ai_data_responsibility_rating_threshold` — provisional (no statutes yet)
- `ai_transparency_rating_threshold` — provisional (no statutes yet)
- `ai_minor_interaction` — 2 statute(s)
- `streaming_age_rating_enforce` — 1 statute(s)
- `ugc_world_age_gate` — provisional (no statutes yet)

### Consent (16)

- `time_daily_limit` — 1 statute(s)
- `time_scheduled_hours` — 5 statute(s)
- `time_per_app_limit` — provisional (no statutes yet)
- `time_downtime` — 2 statute(s)
- `phone_free_school_hours` — 4 statute(s)
- `purchase_approval` — 1 statute(s)
- `purchase_spending_cap` — provisional (no statutes yet)
- `social_contacts` — provisional (no statutes yet)
- `social_multiplayer` — provisional (no statutes yet)
- `stranger_outreach_friction` — 1 statute(s)
- `privacy_account_creation` — provisional (no statutes yet)
- `parental_consent_gate` — 36 statute(s)
- `notification_curfew` — 3 statute(s)
- `dumbphone_migration_mode` — provisional (no statutes yet)
- `child_request_approval` — provisional (no statutes yet)
- `geofence_zone` — provisional (no statutes yet)

### Block (28)

- `content_block_title` — provisional (no statutes yet)
- `content_allow_title` — provisional (no statutes yet)
- `content_allowlist_mode` — provisional (no statutes yet)
- `content_descriptor_block` — provisional (no statutes yet)
- `firearm_content_block` — provisional (no statutes yet)
- `not_for_minors_block` — provisional (no statutes yet)
- `purchase_block_iap` — 1 statute(s)
- `stranger_dm_block` — 1 statute(s)
- `web_safesearch` — 1 statute(s)
- `web_category_block` — 3 statute(s)
- `web_custom_allowlist` — provisional (no statutes yet)
- `web_custom_blocklist` — provisional (no statutes yet)
- `dm_restriction` — 7 statute(s)
- `ai_no_simulated_companionship` — 4 statute(s)
- `ai_no_unsupervised_therapy` — 1 statute(s)
- `ai_no_self_harm_promotion` — 2 statute(s)
- `ai_no_csam_generation` — 2 statute(s)
- `ai_no_personhood_deception` — 1 statute(s)
- `ai_companion_block` — 3 statute(s)
- `library_filter_compliance` — provisional (no statutes yet)
- `gambling_mechanics_block` — 1 statute(s)
- `addictive_pattern_block` — 2 statute(s)
- `app_install_block` — 4 statute(s)
- `voice_chat_minor_limit` — provisional (no statutes yet)
- `ephemeral_message_disable` — provisional (no statutes yet)
- `dm_feature_disable` — provisional (no statutes yet)
- `named_contact_block` — provisional (no statutes yet)
- `native_call_block` — provisional (no statutes yet)

### Privacy (14)

- `privacy_location` — provisional (no statutes yet)
- `privacy_profile_visibility` — 1 statute(s)
- `privacy_data_sharing` — 17 statute(s)
- `data_minimization_enforce` — 3 statute(s)
- `third_party_tracker_block` — 1 statute(s)
- `geolocation_precision_cap` — provisional (no statutes yet)
- `targeted_ad_block` — 16 statute(s)
- `data_deletion_request` — 9 statute(s)
- `geolocation_opt_in` — 7 statute(s)
- `ai_training_data_opt_out` — provisional (no statutes yet)
- `image_rights_minor` — 1 statute(s)
- `student_privacy_school_mode` — 1 statute(s)
- `commercial_data_ban` — 11 statute(s)
- `presence_status_hide` — provisional (no statutes yet)

### Alert (21)

- `educational_credit` — provisional (no statutes yet)
- `monitoring_activity` — 2 statute(s)
- `monitoring_alerts` — provisional (no statutes yet)
- `social_account_content_monitoring` — provisional (no statutes yet)
- `message_content_monitoring` — provisional (no statutes yet)
- `image_content_monitoring` — provisional (no statutes yet)
- `search_query_monitoring` — provisional (no statutes yet)
- `flagged_content_digest` — provisional (no statutes yet)
- `usage_timer_notification` — 2 statute(s)
- `parental_event_notification` — 5 statute(s)
- `screen_time_report` — 6 statute(s)
- `social_media_warning_label_render` — provisional (no statutes yet)
- `digital_literacy_curriculum_link` — provisional (no statutes yet)
- `school_alert_routing` — 1 statute(s)
- `crisis_resource_surface` — provisional (no statutes yet)
- `native_call_monitoring` — provisional (no statutes yet)
- `email_content_monitoring` — provisional (no statutes yet)
- `screen_activity_monitoring` — provisional (no statutes yet)
- `stranger_contact_alert` — provisional (no statutes yet)
- `panic_sos` — provisional (no statutes yet)
- `harm_detection_sensitivity` — provisional (no statutes yet)

### Audit (13)

- `prosocial_weight` — provisional (no statutes yet)
- `role_model_weight` — provisional (no statutes yet)
- `representation_weight` — provisional (no statutes yet)
- `dpia_request_generator` — 1 statute(s)
- `algo_feed_control` — 6 statute(s)
- `addictive_design_control` — 15 statute(s)
- `infinite_scroll_block` — 2 statute(s)
- `autoplay_disable` — 3 statute(s)
- `ai_no_engagement_dark_patterns` — 2 statute(s)
- `ai_synthetic_media_disclosure` — 1 statute(s)
- `algorithmic_audit` — 13 statute(s)
- `cipa_filter_attestation` — 1 statute(s)
- `tamper_attestation` — provisional (no statutes yet)

### Receipt (8)

- `minor_data_sale_audit_log` — 1 statute(s)
- `parental_attestation_cert` — 1 statute(s)
- `ai_toy_safety_cert` — 1 statute(s)
- `csam_reporting` — 6 statute(s)
- `esafety_commission_reporting` — 1 statute(s)
- `platform_liability_evidence_capture` — 2 statute(s)
- `ncii_takedown` — 2 statute(s)
- `harm_report_intake` — provisional (no statutes yet)

## All 91 mapped statutes

- **KOSA** — Kids Online Safety Act (United States (Federal); pending): Establishes a duty of care for platforms, requiring them to disable addictive features and algorithmic feeds for minors by default.
- **COPPA 2.0** — Children's Online Privacy Protection Act 2.0 (United States (Federal); pending): Extends COPPA to teens under 17, bans all targeted advertising to minors, and creates an Eraser Button for data deletion. Passed the Senate 91-3 as part of KOSMA in July 2024 (118th Congress) but the House never voted and the bill expired Jan 3, 2025. Reintroduced in the 119th Congress as S.836 (Senate, March 2025, Senators Markey & Cassidy) and H.R.6291 (House, November 2025). Not yet signed into law.
- **KOSMA** — Kids Online Safety & Media Act (United States (Federal); pending): Combined KOSA + COPPA 2.0 package extending protections to all minors under 17, with mandatory age verification. Passed the Senate 91-3 in July 2024 (118th Congress) but the House never voted and the bill expired on Jan 3, 2025. Must be reintroduced and repassed in the 119th Congress. Component bills KOSA and COPPA 2.0 have been individually reintroduced.
- **FTC COPPA Rule** — Federal Trade Commission COPPA Rule (United States (Federal); enacted): The FTC's COPPA enforcement rule requiring verifiable parental consent for data collection on children under 13. The FTC finalized major amendments in January 2025 (5-0 vote), published in the Federal Register on April 22, 2025, with legal effect June 23, 2025 and a full compliance deadline of April 22, 2026. The 2025 amendments add mandatory information security programs, data retention/deletion policies, enhanced direct notice requirements, expanded personal information definitions (biometrics, government IDs), new consent methods, and separate consent for third-party data sharing.
- **CIPA** — Children's Internet Protection Act (United States (Federal); enacted): Requires schools and libraries receiving E-Rate funding to implement internet safety policies and content filters to protect children from harmful online content.
- **EARN IT Act** — Eliminating Abusive and Rampant Neglect of Interactive Technologies Act (United States (Federal); proposed): Proposes to hold platforms accountable for CSAM by modifying Section 230 protections and establishing best practices for preventing child exploitation.
- **FOSTA-SESTA** — Allow States and Victims to Fight Online Sex Trafficking Act (United States (Federal); enacted): Amends Section 230 to hold platforms liable for facilitating sex trafficking. Requires platforms to actively monitor for and remove trafficking content involving minors.
- **Federal App Store Accountability Act** — App Store Accountability Act of 2025 (S.1829 / H.R.3935) (United States; pending): Federal version of Utah's ASAA. Mandates app store operators verify each user's age category, obtain verifiable parental consent before a minor downloads an app or makes an in-app purchase, and share an age-category attestation with downstream apps under data-minimization and industry-standard-encryption requirements. Apps relying on the store's signal receive a liability safe harbor. (The statute does not itself mandate zero-knowledge proofs or document deletion — that is an implementation choice.)
- **SCREEN Act** — Shielding Children's Retinas from Egregious Exposure on the Net Act (SCREEN Act) (United States; pending): Federal device-level + ISP-level age verification for online pornography access. Targets the gap that state-level porn-AV laws (TX HB 1181, LA Act 440) only address platform compliance — SCREEN Act extends the requirement device-side and ISP-side.
- **CA SB 976** — California Age-Appropriate Design Code (California, United States; enacted): Bans addictive feeds and notifications during school hours for minors. Platforms must default to chronological feeds.
- **VA SB 854** — Virginia Child Safety Act (Virginia, United States; enacted): Requires platforms to suppress non-essential notifications during nighttime and provide configurable screen time limits.
- **NY SAFE for Kids** — New York SAFE for Kids Act (New York, United States; enacted): Prohibits addictive algorithmic feeds for minors without parental consent and mandates notification-free quiet hours.
- **CT SB 3** — Connecticut SB 3 (Connecticut, United States; enacted): Connecticut law protecting minors from addictive platform features and restricting unsolicited contact. Requires platforms to default to safest settings for accounts identified as minors.
- **FL HB 3** — Florida Social Media Act (Florida, United States; injunction): Florida law requiring age verification for social media platforms and prohibiting minors under 14 from holding accounts. Minors 14-15 need parental consent.
- **MN HF 2** — Minnesota Usage Awareness (Minnesota, United States; proposed): Minnesota bill requiring platforms to implement usage awareness tools for minor users, including periodic screen time reminders and usage dashboards.
- **TN HB 1891** — Tennessee Screen Time Act (Tennessee, United States; enacted): Tennessee law requiring social media platforms to implement screen time awareness features for minor users, including configurable usage timer notifications.
- **NY NYCDPA** — New York Child Data Protection Act (New York, United States; proposed): New York Child Data Protection Act focusing on commercial data collection from minors, with strong data minimization and deletion rights for child accounts.
- **MD Kids Code** — Maryland Kids Code (Maryland, United States; enacted): Maryland Age-Appropriate Design Code requiring platforms to default to maximum privacy settings for minors, including geolocation disabled by default and data protection impact assessments.
- **TX SCOPE Act** — Texas Securing Children Online through Parental Empowerment Act (Texas, United States; injunction): Texas law requiring parental consent for minors to access social media, with age verification requirements and monitoring provisions for platforms serving minors.
- **UT SMRA** — Utah Social Media Regulation Act (Utah, United States; enacted): Utah law imposing curfews on minor social media use, requiring age verification, and banning addictive design features targeting minors.
- **UT App Store Accountability Act** — Utah App Store Accountability Act (SB 142, 2025) (Utah, United States; enacted): First-in-nation law shifting the age-verification and parental-consent burden from individual apps to the app-store operator. Requires Apple and Google to verify the age of every Utah user and obtain verifiable parental consent before a minor downloads an app. Per-app re-verification becomes unnecessary once the OS-tier attestation exists.
- **UT Phone-Free Schools** — Utah Phone-Free Schools Policy Act (Utah, United States; enacted): Directs Utah public schools to adopt bell-to-bell phone-free policies during instructional hours. Student personal devices must be stored or otherwise inaccessible during class time, with documented exceptions for medical, IEP/504, and ELL needs.
- **LA Act 456** — Louisiana Act 456 (Louisiana, United States; injunction): Louisiana law requiring age verification for social media platforms and restricting minor access without parental consent.
- **LA HB 1** — Louisiana HB 1 (2024) — Statewide School Phone Ban (Louisiana, United States; enacted): Louisiana's statewide ban on student cellphone use throughout the school day in public K-12 schools. Devices must be off and out of sight from the first bell to the last, with school-board-approved exceptions for documented health, learning, or safety needs.
- **OH HB 33** — Ohio Social Media Parental Notification Act (Ohio, United States; injunction): Ohio law requiring platforms to obtain parental consent for users under 16, with restrictions on direct messaging to minor accounts.
- **VT S69** — Vermont Age-Appropriate Design Code (Vermont, United States; enacted): Vermont age-appropriate design code requiring platforms to disable addictive design features, ban targeted ads, and default geolocation to off for minors.
- **MA S2619** — Massachusetts S2619 (Massachusetts, United States; passed): Massachusetts bill targeting dark patterns and addictive design in platforms used by minors, with bans on targeted advertising to children.
- **AR Age Verify** — Arkansas Social Media Safety Act (Arkansas, United States; injunction): Arkansas law requiring age verification for social media platforms and prohibiting minors under 18 from creating accounts without parental consent.
- **TX HB 1181** — Texas HB 1181 — Pornography Age Verification Act (Texas, United States; enacted): Texas law requiring commercial pornography websites to verify the age of every user via government ID or transactional data. Survived SCOTUS challenge in Free Speech Coalition v. Paxton (June 2025) — important precedent.
- **LA Act 440** — Louisiana Act 440 — Pornography Age Verification (Louisiana, United States; enacted): First-in-nation state porn-AV law requiring commercial pornography websites to verify user age via the state's LA Wallet digital ID system or equivalent. Inspired the wave of state porn-AV laws (TX HB 1181, AR, NC, VA, OH, MS, etc.).
- **CA Addiction Act** — California Social Media Addiction Act (California, United States; enacted): California law restricting notification delivery to minors during school hours and banning addictive design features that target children.
- **PA SB 378** — Pennsylvania Student Data Privacy Act (Pennsylvania, United States; passed): Establishes rules for how Pennsylvania public schools and their third-party vendors collect, store, and share student data. Increases transparency for parents, creates accountability mechanisms for vendors, and requires verifiable parental consent for specified data-collection activities involving minors.
- **PA SB 1014** — Pennsylvania Cell Phone-Free Schools Act (Pennsylvania, United States; passed): Requires all public schools in Pennsylvania to implement bell-to-bell phone-free policies. Students must store devices in lockers or locking pouches during school hours, with exceptions for medical needs, IEP/504 plans, and ELL accommodations.
- **PA HB 1814** — Pennsylvania Public School Code — Cell Phone Possession and Use (Pennsylvania, United States; pending): Companion bill to SB 1014 amending the Public School Code to establish statewide phone-free school policies. Sponsored by Rep. Mandy Steele with 17 co-sponsors and PSEA (Pennsylvania State Education Association) support.
- **PA Online Safety** — Pennsylvania Online Safety Protection Act (Pennsylvania, United States; proposed): Kids Code / KOSA-style legislation requiring platforms to conduct data protection impact assessments before launching services for minors. Prohibits collecting or selling child geolocation data, profiling children by default, and using design patterns that lead children to provide personal information.
- **PA AI Children** — Pennsylvania Regulating AI for Children Act (Pennsylvania, United States; proposed): Regulates AI interactions with minors by requiring age verification for AI services, prohibiting minors from using AI companion chatbots, and criminalizing AI systems that solicit sexually explicit content from or encourage self-harm in minors. Penalties up to $100,000 per violation.
- **EU DSA** — Digital Services Act (European Union (27 member states); enacted): Comprehensive EU regulation banning targeted ads to minors and requiring risk assessments for algorithmic systems.
- **GDPR Art. 8** — GDPR Article 8 Child Consent (European Union (27 member states); enacted): GDPR Article 8 establishes conditions for child consent to data processing, requiring parental consent for children under 16 (or 13, depending on member state).
- **EU AI Act** — EU AI Act Minor Provisions (European Union (27 member states); enacted): The EU AI Act includes specific provisions protecting minors from AI systems that exploit vulnerabilities, manipulate behavior, or use subliminal techniques harmful to children.
- **FR SREN** — France SREN + Image Rights Law (France; enacted): French law requiring age verification for accessing certain online content and establishing image rights protections for minors, including provisions against sharenting.
- **UK AADC** — UK Age Appropriate Design Code (United Kingdom; enacted): Duty of care requiring platforms to protect children from harmful content, restrict adult-child DMs, and implement age verification.
- **UK OSA** — UK Online Safety Act 2023 (United Kingdom; enacted): UK law imposing a duty of care on platforms to protect children from harmful content online. Requires age verification and proactive measures to prevent children encountering harmful material.
- **DE JMStV** — Germany Youth Media State Treaty (Germany; enacted): German interstate treaty governing youth protection in media, requiring content classification, age verification, and filtering for online services accessible by minors.
- **IE OSMRA** — Ireland Online Safety and Media Regulation Act 2022 (Ireland; enacted): Irish law establishing Coimisiún na Meán as online safety regulator, with powers to issue binding online safety codes and designate platforms for compliance obligations protecting children.
- **ES Digital Minors** — Spain Organic Law on Minors in Digital Environments (Spain; enacted): Spain's comprehensive law protecting minors in digital environments, requiring age verification, parental consent, and prohibiting addictive design patterns targeting children.
- **IT Agcom AV** — Italy Agcom Age Verification Decree (Italy; enacted): Italy's age verification decree issued by communications authority Agcom, requiring robust age checks and content filtering for minors.
- **EU CSAR** — EU Child Sexual Abuse Regulation (Chat Control) (eu; proposed): Proposed EU regulation requiring platforms to detect and report child sexual abuse material, including scanning of private communications.
- **AU OSA** — Australia Online Safety Act (Australia; enacted): Establishes the eSafety Commissioner with powers to enforce age verification and removal of content harmful to children.
- **India DPDPA** — Digital Personal Data Protection Act (India; enacted): Complete ban on behavioral monitoring and targeted advertising directed at children. Verifiable parental consent required.
- **AU SMMA** — Australia Social Media Minimum Age Act 2024 (Australia; enacted): Australian law establishing a minimum age of 16 for social media access, with significant penalties for platforms that fail to enforce age verification.
- **ID GR 17** — Indonesia GR 17/2025 on Child Protection (Indonesia; enacted): Indonesian government regulation requiring platforms to implement age verification, content rating, and privacy protections for children accessing digital services.
- **SG PDPA** — Singapore PDPA Child Guidelines (Singapore; enacted): Singapore's Personal Data Protection Commission guidelines on collecting, using, and disclosing personal data of children, emphasizing consent and data protection.
- **JP YIEA** — Japan Youth Internet Environment Act (Japan; enacted): Japanese law requiring ISPs and device manufacturers to provide content filtering for minors, promoting a safe internet environment for young people.
- **KR JPA** — South Korea Juvenile Protection Act (South Korea; enacted): South Korean law restricting minors' access to online games during nighttime hours and requiring content rating for all games and media accessible to juveniles.
- **KR PIPA** — South Korea Personal Information Protection Act (South Korea; enacted): South Korea's comprehensive data protection law with strengthened provisions for children's personal information, requiring parental consent and restricting data processing for minors.
- **NZ SM Proposal** — New Zealand Social Media Age Proposal (New Zealand; proposed): New Zealand government proposal to establish a minimum age for social media access, modeled on Australia's Social Media Minimum Age Act.
- **TH PDPA** — Thailand Personal Data Protection Act (PDPA) (Thailand; enacted): Thailand's data protection law requiring parental consent for processing data of minors under 20, with strict privacy safeguards.
- **CA Bill C-63** — Canada Online Harms Act (Bill C-63) (Canada; proposed): Canadian bill establishing a duty of care for online platforms to protect children from harmful content, with specific provisions for CSAM reporting and addictive design restrictions.
- **BR LGPD** — Brazil LGPD Child Provisions + Digital ECA (Brazil; enacted): Brazil's data protection law includes specific child provisions banning targeted advertising to minors, supplemented by the Digital ECA bill strengthening children's digital rights.
- **MX LFPDPPP** — Mexico Data Protection Law 2025 (Mexico; enacted): Mexican federal data protection law with provisions for minors' personal data, requiring parental consent and data protection measures for children's information.
- **CL PDP** — Chile Personal Data Protection Bill (Chile; pending): Chilean personal data protection bill with specific provisions for children's data, establishing a data protection authority and rights including data deletion for minors.
- **CO Ley 2300** — Colombia Ley 2300 Data Protection Updates (Colombia; enacted): Colombia's updated data protection law strengthening privacy protections for minors with enhanced parental consent requirements.
- **UAE Decree 26** — UAE Child Digital Safety Law (United Arab Emirates; enacted): UAE law establishing comprehensive child digital safety requirements, including age verification, targeted ad bans, privacy protections, and restrictions on addictive design for platforms serving children under 13.
- **PH COTG** — Philippines Child Transparency Guidelines (Philippines; enacted): Philippines National Privacy Commission guidelines on transparency requirements for processing children's personal data, emphasizing best interests and data protection.
- **SA PDPL** — Saudi Arabia Personal Data Protection Law (Saudi Arabia; enacted): Saudi Arabia's comprehensive data protection law with specific provisions for children's data, requiring explicit parental consent and prohibiting processing that harms minors' interests.
- **NG NDPA** — Nigeria Data Protection Act 2023 (Nigeria; enacted): Nigeria's comprehensive data protection framework establishing rules for processing personal data of minors with parental consent requirements.
- **ZA POPIA** — South Africa Protection of Personal Information Act (POPIA) (South Africa; enacted): South Africa's data protection law with specific child provisions requiring parental consent and restricting commercial use of children's data.
- **KE DPA** — Kenya Data Protection Act 2019 (Kenya; enacted): Kenya's data protection framework with child-specific provisions requiring parental consent for processing minors' personal data.
- **ID Age Verify** — Idaho Age Verification Act (Idaho, United States; enacted): Idaho law requiring age verification for platforms hosting content harmful to minors, mandating commercially reasonable age verification methods.
- **KY Age Verify** — Kentucky Age Verification Act (Kentucky, United States; enacted): Kentucky law requiring age verification for platforms hosting content harmful to minors, with civil liability for non-compliance.
- **NE Age Verify** — Nebraska Age Verification Act (Nebraska, United States; enacted): Nebraska law requiring age verification for platforms hosting content harmful to minors, establishing obligations for commercial content publishers.
- **SC Age Verify** — South Carolina Age Verification Act (South Carolina, United States; enacted): South Carolina law requiring age verification for platforms hosting content harmful to minors, with both AG enforcement and private right of action.
- **GA HB 597** — Georgia HB 597 Age Verification Act (Georgia, United States; enacted): Georgia law requiring age verification for social media platforms to prevent minors from accessing age-restricted content.
- **MS HB 1126** — Mississippi HB 1126 Social Media Restrictions (Mississippi, United States; enacted): Mississippi law restricting social media access for minors, requiring age verification and parental consent for account creation.
- **IA SF 2309** — Iowa SF 2309 Age Verification Act (Iowa, United States; enacted): Iowa law requiring age verification for online platforms to protect minors, with parental consent requirements for children's accounts.
- **CA AB 1043** — California AB 1043 — Digital Age Assurance (OS/App Store Age Signaling) (California, United States; enacted): Requires operating systems and app stores to collect parent-declared age information at account setup and pass an age-category signal to downstream apps. Moves the age-assurance burden from individual apps to the OS/store tier so per-app re-verification becomes unnecessary.
- **CA AB 1709** — California AB 1709 — Social Media Minimum Age Act (California, United States; proposed): Establishes a statewide minimum age of 16 to create a social media account in California, with verifiable parental consent required for users aged 13 through 15. Platforms must block account creation for children under 13 and apply protective defaults for 13–15 accounts.
- **CA AB 2** — California AB 2 — Platform Liability for Knowing and Willful Harm to Children (California, United States; proposed): Raises platform financial liability when a covered product knowingly or willfully contributes to harm to a minor. Creates a duty-of-care evidentiary standard, requires algorithmic audits, and mandates parental notification of qualifying safety events.
- **CA AB 2617** — California AB 2617 — Youth Protection from Gambling Mechanics and Predatory Gaming (California, United States; proposed): Restricts exposure of minors to gambling-style mechanics in games and apps, including loot boxes, wagering-linked predictive markets, and pressure-based in-app purchases. Requires platforms to block or gate qualifying mechanics on minor accounts.
- **CA AB 1700** — California AB 1700 — Independent eSafety Commission (California, United States; proposed): Establishes an independent California eSafety Commission modeled on Australia's eSafety Commissioner, with authority to receive platform safety reports, publish transparency data, and coordinate cross-agency enforcement on online harms to minors.
- **CA AB 1159** — California AB 1159 — Student Data Collection, Retention, and Commercial Use Safeguards (California, United States; proposed): Tightens rules on how California schools and their ed-tech vendors collect, retain, and use student data. Bans commercial sale or ad-targeting use of school-collected data and imposes retention-minimization and parental-access requirements.
- **CA AB 2023** — California AB 2023 — AI Chatbot Safety Standards for Minors (California, United States; proposed): Establishes baseline safety and transparency standards for general-purpose AI chatbots available to minors. Requires age-tiered feature gating, clear disclosure that the user is interacting with AI, and prohibits engagement-maximizing dark patterns on minor accounts.
- **CA SB 867** — California SB 867 — Safety Standards for AI-Enabled Toys and Conversational Systems for Children (California, United States; proposed): Applies product-safety and disclosure requirements to AI-enabled toys and conversational devices marketed to or used by children. Requires classification, safety certification, and restrictions on certain generative behaviors in child-facing products.
- **NY S9051 / A10379** — New York S9051 / A10379 — Prohibition on Unsafe Chatbot Features for Minors (New York, United States; proposed): Prohibits specified unsafe AI-chatbot behaviors when the user is or is likely to be a minor, including simulated romantic companionship, unsupervised therapy roleplay, self-harm facilitation, personhood deception, and CSAM generation. Requires age assertion before age-restricted features unlock.
- **NY S7263 / A6545** — New York S7263 / A6545 — Protecting Children from Exploitative Algorithms (New York, United States; proposed): Restricts the use of engagement-maximizing algorithmic features on minor accounts. Platforms must default minors to non-personalized feeds, disable autoplay and infinite scroll, and submit to algorithmic audits covering minor-user impact.
- **NY S8484 / A9106** — New York S8484 / A9106 — AI Companion Safety Standards (New York, United States; proposed): Establishes safety standards specifically for AI companion products (apps whose primary function is ongoing simulated relationship with a user). Prohibits companion-style products on minor accounts and requires age-tiered feature gating for any system that may create a minor user.
- **NY S4609 / A6549 (SOPA)** — New York Stop Online Predators Act (SOPA) — S4609 / A6549 (New York, United States; proposed): Requires platforms to block unsolicited direct messages from non-connected adult accounts to minors, apply friction on stranger outreach, default minor profiles to non-public, and require parental approval for purchases and connection requests.
- **NY S8102 / A8893** — New York S8102 / A8893 — Platform Accountability and Teen Safety Disclosure (New York, United States; proposed): Requires covered platforms to publish teen-safety transparency reports, retain evidence sufficient to evaluate liability claims, and submit to annual independent algorithmic audits. Strengthens accountability for engagement systems that affect teen users.
- **NY S8217 / A8022** — New York S8217 / A8022 — Streaming Service Age Ratings (New York, United States; proposed): Requires streaming services operating in New York to apply and enforce age ratings on individual titles, block age-restricted content on minor profiles by default, and make ratings available through machine-readable metadata for parental-control systems.
- **MD ODPA** — Maryland Online Data Privacy Act of 2024 (Maryland, United States; enacted): Comprehensive consumer-privacy statute built around a strict data-minimization model — one of the most protective in the US. Bans sale of sensitive personal data, bars targeted advertising to known minors under 18, and limits data collection to what is reasonably necessary to deliver the product or service.
- **CA Kids Safe AI Initiative** — California Parents & Kids Safe AI Act (2026 Ballot Initiative) (California, United States; proposed): Proposed ballot measure establishing statutory duties for AI products used by minors, including age assurance, prohibitions on emotional manipulation and romantic simulation, required parental controls, and a ban on ad targeting to children.