Should have known

On June 29 the House passed the KIDS Act, 267 to 117, the first time a federal omnibus bundling AI-chatbot safety rules with online age verification has cleared a chamber of Congress. Earlier versions of this fight — KOSA, state porn-site laws — stalled or stayed narrow. This one moved, and it moved by changing one phrase.

To try to avoid liability, services will have to determine which users are teenagers and which are not... Some companies may respond by requesting driver's licenses or passports. — the Electronic Frontier Foundation

The House deal dropped KOSA's contested "duty of care" and swapped in a negligence standard: a platform is liable if it "knew or should have known" a user was a minor. That sounds narrower. In practice it is the opposite. You cannot defend yourself by pointing out that a user never said they were a child, because a court or the FTC can decide after the fact that the signals — search history, the accounts someone follows, how they type — meant you should have known. The only reliably safe response is to stop guessing and card everyone.

Here is the contradiction critics keep circling. The bill's chatbot title states in plain text that providers are not required to verify age. But the same bill's "should have known" standard is exactly what would push a general website to demand a driver's license, a passport, or a face scan from an adult who just wants to read it — because, as the recurring line in the coverage goes, there is no age-verification system that isn't also a deanonymization system. The statute disclaims the outcome its own liability design produces.

None of this is law yet: the bill passed one chamber, and the Senate has its own youth-safety bills to reconcile. Privacy-preserving alternatives already exist — cryptographic proofs that confirm someone is over 18 without revealing who they are — but the bill requires no one to use them, leaving the government-ID route as the path of least legal resistance. If the Senate keeps the standard, the question stops being whether porn sites check IDs and becomes whether browsing the open web anonymously survives at all.