Online safety & content laws in United States (2026)
Online safety rules in United States: partial.
The United States relies on a fragmented set of targeted federal laws and state legislation rather than a unified online safety regime. The TAKE IT DOWN Act (signed May 19, 2025) is the most significant recent federal enactment, criminalising non-consensual intimate imagery and mandating 48-hour platform takedowns; amended COPPA rules (effective June 2025) tighten children's data protections. Section 230 platform immunity remains largely intact but faces intense legislative pressure, while the Kids Online Safety Act (KOSA) was reintroduced in 2025 and remains pending.
Legal framework
Patchwork of federal statutes (TAKE IT DOWN Act 2025, COPPA/FTC Rule, CDA Section 230) plus rapidly expanding state-level age-verification and children's design codes; no single comprehensive online safety statute equivalent to the EU DSA or UK OSA
Key points: internet & online safety in United States
TAKE IT DOWN Act (2025)
Signed into law by President Trump on May 19, 2025, the Act criminalises publication of non-consensual intimate imagery (including AI-generated deepfakes) and requires covered user-generated-content platforms to remove flagged material within 48 hours of a valid notice. FTC enforcement authority activated May 19, 2026; civil penalties up to $53,088 per violation.
Amended COPPA Rule (2025)
The FTC finalised amendments to the Children's Online Privacy Protection Rule on January 16, 2025 (published April 22, 2025; effective June 23, 2025; full compliance required by April 22, 2026). Key changes include expanding the definition of personal information to cover biometric identifiers, requiring separate parental consent for third-party targeted-advertising data sharing, and increased Safe Harbor transparency obligations.
Section 230, intact but under siege
Section 230 of the Communications Decency Act continues to shield platforms from liability for third-party content, but reform pressure is intense. H.R. 6746 (Sunset to Reform Section 230 Act) proposes eliminating immunity by December 31, 2026. Two March 2026 court rulings (K.G.M. v. Meta; New Mexico v. Meta) held that algorithmic recommendation systems fall outside Section 230 protection, increasing platform exposure.
KOSA, pending federal children's safety bill
The Kids Online Safety Act (S.1748 / H.R. 6484) was reintroduced in May 2025 with bipartisan Senate support; it requires covered platforms to implement safeguards preventing harms to minors (drug promotion, compulsive usage design features, etc.) and provide easy parental controls. As of May 2026 the bill has not passed the House and is not law.
Age verification, state patchwork, SCOTUS-validated
At least 25 states have enacted age-verification laws for adult-content websites as of early 2026. The U.S. Supreme Court upheld Texas H.B. 1181 (Free Speech Coalition v. Paxton, June 2025), validating state-mandated age verification. Four states (California, Maryland, Nebraska, Vermont) have enacted child-centric design codes imposing default privacy and safety settings for minors; multiple states also require parental consent or age-gating for social-media access.
No comprehensive federal online safety statute
Unlike the EU (Digital Services Act) or the UK (Online Safety Act), the US has no omnibus platform-safety law imposing systemic risk assessments, algorithmic transparency obligations, or a dedicated regulator for online harms. Legislative activity is high, the House Energy & Commerce Committee released 19 draft online-safety bills in late 2025, including the KIDS Act, but none have been enacted into law.
Timeline of decisions
- Decision · officialSupreme Court Unanimously Upholds TikTok Divestiture-or-Ban Law
In TikTok, Inc. v. Garland, all nine justices upheld the Protecting Americans from Foreign Adversary Controlled Applications Act, ruling the national-security rationale justified its burden on speech with no First Amendment violation. The decision set a landmark precedent for federal authority to regulate foreign-owned platforms and triggered TikTok's brief 48-hour U.S. shutdown on January 18-19, 2025.
U.S. Supreme Court
- Law · officialFTC Finalizes Sweeping COPPA Rule Overhaul
The FTC adopted the first comprehensive revision of the Children's Online Privacy Protection Rule since 2013, requiring separate parental consent for targeted advertising of children's data, imposing strict data-retention limits, banning push notifications to children without consent, and expanding the definition of personal information to include biometric identifiers and government-issued IDs. The rule became effective June 23, 2025, with full operator compliance required by April 22, 2026.
Federal Trade Commission
- Enforcement · officialFTC and DOJ Sue TikTok and ByteDance for Systemic COPPA Violations
The FTC referred and the DOJ filed a federal civil complaint alleging TikTok knowingly allowed millions of children under 13 to use the platform without parental consent, with reviewers spending only 5-7 seconds per account, and that ByteDance violated the 2019 consent decree. The action seeks civil penalties up to $51,744 per violation per day.
Federal Trade Commission
- Decision · officialSenate Passes Kids Online Safety and Privacy Act 91-3
The U.S. Senate passed a combined package merging the Kids Online Safety Act (imposing a statutory duty of care on platforms regarding minor users) and COPPA 2.0 (extending protections to age 16 and banning targeted advertising to minors) by a 91-3 bipartisan vote. The bill did not advance in the House before the 118th Congress ended, leaving it unenacted.
Congress.gov / Library of Congress
- Law · officialBiden Signs Law Requiring TikTok Divestiture or U.S. Ban
Enacted as Division H of the national-security supplemental H.R. 815, the Protecting Americans from Foreign Adversary Controlled Applications Act gave ByteDance 270 days to divest TikTok or face removal from U.S. app stores and web hosting services. It was the first federal statute to target a specific social media platform on foreign-adversary national-security grounds.
Congress.gov / Library of Congress
- Decision · officialSupreme Court Preserves Section 230 Immunity in Gonzalez v. Google and Twitter v. Taamneh
The Court vacated and remanded Gonzalez without ruling on Section 230's scope, and unanimously held in Twitter v. Taamneh that platforms were not liable under the Anti-Terrorism Act for hosting ISIS content. The paired rulings left Section 230's broad immunity intact and effectively deferred any judicial narrowing of the statute to future litigation or Congress.
U.S. Supreme Court
- Enforcement · officialFTC Proposes Banning Meta from Monetizing Children's and Teens' Data
The FTC proposed a sweeping modification to Meta's 2019 consent decree, seeking a blanket prohibition on monetizing personal data from users under 18 and alleging ongoing COPPA violations through Messenger Kids. The proposal marked the most aggressive federal enforcement posture toward a major platform's treatment of minor users to date.
Federal Trade Commission
- Enforcement · officialFTC Levies Record $5.7 Million COPPA Fine Against TikTok (Musical.ly)
The FTC and DOJ settled COPPA charges against Musical.ly (operating as TikTok), imposing a then-record $5.7 million civil penalty for illegally collecting personal information from children without parental consent and requiring deletion of all illegally gathered children's data. The settlement also required TikTok to create a verified children's mode, a consent decree TikTok would later be accused of violating.
Federal Trade Commission
- Law · officialFOSTA-SESTA Signed, First Statutory Carve-Out to Section 230 Immunity
President Trump signed H.R. 1865 (FOSTA-SESTA), creating civil and criminal liability for platforms that knowingly facilitate sex trafficking and explicitly removing that category from Section 230's immunity. It was the first time Congress legislated an exception to the platform-immunity framework enacted in 1996, demonstrating that Section 230 was subject to statutory modification.
Congress.gov / Library of Congress
- Law · officialRevised COPPA Rule Takes Effect, Covering Mobile Apps and Persistent Identifiers
The FTC's updated COPPA Rule expanded the definition of personal information to include geolocation data, photos, videos, audio recordings, and persistent identifiers such as cookies and device IDs, and explicitly brought mobile apps and third-party plug-ins within the rule's scope. The revision was the first major modernization of children's online privacy rules for the smartphone era.
Federal Trade Commission
- Law · officialCOPPA Implementing Rule Becomes Enforceable
The FTC's Children's Online Privacy Protection Rule (16 C.F.R. Part 312) began formal enforcement, requiring operators of child-directed websites and online services to post clear privacy policies, obtain verifiable parental consent before collecting personal information from children under 13, and provide parents the right to review and delete their children's data. The rule established the core compliance architecture still in use today.
Federal Trade Commission
- Law · officialCOPPA Enacted, Congress Creates Children's Online Privacy Framework
Congress enacted the Children's Online Privacy Protection Act (15 U.S.C. §§ 6501-6506), establishing the first federal law specifically governing online privacy for children by mandating parental consent before collecting personal information from users under 13 and granting the FTC rulemaking and enforcement authority. COPPA remains the cornerstone federal statute for children's digital privacy more than 25 years later.
Federal Trade Commission
- Law · officialSection 230 of the Communications Decency Act Enacted
President Clinton signed the Telecommunications Act of 1996, embedding Section 230 (drafted by Reps. Cox and Wyden) which immunized online platforms from civil liability for third-party content and permitted good-faith content moderation without losing that immunity. Section 230's near-absolute liability shield became the legal foundation for the modern commercial internet and remains the single most consequential online-safety law in U.S. history.
Congress.gov / Library of Congress
Sources
- congress.gov/bill/119th-congress/senate-bill/146
- ftc.gov/business-guidance/blog/2026/05/take-it-down-act-enforcement-starts-no
- ftc.gov/news-events/news/press-releases/2025/01/ftc-finalizes-changes-childre
- federalregister.gov/documents/2025/04/22/2025-05904/childrens-online-privacy-protection-r
- congress.gov/bill/119th-congress/senate-bill/1748
- congress.gov/bill/119th-congress/house-bill/6746/text
- commerce.senate.gov/press/rep/release/liability-or-deniability-platform-power-as-section-
- natlawreview.com/article/new-age-verification-reality-compliance-rapidly-expanding-sta
- mayerbrown.com/en/insights/publications/2026/01/little-users-big-rules-tracking-chil
- dwt.com/insights/2026/01/federal-online-safety-legislation-hits-congress
- publicknowledge.org/assessing-section-230-reform-proposals-in-the-119th-congress/
- skadden.com/insights/publications/2025/06/take-it-down-act
- blackburn.senate.gov/2025/5/technology/blackburn-blumenthal-thune-and-schumer-introduce-th
- en.wikipedia.org/wiki/Social_media_age_verification_laws_in_the_United_States
- techpolicy.press/house-subcommittee-advances-18-child-online-safety-bills/
- bilirakis.house.gov/media/press-releases/bilirakis-announces-kids-online-safety-act-prote
Next for United States: CybersecuritySectoral rules
Next topicOrientation, not legal advice: verify against the primary sources linked above. Last verified 24 May 2026. Methodology & how to cite · State of Technology Regulation 2026