The laws in play: KOSA, COPPA, and Section 230

The social media harm cases sit against a small set of federal laws, some already on the books and some still moving through Congress. Understanding them helps make sense of why the cases are argued the way they are.

COPPA, the privacy law already in force

The Children’s Online Privacy Protection Act, known as COPPA, has been law since the late 1990s. It limits how companies can collect personal information from children under 13 and requires parental consent in many cases. The Federal Trade Commission enforces it and maintains the rule that puts it into practice (FTC).

COPPA is not a mental health law. It is a privacy law. It enters these cases because the states suing Meta alleged that Meta collected data from children under 13 without parental consent, in part to train its systems, in violation of COPPA (Reuters).

Section 230, the shield at the center of the argument

Section 230 of the Communications Decency Act is a short provision with an outsized role. Its core rule is that a platform is not treated as the publisher of content posted by its users (Cornell Law).

That shield is why the harm cases are built around design rather than specific posts. The families and states suing argue that a feed, its ranking, and its notifications are the platform’s own product, not a user’s speech. The companies argue the opposite. In 2026 a federal appeals court declined to settle the question early, leaving it for after trials reach final judgments.

KOSA, the bill still in Congress

The Kids Online Safety Act, or KOSA, would impose a duty of care on large platforms to design their products in ways that limit harm to minors. As of September 2026, it is not law.

KOSA passed the Senate in one form in 2024, but differences with the House prevented it from reaching the president’s desk. In August 2026, a new version advanced out of the Senate Commerce Committee, while a different House version had moved forward in June 2026 (CNBC). The Senate version includes a duty of care provision that the House version omits, and that gap is what remains to be bridged.

The original Senate bill, S.1409, is tracked on Congress.gov (Congress.gov). The takeaway for anyone following this closely is to watch the wording, because a duty of care is a meaningfully stronger requirement than a transparency or default settings bill.

This summary is informational and is not legal advice.