Internet & Online Safety - United States

Signed into law by President Trump on May 19, 2025, the Act criminalises publication of non-consensual intimate imagery (including AI-generated deepfakes) and requires covered user-generated-content platforms to remove flagged material within 48 hours of a valid notice. FTC enforcement authority activated May 19, 2026; civil penalties up to $53,088 per violation.

The FTC finalised amendments to the Children's Online Privacy Protection Rule on January 16, 2025 (published April 22, 2025; effective June 23, 2025; full compliance required by April 22, 2026). Key changes include expanding the definition of personal information to cover biometric identifiers, requiring separate parental consent for third-party targeted-advertising data sharing, and increased Safe Harbor transparency obligations.

Section 230 of the Communications Decency Act continues to shield platforms from liability for third-party content, but reform pressure is intense. H.R. 6746 (Sunset to Reform Section 230 Act) proposes eliminating immunity by December 31, 2026. Two March 2026 court rulings (K.G.M. v. Meta; New Mexico v. Meta) held that algorithmic recommendation systems fall outside Section 230 protection, increasing platform exposure.

The Kids Online Safety Act (S.1748 / H.R. 6484) was reintroduced in May 2025 with bipartisan Senate support; it requires covered platforms to implement safeguards preventing harms to minors (drug promotion, compulsive usage design features, etc.) and provide easy parental controls. As of May 2026 the bill has not passed the House and is not law.

At least 25 states have enacted age-verification laws for adult-content websites as of early 2026. The U.S. Supreme Court upheld Texas H.B. 1181 (Free Speech Coalition v. Paxton, June 2025), validating state-mandated age verification. Four states (California, Maryland, Nebraska, Vermont) have enacted child-centric design codes imposing default privacy and safety settings for minors; multiple states also require parental consent or age-gating for social-media access.

Unlike the EU (Digital Services Act) or the UK (Online Safety Act), the US has no omnibus platform-safety law imposing systemic risk assessments, algorithmic transparency obligations, or a dedicated regulator for online harms. Legislative activity is high — the House Energy & Commerce Committee released 19 draft online-safety bills in late 2025, including the KIDS Act — but none have been enacted into law.