The Kids Online Safety Act (KOSA) poses significant privacy risks due to its proposed expansion of age verification, which would compel companies to collect more user data. This legislation, currently under consideration by the Senate Commerce Committee, would also create incentives for platforms to restrict lawful speech. By imposing a "duty of care" on online services, KOSA would lead to increased data collection and potentially harmful restrictions on online expression. The Electronic Frontier Foundation argues that this approach would undermine privacy for all users, not just children1. As policymakers weigh the potential benefits of KOSA against its privacy risks, organizations must consider the potential compliance implications of such a shift. The eventual outcome of KOSA will have significant strategic implications for companies operating online, so understanding the potential consequences of this legislation is crucial for practitioners seeking to navigate the evolving regulatory landscape.