Bill by bill: what evidence is cited, and what it shows.

For each bill in the current online-safety package: the status on the official record, the evidence advocates cite in support of it, what that evidence does and does not establish, and our position. Positions are on mechanism — what a statute requires of whom — not on whether the harms are real. Several are.

Compiled 4 November 2026 · status verified against congress.gov and the Congressional Record

The threshold finding

No pending federal bill in this package cites any advocacy research by name. The Kids Online Safety Act (S.1748) and the CHATBOT Act (S.4407) contain no findings section at all. The AI LEAD Act (S.2937), the Youth AI Privacy Act (S.4199) and the DEFIANCE Act (S.1837) carry findings that cite no source. No committee report exists for S.1748, S.4199, S.4407 or S.2937 — congress.gov shows “Related Documents” blank for each.

That matters in both directions. It means no bill’s text can be impeached by impeaching a study. It also means the evidentiary basis for these duties lives entirely in hearing records, advocacy submissions and press material — material that, as the evidence base sets out, publishes no uncertainty estimates.

Two official texts do cite a CCDH AI report by name, and both are court filings rather than legislation: the Iowa petition against OpenAI at ¶106 n.83 and the Idaho complaint at ¶102 n.85, both dated 14 October 2026 and drafted by the same outside counsel. Neither carries the 53% or 1,200 figures; both paraphrase the narrative. The 2021 Surgeon General’s advisory cites the Disinformation Dozen at page 6, footnote 45 — the only federal advisory located that does.

JAWBONE Act

S.4749 · 119th Senate

Coalition supports

Creates a federal cause of action against government jawboning — informal official pressure on platforms to suppress lawful speech.

Why we support it. It is viewpoint-neutral and bipartisan, and it reaches the precise mechanism documented in the Virality Project record: pressure applied through intermediaries rather than through law, which is why it was deniable and why Finn v. GEC never reached it. A remedy running against the government actor creates no removal duty on any platform and no incentive to over-suppress.

Note: the text reported by committee is the Cruz substitute, which congress.gov does not yet publish; the bill-text link on our bill matrix is the introduced version and is labelled as such.

DEFIANCE Act

S.1837 · Passed Senate by unanimous consent, 13 January 2026

Distinguishable — supportable

Creates a federal civil cause of action for people whose intimate images or sexually explicit deepfakes are distributed without consent.

Why this one is different, and why we say so publicly. DEFIANCE gives the depicted person an action against producers and distributors. It imposes no removal duty on intermediaries and creates no duty of care keyed to a category of content. Opposing a duty of care while supporting a victim’s remedy is not a contradiction; it is the distinction the whole argument turns on. The harms here are real and independently documented — Canada’s Privacy Commissioner found a breach of PIPEDA over sexualised Grok imagery, and an Amsterdam court granted an injunction.

Kids Online Safety Act

S.1748 · Blackburn / Blumenthal

Coalition opposes on mechanism

Status, precisely: Senate Commerce ordered the bill reported with a substitute on 5 August 2026. It has never been formally reported and has no calendar number — which is why Sen. Blumenthal’s unanimous-consent request of 30 September 2026 had to ask that the committee be discharged. Sen. Rand Paul objected. The objection is heard at 172 Cong. Rec. S5213–S5214.

Establishes a duty of care on covered platforms to “exercise reasonable care in the creation and implementation of any design feature” to prevent and mitigate enumerated harms to minors.

Evidence cited in support, and how it checks out: advocates cite NCMEC’s financial-sextortion figures — more than 50,000 reports in 2025, an average of 137 a day, up from more than 36,000 in 2024. Those figures are accurate and we do not dispute them. They establish that the harm is large and growing. They do not establish that a design-feature duty of care is the instrument that reduces it, and no published study in this package tests that question.

Our objection, stated fairly. The bill’s text enumerates specific harms, bars viewpoint-based enforcement at §102(b)(2), and disclaims any age-verification mandate at §112(c). Those are real limits and we state them. The objection is to what the duty produces in practice: Sen. Paul — “imposing a duty of care will inevitably lead to one outcome: the stifling of First Amendment protected speech” — and EFF’s letter to the committee of 5 August 2026, which argues the obligations “only work if online services know which users are minors,” so platforms will be pressured into age verification whatever the text disclaims. Enforcement runs through the FTC and state attorneys general, not private tort suits. This is the statutory form of the informal pressure this coalition exists to document.

AI LEAD Act

S.2937 · Durbin · Introduced 29 September 2025 · still in Judiciary

Coalition opposes on mechanism

Classifies an AI system as a product and creates federal product-liability exposure for it.

From its own text: “covered product” means “an artificial intelligence system” (§3(3)). Suit may be brought by the US Attorney General, any state attorney general, individuals, or classes (§301). Liability runs by preponderance under four theories including strict liability for a “defective condition unreasonably dangerous” notwithstanding the exercise of “all possible care” (§101(a)(4), §101(d)). §501 reaches conduct before enactment. The only speech language is in the non-operative findings at §2(6), which assert the Act “establishes Federal legislative guidelines for products liability without implicating expressive speech.” There is no operative First Amendment or expressive-content carve-out, and no reference to Section 230.

Our objection. A findings clause asserting that a statute does not implicate expressive speech does not prevent a plaintiff from arguing that a harmful generated output reflects a design defect. “Design” is defined at §3(5) to include training data selection, training, testing, auditing and fine-tuning — i.e. the choices that determine what a model says. Strict liability notwithstanding all possible care means the safest commercial response is to generate less, for more people, in more categories. This is our reading of the bill, labelled as a reading.

Documented pipeline, stated without inference: Sen. Durbin promoted this bill on CCDH’s own webinar of 14 November 2025, alongside the research cited in support of it, with ParentsTogether Action and the Heat Initiative. That is a co-appearance on the record. Nothing in the record shows coordination beyond co-appearance, and Durbin’s own 29 September 2025 endorsement list does not name CCDH.

CHATBOT Act

S.4407 · Cruz / Schatz / Curtis · Advanced 5 August 2026

Watching — operative text not public

Status: advanced by voice vote, which the Commerce Committee’s own release describes as “with unanimous support”. The committee advanced the Cruz–Schatz–Curtis substitute as modified, which is roughly a third new text against the introduced bill; congress.gov publishes only the introduced version.

Why we are not taking a position yet. The operative text exists only as a committee PDF. We will not characterise provisions from the introduced version while describing a bill that advanced as a substitute — that is the defect we document elsewhere, and we are not going to commit it here.

Youth AI Privacy Act · NO FAKES Act

S.4199 (Markey substitute) · S.4591 (Calendar No. 446)

Watching

S.4199: advanced 5 August 2026 as the Markey substitute as modified; session and memory rules materially rewritten against the introduced text.
S.4591: reported 24 June 2026 and placed on the Senate calendar — the only bill in this package formally reported. It was also blocked by unanimous-consent objection on 30 September 2026, by Sen. Cruz, the Commerce chairman who sponsors the CHATBOT Act. Two of the package’s bills are therefore stalled, each by a senator aligned with the other’s sponsors.

Both touch likeness, voice and minors’ data rather than a general duty of care. We are reading the substitutes before taking a position.

What the advocacy list leaves out

Recorded as observation, not as a charge of bad faith: an advocacy organisation owes no mention of a bill it does not endorse. But a reader of a legislative wish list should know what else was in the room.

How to read a citation in a legislative record

We hold to four categories, and ask that anyone citing this page do the same. A source was cited; its evidence was relied upon; it helped initiate a proceeding; it caused a specific action. The documentary burden rises at each step, and most claims of research “driving” policy stop at the first.

Applied to this package: advocacy research is cited in two state court filings and one 2021 federal advisory. It is not cited in any bill text or committee report. Regulatory action on Grok predates the research most often credited with prompting it — Ofcom on 12 January 2026 and eSafety Australia on 9 January 2026 both moved before the 22 January estimate was published.