Section 10 of KOSA establishes the enforcement framework limiting authority to FTC and State Attorneys General. (1) Section 10(a) FTC Federal Enforcement: (a) FTC has sole federal authority; (b) Treated as unfair or deceptive acts or practices per FTC Act Section 5; (c) Civil penalty authority; (d) Injunctive relief; (e) Restitution + disgorgement; (f) Cease and desist orders; (g) Compliance monitoring + reporting. (2) Section 10(b) State Attorney General Enforcement: (a) State AGs have concurrent enforcement authority; (b) Standing to bring action in federal court; (c) State court action also possible; (d) Civil penalty authority - amount per state law or KOSA cap; (e) Injunctive relief; (f) Restitution to state residents; (g) State AGs MUST provide notice to FTC of intent to bring action. (3) Section 10(c) Civil Penalty Framework: (a) UP TO USD 43,792 per violation (adjusted for inflation per FTC Improvement Act); (b) Per-violation cumulation possible; (c) Per minor user + per category violation; (d) Aggregation considerations; (e) Pattern + intentional violations increase per-violation penalty. (4) Section 10(d) No Private Right of Action: (a) Individuals cannot sue covered platforms under KOSA directly; (b) Distinguishes from COPPA + California CCPA breach PRA + Illinois BIPA; (c) Reduces litigation exposure; (d) Centralised enforcement strategy; (e) AG industry-wide investigations enabled; (f) Compensation must come through state consumer protection laws + FTC restitution. (5) Section 10(e) Cure Period for Smaller Platforms: (a) Platforms below certain size threshold (typically less than USD 100M revenue or less than 5M users) may have cure period; (b) 30-60 day cure period typical; (c) Cure period sunsets after specified date; (d) Cure includes remediation + restitution + procedural changes; (e) Cure notice + acceptance closes matter. (6) FTC Investigation Process: (a) Complaint receipt - consumer complaints to FTC; (b) FTC self-initiated investigation; (c) Civil Investigative Demand (CID) + subpoena power; (d) Document production + interview + on-site inspection; (e) Cooperation expectation; (f) Settlement discussions; (g) Consent Decree possible; (h) Final action - civil penalty + injunction + compliance monitoring. (7) State AG Investigation Process: (a) Multi-State Privacy Working Group coordination; (b) Lead AG state; (c) Joint investigations; (d) Multi-State Civil Investigative Demand (CID); (e) State Consumer Protection Act overlap; (f) Settlement with multiple states; (g) Public Notice. (8) Penalties Aggregation Considerations: (a) Number of affected minors; (b) Number of categories of harm; (c) Duration of violation; (d) Sophistication of platform; (e) Cooperation level; (f) Public interest; (g) Aggravating factors (sensitive harms + vulnerable populations); (h) Mitigating factors (cure + remediation + cooperation). (9) Settlement + Consent Decree: (a) Negotiated resolution; (b) Compliance commitments; (c) Monitor appointment; (d) Penalty amount agreed; (e) Public Notice; (f) Reputation considerations; (g) Future compliance obligations. (10) Other Remedies: (a) Injunctive relief; (b) Restitution to affected minors + parents; (c) Disgorgement of profits; (d) Cease and desist orders; (e) Public Naming on FTC + State AG websites; (f) Compliance program enhancements required; (g) Independent monitor appointment. (11) Reputational + Litigation Exposure: (a) FTC + State AG public actions create reputational risk; (b) Settlements typically include public disclosure; (c) Class action exposure for adjacent state consumer protection claims; (d) State-specific privacy laws PRA exposure; (e) Cyber liability + privacy + D and O insurance considerations. (12) Compliance Program Best Practices: (a) Internal Compliance Program + KOSA Officer or Chief Trust + Safety Officer appointment; (b) Annual KOSA risk assessment; (c) Privacy Notice + Parental Tools + Reporting Mechanism current; (d) Vendor management + DPA tracking; (e) Customer service training; (f) Documentation + audit trail; (g) Industry self-regulation participation. Coordinates with FTC Section 5 + FTC Act + State Consumer Protection Acts + State AGs + NAAG National Association of Attorneys General + State Privacy Working Group + COPPA enforcement + CCPA/CPRA + IL BIPA + Privacy liability + Cyber + D and O insurance + Section 9 Kids Online Safety Council + Multi-State coordination + Settlement + Consent Decree templates + DSA enforcement comparison. KOSA Enforcement + Section 10 applies.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.