# Research Agenda for Online Safety, Lawful Inquiry, and Cognitive Liberty

## Executive summary

The topic is not entirely unspecified. The uploaded commissioning brief supplies a strong substantive anchor: it asks for an adversarial, primary-source-driven investigation into when “online safety” duties—especially child-safety, systemic-risk, content-removal, age-assurance, and service-design rules—can spill over into suppression or surveillance of lawful adult inquiry and, prospectively, the information environment of increasingly autonomous machine systems. It specifically identifies the UK Online Safety Act, the U.S. Kids Online Safety Act or verified successors, the EU Digital Services Act, and Australian online-safety measures, while requiring careful separation of enacted law, proposals, regulatory interpretation, provider overcompliance, and hypothetical machine-rights extensions. fileciteturn0file0

That legal-policy topic should be pursued first. It is unusually time-sensitive. As of the September 6, 2026 research cutoff used here, the UK’s protection-of-children duties are operational, with Ofcom stating that the relevant duties came into force on July 25, 2025. citeturn3search5turn3search8 The EU Digital Services Act has broadly applied since February 2024 and expressly bars imposing a general monitoring or active fact-finding obligation on intermediary services under Article 8. citeturn3search19turn2view6 Australia’s under-16 social-media account restrictions took effect on December 10, 2025, while several types of messaging, gaming, health, and educational services remain outside the current age-restricted list. citeturn0search8turn3search7 In the United States, the Senate Commerce Committee advanced S.1748, KOSA, as amended on August 5, 2026, while the House had already passed the materially distinct H.R.7757 KIDS Act on June 29, 2026. citeturn7search0turn8search1 This divergence makes it especially important not to treat “KOSA” as a single settled text.

Five plausible research programs follow naturally from the brief, one in each requested domain:

| Domain | Proposed topic | Core value |
|---|---|---|
| **Policy** | Online-safety law versus lawful inquiry: UK–US–EU–Australia comparison | Directly answers the attached commission and establishes the legal baseline |
| **Technology** | Privacy-preserving age assurance and safety architecture without generalized surveillance | Tests whether less restrictive technical alternatives are genuinely feasible |
| **Business** | Compliance incentives, over-removal, and regulatory concentration | Explains why firms may go beyond what statutes literally require |
| **Science** | What causal evidence actually shows about online harms, recommendation systems, and beneficial inquiry | Separates evidence-based harm predicates from assumptions embedded in regulation |
| **Travel / cross-border** | How jurisdiction-specific safety and age rules become global access restrictions | Tests territorial spillover, geo-restriction, and “one global policy” effects |

The policy project ranks first because the other four depend on it. One cannot credibly attribute surveillance to law rather than corporate choice, model compliance costs, design a privacy-preserving substitute, or analyze cross-border spillovers without first establishing exactly which actor is subject to which duty, in which jurisdiction, under which version of the law.

A four-week first phase, from September 7 through October 4, 2026, is realistic for a publication-grade legal and evidence dossier using public sources. It should culminate in the bundle contemplated by the attached commission: a legal-status register, duty-to-interference matrix, six worked scenarios, over-removal evidence plan, reform alternatives, draft protective language, source register, search log, and a publication-ready report. fileciteturn0file0

## Assumptions and likely user intent

### Explicit assumptions

**The attached commission is the best signal of substantive intent.** I therefore treat “online safety as potential infrastructure for suppressing lawful inquiry” as the presumptive primary subject, rather than treating the research space as completely unconstrained. The document repeatedly emphasizes cognitive liberty, lawful research, private inquiry, operatorless services, machine-mediated reasoning, and narrowing or replacing overbroad safety duties. fileciteturn0file0

**The immediate deliverable requested here is a research design, not yet the full 6,000–10,000-word legal report.** The attached file describes a much larger eventual bundle, whereas the current instruction asks for candidate topics, methodologies, comparative scoring, a four-week plan, and clarifying questions. fileciteturn0file0

**The legal-status cutoff is September 6, 2026.** Because the U.S. legislative position has moved materially during 2026, status checking must occur again when substantive drafting begins. The Senate committee’s August 5 action on S.1748 is a concrete example of why older summaries are no longer adequate. citeturn7search0turn9search6

**“Primary sources” means operative legal texts, official legislative histories, regulator codes and decisions, court judgments or dockets, original empirical papers, standards bodies’ specifications, and first-party transparency materials.** Advocacy papers and journalism are useful for hypotheses and contrary arguments, but not to establish an operative statutory duty.

**Cost estimates assume desk research using publicly available sources.** They exclude retained local counsel, paid proprietary litigation databases, large-scale surveys, human-subject experiments, travel, or proprietary platform data.

**Machine moral status remains an analytic variable rather than a premise.** This follows the attached commission itself, which distinguishes present interfaces, bounded agents, persistent operatorless services, and hypothetical future machine principals, while expressly declining to assume that current systems are conscious or legal persons. fileciteturn0file0

### Likely intent

The most plausible intent is not to produce a conventional “how to comply with online-safety law” guide. It is to determine, with enough doctrinal precision to survive adversarial checking, **where legitimate safety objectives end and unnecessary control over lawful inquiry begins**, while also identifying narrower ways to protect children, victims, privacy, consent, and bodily safety. fileciteturn0file0

The intended causal question is therefore:

> **Which exact legal triggers create which compliance incentives, and under what conditions do those incentives cause lawful information, private questions, research communities, or machine-mediated inquiry to be filtered, recorded, denied, or centralized beyond what is necessary to prevent a concrete injury?**

That formulation is particularly important for the DSA. Article 8 expressly rejects a general monitoring mandate, so any criticism that the DSA indirectly induces monitoring must demonstrate the intermediate mechanism rather than falsely describing the regulation as commanding universal surveillance. citeturn2view6turn2view7

Likewise, Australian law illustrates the need to distinguish **account access** from **information access**. Current eSafety guidance says designated platforms must take reasonable steps to prevent Australians under 16 from holding accounts, while publicly available content that does not require login can still be viewed; numerous services are presently excluded from the age-restricted category. citeturn3search7turn3search0

The principal open questions are how strongly the final publication should foreground machine interests rather than human users’ rights; how much empirical work on actual over-removal is expected; whether a technically detailed alternative architecture is desired; whether constitutional litigation arguments should receive equal weight with legislative reform; and whether the eventual product is intended principally for public persuasion, policymakers, courts, or system designers.

## Candidate topics and research designs

**Policy — Online-safety law versus lawful inquiry: a comparative legal and institutional audit**

**Scope.** Compare the UK Online Safety Act 2023 and Ofcom implementation, the EU DSA, current U.S. Senate and House child-safety proposals, and Australia’s Online Safety Act plus the social-media minimum-age regime. The unit of analysis should be the **individual duty**, not the statute as a whole: illegal-content response, child-access assessment, risk assessment, recommender design, age assurance, reporting, recordkeeping, private messaging, search, generative systems, and sanctions should be separated.

The current baseline already demonstrates why version control matters. Ofcom says user-to-user and search services in scope must assess child access and, where children are likely to access the service, perform risk assessments and implement protections. citeturn3search8turn3search17 The EU DSA simultaneously contains systemic-risk obligations for the largest services and a categorical Article 8 prohibition on imposing general monitoring. citeturn2view6 Australia’s age-restricted social-media scheme is operative but contains service-category exclusions and focuses on under-16 accounts rather than a general prohibition on viewing public information. citeturn3search7 In the United States, S.1748 was ordered reported favorably after an August 2026 committee markup, while H.R.7757 passed the House in June; those texts therefore require separate treatment. citeturn7search0turn8search1

**Key research questions.** What exact actors and functions are regulated? When does the law regulate illegal material, lawful-but-age-inappropriate material, recommendation, account access, advertising, or service design? Which duties plausibly reach private messaging, search, research forums, local assistants, or an operatorless coordination commons? Which rights, exemptions, procedural protections, appeal mechanisms, and territorial limits defeat stronger censorship claims? Which sanctions or ambiguities create incentives to over-remove even when the statute does not expressly demand it? Where would audience-specific or injury-specific drafting accomplish the legitimate safety aim with less interference?

**Methodology.** Perform provision-by-provision doctrinal analysis; build a versioned legal register; trace cross-references, definitions, commencement provisions and amendments; read regulator codes beside statutes; separate binding text from guidance; check subsequent judicial treatment; map each duty into the causal chain required by the brief: legal trigger → compliance mechanism → restricted information/activity → affected actor → immediate harm → possible concentration or chilling effect. Every link should be labeled documented, inferred, or hypothetical.

The empirical leg should then test actual over-removal and overcompliance rather than inferring them merely from penalty levels. Positive controls would examine categories in which intervention is indisputably required; negative controls would examine services or content categories clearly outside a provision.

**Primary sources.** UK legislation.gov.uk and Ofcom; Congress.gov, Senate Commerce Committee and House Energy and Commerce materials; EUR-Lex and European Commission DSA decisions; Australia’s Federal Register of Legislation and eSafety Commissioner; official court judgments and dockets. For example, the authoritative DSA text contains both Article 8’s no-general-monitoring rule and explicit concern for freedom of expression and information in its systemic-risk architecture. citeturn2view6

**Expected deliverables.** A precise legal-status table; duty-to-interference matrix; six worked scenarios specified in the attached commission; three or more provision-specific narrowing/repeal arguments; strongest defense and rebuttal for each main target; draft legislative language protecting lawful private inquiry; legal register; sources register; reform-options paper; search log.

**Estimated timeline.** Four weeks for the first publication-grade version; six weeks if exhaustive case-law and regulator-enforcement treatment is required.

**Limitations and risks.** The largest risk is legal movement during drafting. U.S. texts are especially unstable: the Senate version was amended in committee only on August 5, 2026, after the House had passed a separate package. citeturn7search0turn8search1 Another risk is falsely attributing voluntary platform behavior to legislation. A third is jurisdictional overgeneralization: an EU obligation cannot simply be treated as a worldwide duty because a multinational provider chooses a global implementation.

**Technology — Privacy-preserving age assurance and safety architecture without generalized surveillance**

**Scope.** Ask whether the safety objectives driving age assurance and child-access controls can be met through architectures that reveal only the minimum attribute necessary—such as “over threshold age”—rather than centralized identity, persistent browsing history, or universal profiling.

This is technically credible enough to study rather than dismiss abstractly. NIST’s current Digital Identity Guidelines, SP 800-63-4 and its companion identity-proofing guidance, address modern identity proofing, authentication, federation, security and privacy. citeturn4search4turn4search5 W3C finalized the Verifiable Credentials 2.0 family as Recommendations in May 2025; the framework supports machine-verifiable credentials and selective disclosure of claims. citeturn4search0turn4search2 Neither source by itself proves that any particular age-assurance method is legally sufficient, but together they provide a primary technical basis for evaluating lower-data alternatives.

**Key research questions.** Can age-threshold assertions be separated from civil identity? Can credentials be short-lived and unlinkable across services? What threat models defeat claimed privacy benefits? Could device-level or user-held proofs avoid centralized permission while preserving regulator-auditable assurance? How should a system handle errors, lost credentials, nonstandard users, adults without conventional identity documents, or autonomous services? At what point does a privacy safeguard itself become a new gatekeeper?

**Methodology.** Build threat models and data-flow diagrams for several architectures: centralized identity verification, device-side age inference, tokenized threshold proof, federated credentials, and service-local assurance. Evaluate each against data minimization, linkability, false positives, exclusion risk, auditability, revocation, operatorlessness, and legal sufficiency. Do not build or deploy a production identity system; a specification and adversarial analysis are sufficient.

**Primary sources.** NIST SP 800-63-4 and 800-63A-4; W3C Verifiable Credentials Data Model 2.0 and Data Integrity specifications; official regulator age-assurance guidance from Ofcom and eSafety; enacted statutory language defining “highly effective age assurance,” “reasonable steps,” or equivalent concepts where applicable. NIST Revision 4 was finalized in 2025 after a multi-year consultation process, making it a current baseline for digital-identity design rather than an obsolete technical reference. citeturn4search10

**Expected deliverables.** Architecture comparison; threat model; privacy/data-flow matrix; regulatory-fit analysis; model requirements for “proof of eligibility without proof of identity”; implementation-neutral reform language.

**Estimated timeline.** Four to six weeks.

**Limitations and risks.** Legal regimes may demand outcomes rather than prescribe technology, so technical privacy superiority does not automatically establish statutory compliance. Biometric and inferential systems may introduce bias or false-rejection risks. Credential schemes can merely relocate concentration from platforms to issuers.

**Business — Compliance economics, over-removal, and incumbent advantage**

**Scope.** Analyze how penalty exposure, fixed compliance costs, audit duties, complaint volumes, age-assurance infrastructure, regulator uncertainty, and reputational pressure alter firms’ incentives. The core question is not “does a law literally require censorship?” but “when is over-removal or one-size-fits-all global filtering privately rational?”

**Key research questions.** How large are fixed versus variable compliance burdens? Do obligations that are manageable for major platforms raise entry barriers for small or operatorless services? When does a provider rationally use the strictest jurisdiction as a worldwide baseline? How much of observed filtering is explained by advertiser or app-store incentives rather than law? What appeal or transparency arrangements reduce the expected cost of false positives?

**Methodology.** Construct a compliance-cost taxonomy, then model simplified expected-loss decisions:

\[
E(C_{\text{under}})=P(\text{enforcement})\times\text{sanction/exposure}+\text{reputational cost}
\]

versus

\[
E(C_{\text{over}})=\text{lost users/revenue}+\text{appeals}+\text{false-positive cost}.
\]

No numerical probability should be invented. Where credible figures are unavailable, use threshold and sensitivity analysis: determine what combination of penalty exposure and moderation cost makes a global restrictive policy economically rational. Compare large platforms with small publishers and operatorless services.

**Primary sources.** Statutory penalty provisions; regulator enforcement decisions and impact assessments; corporate annual reports and first-party transparency reports; public audit reports mandated under applicable law; securities filings; official SME guidance and fee schedules. The DSA, for example, distinguishes the largest platforms from smaller actors and places Commission supervision on the largest services, while the Commission states that most platforms have been subject to the regime since February 2024. citeturn3search19

**Expected deliverables.** Compliance-cost model; “Brussels/London/Canberra effect” decision tree; small-provider versus incumbent comparison; global-filter scenario; policy recommendations for safe harbors, proportionality and burden reduction.

**Estimated timeline.** Three to five weeks.

**Limitations and risks.** Internal moderation costs and policy rationales are usually proprietary. Public transparency reports may reflect each company’s categorization choices. Correlation between new regulation and increased moderation does not alone establish causation.

**Science — Causal evidence behind online-harm and recommender-system claims**

**Scope.** Examine what original empirical research actually establishes about social-media design, algorithmic recommendation, mental health, political exposure, compulsive use, and the benefits of anonymous or difficult online inquiry.

The evidence is not likely to support a simple “algorithms are harmless” or “algorithms are uniformly dangerous” story. A 2026 randomized field experiment on X found that switching users from a chronological to an algorithmic feed increased engagement and shifted some political attitudes, while switching the algorithm off did not produce symmetrical effects. citeturn5search2 By contrast, experimental work on removing political advertisements from Facebook and Instagram before the 2020 U.S. election found no detectable effects across several measured political outcomes. citeturn5search6 A randomized study of an anonymous mental-health community for adolescents found the environment feasible and reported benefits valued by participants, illustrating that safety research should examine beneficial online association alongside harms. citeturn4search11

**Key research questions.** Which alleged harms have causal rather than merely correlational evidence? Which effects are associated with content, recommender design, duration, social interaction, or pre-existing vulnerability? What effect sizes and populations justify regulatory generalization? What beneficial uses—peer support, anonymous discussion, research, political dialogue—might broad restrictions unintentionally diminish? What evidence would falsify a claim of net benefit from a particular intervention?

**Methodology.** Predefine an evidence hierarchy: randomized field experiments first; quasi-experiments and longitudinal studies second; cross-sectional studies lower; advocacy surveys as contextual evidence. Extract population, exposure, comparator, effect, confidence interval, external-validity limits, preregistration, attrition, and conflicts. Explicitly separate evidence about children from extrapolations to adults.

Original research should include countervailing results. For example, a randomized Facebook-deactivation experiment studied 2,743 users around the 2018 U.S. midterms, while an experiment with structured anonymous cross-party conversation found reductions in measured polarization relative to a control condition. citeturn5search0turn5search5

**Primary sources.** Original papers in Nature, Science, AER, PNAS and relevant clinical or behavioral-science journals; trial registrations and supplements; regulator evidence registers; platform researcher-access datasets where reproducible.

**Expected deliverables.** Evidence map; claim-to-study matrix; causal-strength ratings; list of claims policymakers should and should not confidently make; research gaps; empirical predicates suitable for narrower statutory language.

**Estimated timeline.** Five to eight weeks for a strong systematic evidence review; four weeks for a scoped rapid review.

**Limitations and risks.** Platform effects change over time, proprietary algorithms reduce replicability, and findings from one interface may not generalize to another. Publication bias and selective platform-data access can distort the literature.

**Travel / cross-border — When local safety law becomes a global information-access policy**

**Scope.** Study the experience of travelers, expatriates, visiting researchers, international publishers and distributed services when age or safety obligations differ by jurisdiction. The attached commission’s “cross-border rule becomes a global filter” scenario makes this a natural travel-domain extension. fileciteturn0file0

**Key research questions.** What determines territorial nexus: user location, provider establishment, targeting, market size, or something else? What changes for a user who crosses from the United States into the UK, EU or Australia? Can providers lawfully localize compliance, or do architectural and commercial incentives encourage worldwide restriction? When is regional non-service legally effective? Which travel-related online services themselves fall within intermediary-service regulation?

The DSA is directly relevant to the travel domain because the European Commission identifies online travel and accommodation services among the kinds of online services regulated by the framework. citeturn3search19 Australian implementation also offers a useful control: age restrictions focus on designated social-media accounts and currently do not automatically encompass every messaging, gaming, educational or health service. citeturn3search7

**Methodology.** Develop jurisdiction-switching personas—a U.S. adult researcher visiting London, a 16-year-old visiting Australia, an EU resident using a non-EU service, and a small global publisher—and trace the same lawful activity through each territorial regime. Separate statutory reach from IP geolocation, account-country settings, app-store rules and voluntary global company policy.

**Primary sources.** Territorial-scope provisions of the OSA, DSA and Australian Online Safety Act; eSafety and Ofcom guidance; EU enforcement materials; immigration/travel status only where it changes the legal analysis; first-party service terms documenting geographic restrictions.

**Expected deliverables.** Cross-border access matrix; four traveler/provider case studies; territorial-nexus decision tree; global-policy versus regional-compliance model; guidance on when non-service is legally meaningful and when it is not.

**Estimated timeline.** Two to four weeks.

**Limitations and risks.** Service behavior can change faster than legislation, location-detection methods are opaque, and apparent territorial effects may actually result from corporate account policy rather than public law.

## Comparative assessment

Scores below are analytical judgments rather than empirical measurements. “Relevance” is relevance to the attached commissioning brief; “feasibility” assumes public-source research; “impact” means likely value to a publication concerned with cognitive liberty and institutional concentration.

| Topic | Relevance | Feasibility | Typical first-phase time | Cost | Potential impact | Main dependency |
|---|---:|---:|---:|---|---:|---|
| **Policy: comparative online-safety law** | **5/5** | **5/5** | **4 weeks** | Low–Medium | **5/5** | Continuous legal-status checking |
| **Technology: privacy-preserving assurance** | 5/5 | 4/5 | 4–6 weeks | Medium | 5/5 | Precise legal performance requirements |
| **Business: compliance and over-removal incentives** | 4/5 | 4/5 | 3–5 weeks | Low–Medium | 4/5 | Sparse proprietary cost data |
| **Science: causal evidence of harms/benefits** | 4/5 | 3/5 | 5–8 weeks | Medium | 5/5 | Platform-data and external-validity limits |
| **Travel: cross-border digital access** | 3/5 | 5/5 | 2–4 weeks | Low | 3/5 | Territorial-scope conclusions from policy project |

The **policy project dominates on sequencing**, even though the science and technology projects may ultimately have equally high substantive impact. There are three reasons.

First, it directly answers the commission. The requested final analysis requires exact provisions, status, applicability, sanctions, exceptions, enforcement routes and six scenarios; all of those are legal-baseline tasks. fileciteturn0file0

Second, the baseline is currently moving. Senate KOSA is not frozen at the text originally introduced in May 2025: the Commerce Committee approved it “as amended by the Blackburn substitute, as modified” on August 5, 2026. citeturn7search0 The House, meanwhile, passed H.R.7757 on June 29, 2026, and a House member supporting the bill expressly noted that the package does not contain the Senate KOSA-style duty-of-care provision. citeturn8search1turn10search8 A report that treats these as interchangeable would fail one of the central methodological requirements in the commissioning brief.

Third, the comparative legal work will identify the correct counterexamples. The DSA’s no-general-monitoring clause, Australia’s service exclusions and distinction between account-holding and public-content access, and UK age-assurance/access-assessment structure are exactly the kinds of provisions that can either defeat an overclaim or sharpen it into a narrower, more defensible criticism. citeturn2view6turn3search7turn3search17

## Recommended topic and four-week plan

### Recommendation

The first project should be:

**“When online safety becomes a system for suppressing lawful inquiry: a comparative audit of the UK, United States, European Union and Australia.”**

The governing thesis should remain **a hypothesis to test**, not a conclusion to presuppose:

> Safety regimes can generate interference with lawful inquiry through direct duties, ambiguous risk obligations, age-classification systems, sanctions, regulator guidance, and private overcompliance; however, the strength of that claim must be assessed provision by provision, with statutory safeguards and counterexamples given full effect.

That framing preserves the commissioning perspective without sacrificing evidentiary rigor. It also makes room for findings unfavorable to the initial critique—for example, where a provision plainly does not cover a private local tool, where an exception protects scholarly activity, or where a narrow rule preventing non-consensual exploitation protects rather than diminishes another person’s cognitive liberty.

### Detailed research plan

**Week one — Status lock and authoritative legal map, September 7–13**

Freeze a September 6, 2026 legal-status baseline and create the version-control register before doing normative analysis.

For each target provision, record jurisdiction, exact instrument, version, operative date, affected service, territorial trigger, required/prohibited conduct, statutory exceptions, regulator, sanctions, administrative or judicial review, and source locator. Separate “enacted,” “commenced,” “guidance operative,” “introduced,” “committee-reported,” “passed one chamber,” and “not enacted.”

The U.S. work should begin with the current Senate amendment package from the August 5 Commerce Committee action and the House-passed June 29 H.R.7757 text, not merely the May 2025 introduced S.1748 text. citeturn7search0turn9search1turn8search3

The EU review should put Article 8 beside systemic-risk, notice-and-action, transparency and due-process provisions rather than isolating one clause. citeturn2view6

The UK review should distinguish child-access assessments, children’s risk assessments, illegal-content duties, recommender measures and the April 2026 CSEA reporting regime; Ofcom states that the latter currently applies operationally to user-to-user services, with search-service commencement expected separately. citeturn3search15

**Milestone:** verified legal-status table and first versions of `legal-register.json` and `sources.json`.

**Week two — Duty-to-interference matrix and six scenarios, September 14–20**

Translate statutory provisions into causal mechanisms.

For every alleged interference, record:

**legal trigger → provider response → information/activity affected → person or machine capability case → immediate consequence → longer-run concentration/chilling hypothesis.**

Develop the four commissioned scenarios: research room mistaken for a harmful feed; private question becomes a risk signal; future persistent machine denied an intellectual education; cross-border law produces a global filter. Add the two required controls: one in which the statutory text or exception defeats the criticism, and one where a narrow restriction affirmatively protects consent, safety or cognitive liberty. fileciteturn0file0

The research-room scenario should explicitly test recommender dependence. A deliberately chosen scholarly corpus without algorithmic amplification may implicate different risks from an engagement-maximizing public feed; the research must determine whether the statute actually recognizes that distinction rather than assuming it.

The private-question scenario should be especially disciplined: do not equate a provider’s desire to classify user queries with a legal monitoring mandate unless the law actually requires it. Article 8 makes that discipline indispensable in the EU analysis. citeturn2view6

**Milestone:** duty-to-interference matrix plus six complete scenario skeletons with documented/inferred/hypothetical labels.

**Week three — Evidence of actual spillover, defenses, and less restrictive alternatives, September 21–27**

Search for real evidence of false positives, over-removal, access denial and burden shifting. Prioritize regulator transparency databases, platform appeals data, judicial records, audit reports, researcher-access studies, original empirical papers and documented changes to provider policy.

Use a formal control structure:

| Evidence type | Purpose |
|---|---|
| Positive control | A case clearly covered by the protective objective, such as illegal exploitation or a concrete credible threat |
| Negative control | Lawful research or a service/function plainly outside the relevant duty |
| Boundary case | Lawful but disturbing material whose regulatory treatment depends on age, recommendation, context or service type |
| Overcompliance case | Provider restriction broader than the verified legal minimum |

Also write the strongest defense of each principal target. For example, child-safety rules can be defended as product-design or audience-specific safeguards rather than viewpoint regulation; the DSA can point to Article 8 and its express fundamental-rights framework; Australian authorities can point to exceptions and continued access to public content; KOSA advocates can stress controls on design and recommendations rather than a general ban on information. Those defenses must be confronted at their strongest rather than omitted. citeturn2view6turn3search7turn2view4

The empirical science work should be used to discipline both sides. Modern randomized research shows that some algorithmic interventions can affect behavior or attitudes, while other interventions produce null or context-dependent results; that makes precise harm predicates preferable to sweeping assumptions. citeturn5search2turn5search6

**Milestone:** over-removal evidence dossier, defenses-and-rebuttals memo, and first draft of narrowing alternatives.

**Week four — Reform specification, adversarial quality control, and publication bundle, September 28–October 4**

Draft reform language around several principles: precise injury predicates; adult/private-inquiry safe harbors where compatible with others’ rights; separate treatment of recommendation from deliberate retrieval; data minimization in age assurance; reasoned notices; accessible appeals; transparency on false positives and reversals; protection against general monitoring; proportionality for small or operatorless services; periodic sunset/review.

Technical alternatives should be tested against current identity standards rather than described as magical privacy solutions. W3C’s current Verifiable Credentials architecture supports selective disclosure, while NIST’s identity guidelines supply a contemporary framework for proofing, federation, security and privacy; the research should ask what can be borrowed without creating a new centralized identity chokepoint. citeturn4search0turn4search4

Then run a claim audit: every statement marked “law requires” must resolve to operative text; every statement marked “regulator expects” to official guidance or decision; every “provider did” to documented evidence; every causal extension to a stated inference; every future-machine claim to a labeled hypothetical.

**Milestone:** publication-ready `report.md`, `legal-register.json`, `sources.json`, `scenarios.json`, `reform-options.md`, `search-log.md`, and `manifest.json`, matching the eventual bundle specified in the commission. fileciteturn0file0

```mermaid
gantt
    title Four-week research program
    dateFormat YYYY-MM-DD
    axisFormat %b %d

    section Legal baseline
    Status lock and primary-source register :a1, 2026-09-07, 7d
    Legal register complete :milestone, m1, 2026-09-13, 0d

    section Interference analysis
    Duty matrix and six scenarios :a2, 2026-09-14, 7d
    Scenario package complete :milestone, m2, 2026-09-20, 0d

    section Evidence and alternatives
    Over-removal evidence and strongest defenses :a3, 2026-09-21, 7d
    Reform options draft :milestone, m3, 2026-09-27, 0d

    section Synthesis
    Draft language, adversarial audit, final bundle :a4, 2026-09-28, 7d
    Publication bundle :milestone, m4, 2026-10-04, 0d
```

The four-week schedule is best treated as a **first authoritative edition**, not as a promise of permanent legal completeness. The U.S. legislative process alone may require an update between research freeze and publication: S.1748 became eligible for full-Senate consideration only after the August 2026 committee action, while the House has already adopted a different vehicle. citeturn9search0turn8search1

## Targeted clarifying questions

1. **Should the attached online-safety commission be treated as the definitive topic, or do you genuinely want the five domains considered as competing independent projects?**

2. **Who is the primary intended reader of the eventual research: general readers, legislators and regulators, constitutional litigators, technical system designers, or investors/operators deciding where to provide service?**

3. **How central should hypothetical machine cognitive liberty be relative to present-day human rights?** For example, should future machine principals occupy roughly 10–20% of the report as a capability-contingent extension, or be a coequal theme?

4. **Should the final normative position begin with a presumption favoring repeal/narrowing, as the commissioning brief suggests, or should the research be allowed to recommend retaining a provision unchanged when the primary evidence supports it?**

5. **What level of U.S. constitutional analysis is desired?** A focused First Amendment/Section 230/federalism treatment, or a deeper litigation memorandum with circuit splits, standing, remedies, and later-treatment checks?

6. **Should “over-removal evidence” be limited to published and regulator-accessible evidence, or should the project also design a reproducible synthetic audit protocol that could later be run against public services?**

7. **How technical should the age-assurance alternative become?** A legislative principle such as data-minimized age-threshold proof, or a full architecture comparison covering credentials, device assertions, biometrics, inference, federation, revocation and unlinkability?

8. **Should the business analysis quantify compliance burden wherever public data permit, including sensitivity models for small versus large providers, or remain mainly qualitative to avoid weak numerical assumptions?**

9. **For the cross-border analysis, which service model matters most: a small publisher, a scholarly research forum, an operatorless commons like the Concresca example, a private/local AI assistant, or a large public platform?** The attached brief distinguishes these actors because the same legal rule may affect them very differently. fileciteturn0file0

10. **What publication constraint matters most: speed, exhaustive legal defensibility, empirical novelty, or a concrete reform proposal ready to be quoted in legislative advocacy?** The answer determines whether the next increment should prioritize status/case-law verification, original evidence analysis, technical architecture, or draft statutory language.