Every statute, mapped to a signal.
One law's obligation becomes a typed rule a conformant router carries — and proves it acted on.
Conformance is evidence, not approval.
Before anything below: a mapping on this page is not a compliance determination. OCSS conformance does not confer regulatory approval and is not a COPPA safe harbor. It is something a regulator can weigh, alongside everything else, when they evaluate you — so we state the boundary exactly as the spec does, with no softening and no implied stamp.
Phosra is building toward OCSS Certified— a status earned from the standard and its conformance suite, never issued by us. We don't self-certify, and we don't ship a “Phosra Certified” badge.
“A conformance claim under this specification attests that an implementation satisfies its declared OCSS rule lists; it is not a compliance determination under any statute or regulatory scheme, and it MUST NOT be represented as one.”
Read the full §5.1 at openchildsafety.com
From statute to signal to a receipt you can replay.
The registry isn't a reading list. Each statute is decomposed into typed rule categories, those categories drive a conformant decision, and the decision leaves an auditable trail. Three steps, one direction.
A law says what a platform owes a child
COPPA wants verifiable parental consent. KOSA wants a duty of care. The EU DSA wants minor-protection by design. Each statute is tracked in the registry below with its key provisions, status, and the jurisdictions it binds.
Each provision maps to an OCSS rule category
A statute's obligations are decomposed into typed rule categories from the 115-category OCSS registry — parental_consent_gate, screen_time_report, commercial_data_ban, ai_chatbot_tier_gate, and the rest. One statute touches many categories; one category serves many statutes.
The router enforces the signal at the surface
An OCSS-conformant decision carries that rule vocabulary across DNS, MDM, routers, and app controls — and writes a replayable receipt with the rule, the input, the output, and the statute citation. The same parental choice means the same thing on every surface.
The full registry, jurisdiction by jurisdiction.
Every statute Phosra tracks, grouped by jurisdiction, monitored weekly. Open a group and follow any law to its full provision mapping, Phosra feature crosswalk, and a compliance-readiness checklist.
The registry is also available as JSON at /api/compliance/laws — single laws, rule-category mappings, and jurisdiction filtering included.
The frameworks that govern minor data.
These are enforceable policies in the registry, not documentation wishes. Each links to its full provision-by-provision mapping in the registry above.
COPPA / COPPA 2.0
Verifiable parental consent, minimum-necessary collection, and parent-initiated deletion are decomposed into rule categories and enforced — not just documented.
Statute mappingKOSA
Duty-of-care surfaces mapped across the OCSS categories: content filtering, design-feature limits, and parental tooling, each tied to a signal.
Statute mappingEU Digital Services Act
Article 28 minor-protection obligations and risk reporting, backed by queryable audit trails and transparency-report-ready exports.
Statute mappingUK Age-Appropriate Design Code
High-privacy defaults, no profiling, and no nudges expressed as enforceable policies in the registry — readiness you can check, not assert.
The vocabulary is the standard's. We just implement it.
The rule categories these statutes map to belong to OCSS — the Open Child Safety Specification, currently an individual IETF Internet-Draft (Draft 4, pre-release), not yet ratified and not a standards-body publication. Phosra is its reference implementer and one accredited network on it — like Yubico for FIDO2: we build the thing, we don't control the standard. The canonical rule registry and conformance suite live at openchildsafety.com — not here.
That separation is the point. A mapping you can check against an open registry is worth more than one vendor's claim — which is why the categories, the statutes, and the conformance tests are all public, and why nothing on this page asks you to take our word for it.
Missing a statute? Tell us — we'll map it.
We monitor global child-safety legislation weekly and add new laws as they're introduced. If you know of a regulation we haven't mapped, point us at it — the registry is only useful if it's complete.
The rule vocabulary these statutes map to lives at openchildsafety.com — spec, rule registry, and conformance suite.