I agree with your concerns. I'm just a techie with no legal background, but as far as I understand it, KOSA enforcement would be done by the FTC and state AGs

I agree with your concerns. I'm just a techie with no legal background, but as far as I understand it, KOSA enforcement would be done by the FTC and state AGs via civil suits against companies. It's not a criminal matter, so law enforcement agencies wouldn't be involved, except in the normal ways law enforcement can become involved in civil cases.