California exempts Linux and open-source software from new age verification law

[Alfonso Maruccia]

Recap: California will require software vendors to verify users' ages at the operating system level in the coming months. Thanks to the latest changes approved by the state's Assembly, the new draconian requirements will not apply to software projects designed to be modified or copied.

For the time being, Linux and other open-source software projects are safe from California's upcoming age-verification law. State lawmakers recently passed Bill 1856, which introduces several significant amendments to the original Digital Age Assurance Act (DAAA) and its age-verification requirements.

Bill 1856 defines an "operating system provider" as a person or organization that develops, licenses, or otherwise controls an OS product for computers, phones, or other general-purpose computing devices. The law also states that operating systems or software applications intended to be copied, redistributed, or modified do not have "providers" under the legislation and therefore should not be required to verify users' ages.

Many popular OS projects, including Linux distributions used by both consumers and enterprise organizations, should now be exempt from the DAAA's provisions. However, some Linux-derived projects, such as SteamOS, might still be forced to impose age verification on their users. The gaming-focused operating system is based on the Arch Linux project, but Valve provides its own "official" OS images along with a proprietary Steam client.

Bill 1856 provides other important clarifications to the DAAA. The original law contained a badly mangled definition of a "user," essentially turning every Californian consumer into a child. Lawmakers have also added a new prohibition against potential misuse of the "age signal" provided by an operating system. Under the revised law, OS providers and app store owners will only be required to disclose a user's age when law enforcement agencies or other state authorities request it.

The full DAAA package will take effect on January 1, 2027. While Linux distros should be safe, other commercial platforms such as Windows, Android, and iOS will be required to verify a user's age during the operating system's setup process. Furthermore, devices configured before January 1 will have until July 1, 2027, to implement the new age check.

Age-verification requirements are growing in both scope and popularity, but some users are fighting the new rules. The Electronic Frontier Foundation has heavily criticized California's DAAA, stating that the law will impose new and potentially unconstitutional barriers preventing adults and younger citizens from freely accessing information online.

Permalink to story:

California exempts Linux and open-source software from new age verification law

 

[Squid Surprise]

How strict is the age verification? Can I just enter in my age? Or do I need Photo-ID or some such?

If it’s the former, the law is useless… if the latter, now we have a police state…

 

[yRaz]

I want steam to just say "yeah, we're not doing that". They don't need to sell the steam machine in CA and now that the whole Flock thing is sweeping the US people aren't really in favor of things that feel like mass surveillance

 

[NumberNine]

I roll my eyes whenever I hear "we need to collect more personal information to protect you properly". Why is it that the only way to protect the children is to exploit the adults to the tune of a tidy profit? Hmmmm?

 

[Dreadcthulhu]

This whole having the OS be the age verifier seems daft to me. To give real world analogy - its reasonable to expect say, a liquor store to verify that people at the store wanting to buy liquor are of legal age to do so.

But instead, imagine if law makers decided that the manufacturers of automobiles or services like Lyft/Uber had to verify the age of the person purchasing a car or getting a ride, and then car or the ride service had to send that info to the liquor store. It would both be stupidly overcomplicated, and rife with problems. Like say if a 16 year old borrows his dad's Ford and goes to the liquor store and Ford's software then reports the owner's (dad) age to the store. Everyone would agree that would be an insane system to have. Yet, toss it on a computer and its fine? What are those lawmakers smoking?

 

[Axeia]

How strict is the age verification? Can I just enter in my age? Or do I need Photo-ID or some such?

If it’s the former, the law is useless… if the latter, now we have a police state…

If it's like other places that require it, might require taking a selfie or selfie video.
Then again that's for verifying you're of a certain age rather than giving a specific age though.

 

[yRaz]

This whole having the OS be the age verifier seems daft to me. To give real world analogy - its reasonable to expect say, a liquor store to verify that people at the store wanting to buy liquor are of legal age to do so.

But instead, imagine if law makers decided that the manufacturers of automobiles or services like Lyft/Uber had to verify the age of the person purchasing a car or getting a ride, and then car or the ride service had to send that info to the liquor store. It would both be stupidly overcomplicated, and rife with problems. Like say if a 16 year old borrows his dad's Ford and goes to the liquor store and Ford's software then reports the owner's (dad) age to the store. Everyone would agree that would be an insane system to have. Yet, toss it on a computer and its fine? What are those lawmakers smoking?

What really pisses me off about these age verification laws is that most of it could be solved by the parents. You're supposed to know what your kids are doing. So taking this idea and applying it to people who might not even have kids is really absurd. I'm not okay with this universal age verification system but I'm also not against someone asking for ID when they're selling tanacoo or alcohol or someone is trying to get into an adults only space.

And here is the other thing about open source, they will never stop people using open source operating systems if they want to. Like, what, you're going to stop people from downloading and running an operating system made in another country or even state? Ubuntu makes an California only version of its OS, well what's stopping you from downloading the Florida, New York or Canada version?

if they try fight that they're just going to push more people on to the dark web an segregate the Internet. And maybe CP2077 had it right, there is a whole seperat internet that is just AI bots.

 

[Dreadcthulhu]

What really pisses me off about these age verification laws is that most of it could be solved by the parents. You're supposed to know what your kids are doing. So taking this idea and applying it to people who might not even have kids is really absurd. I'm not okay with this universal age verification system but I'm also not against someone asking for ID when they're selling tanacoo or alcohol or someone is trying to get into an adults only space.

That's very true; I have children myself, and I monitor them in a way that is appropriate for their age. And this system honestly makes it even harder for parents. Its really common for parents to set up a device, and then occasionally let their children use it. If the parents set up a device with ADULT flag, then well it will be trivial for children to use that borrowed device to easily see adult-only websites of various sorts, the OS silently telling the website that the owner of the device is of age. If the burden of IDing a user/customer is on the adult-only website (just how in the physical world the burden of IDing people for adult-only stuff is on the actual business), well that will at least stop some children some of the time. It means parents have to make sure that any device their child is using is set up with that child flag correctly, which could be a pain, especially if you need to set make new accounts, and all that stuff.

And any adult material that lacks an age check of their own is unlikely to start using the OS age check anyways, so OSes set to CHILD will still be able to access those.

 

[Theinsanegamer]

The irony that the same state that passed this still argues voter ID laws are rayciss is so strong you could use it to make battleship armor.

Here's an idea: hold parents accountable for raising their kids, and actually punish people who commit crimes against children.

 

[brucek]

Since we're 20+ years into not having had this system, are there any studies documenting the widespread harm its absence has caused?

Or is this mostly just a made up pretense for other goals?