Just as I thought that the worst thing that could happen to humankind and the worst possible thing in America was Donald J. Trump, wokism in Socialist California struck again!

Quick jump to:

California being California…

The State of California is that crazy entity that has a worldwide exclusivity: according to the list of over 900 substances listed in Proposition 65, almost everything is “known to cause cancer”! Even the wood dust has been listed since December 18, 2009, as presenting this risk!

The Advanced Clean Cars II (ACC II) regulation, adopted by California in 2022, updated the zero-emission vehicle (ZEV) regulation to require that 100% of new passenger vehicles meet zero-emission standards (including plug-in hybrids) by the 2035 model year. In practice, each manufacturer must sell a specific percentage of zero-emission vehicles calculated as a ratio of ZEVs to total vehicles sold in the state: 35% for 2026, 43% for 2027, 51% for 2028, 59% for 2029, 68% for 2030, 100% for 2035. Each automaker must meet these targets independently! California can fine manufacturers for non-compliance, as if a manufacturer could force the public to purchase what the public does not want to buy!

This is similar to (but also quite different from) the requirements from the Green Soviets of Greta Thunberg, aka the EU. Here, while there is a 100% CO₂ reduction target for 2035 (effectively banning new ICE sales), manufacturers can balance high-emitting ICE vehicles with zero-emission vehicles across their entire EU fleet (not per country), and the target is not the percentage of vehicles but a fleet’s average CO₂. This is slightly less restrictive but still antidemocratic: you cannot force people to purchase EVs as long as ICE vehicles are still manufactured! Fines for non-compliance can also be applied.

Surprisingly for some, there is more freedom in China, the number one EV producer in the world. There, the “dual credit” policy system means that “NEV” credits can be earned by a manufacturer for each EV sold based on range, energy efficiency, battery density, and low-temperature performance. Then, a second CAFC (Corporate Average Fuel Consumption) credit requirement targets require manufacturers to meet weight-based fuel economy standards across their entire fleet. NEVs count as zero-emission vehicles in this calculation, effectively lowering the fleet average. The NEV credit requirements per manufacturer are 38% for 2025, 48% for 2026, 58% for 2027 (it started with 10% in 2019). However, there’s a lot of flexibility: surplus NEV credits can be sold to other manufacturers. In practice, the dual credit system rewards fuel-efficient ICE vehicles and hybrids alongside pure EVs while avoiding the “one-size-fits-all” approach. If a manufacturer cannot sell enough high-range EVs to earn credits and cannot sell enough fuel-efficient ICE vehicles to reduce NEV credit obligations, it can buy credits from competitors (conversely, it can also bank excess credits for future years!). This means that ICE vehicles remain available as long as consumers demand them; by purchasing credits from competitors, ICE vehicles would become slightly more expensive, but consumers can still buy that ICE vehicle if they value it more than the price premium. China preserved the market choice by resorting to a Pigouvian tax rather than prohibitory regulations. Funny how a “communist” state leaves more freedom to the market, eh?

Back to the more communist but nominally democratic California, here’s the next step on the path of becoming a fully woke dictatorship:

The State of California in the United States of America has passed a law which will require operating systems to collect and provide the birthdate or age of the person using the computer.

Read also: Ubuntu, Fedora, Linux Mint Eye Age Verification Amid California Law Backlash.

Now, how is the Linux “community” reacting?

Ubuntu

Aaron Rainbolt (a fundamentalist who needs to stress that he’s a Christian), on Ubuntu lists: On the unfortunate need for an “age verification” API for legal compliance reasons in some U.S. states:

Recently, a new law was passed in California that requires OS vendors to provide some limited info about a user’s age via an API that application distribution websites and application stores can use. [1] Colorado seems to be working on a similar law. [2] The law will go into effect January 1, 2027, it is no longer a draft. I do quite a bit of work with an OS vendor (working with the Kicksecure [3] and Whonix [4] projects), and we aren’t particularly interested in blocking everyone in California and Colorado from using our OSes, so we’re currently looking into how to implement an API that will comply with the laws while also not being a privacy disaster. Given that other distributions are also investigating what to do with this, and the law requires us to make a “good faith effort to comply with [the] title, taking into consideration available technology”, I figured it would be a good idea to bring the issue here.

At its core, the law seems to require that an “operating system” (I’m guessing this would correspond to a Linux distribution, not an OS kernel or userland) request the user’s age or date of birth at “account setup”. The OS is also expected to allow users to set the user’s age if they didn’t already provide it (because the OS was installed before the law went into effect), and it needs to provide an API somewhere so that app stores and application distribution websites can ask the OS “what age bracket does this user fall into?” Four age brackets are defined, “< 13”, “>= 13 and < 16”, “>= 16 and < 18”, and “>= 18”. It looks like the API also needs to not provide more information than just the age bracket data. A bunch of stuff is left unclear (how to handle servers and other CLI-only installs, how to handle VMs, whether the law is even applicable if the primary user is over 18 since the law ridiculously defines a user as “a child” while also defining “a child” as anyone under the age of 18, etc.), but that’s what we’re given to deal with.

The most intuitive place to put this functionality would be, IMO, AccountsService. The main issue with that is that stable-release distributions, and distributions based upon them, would be faced with the issue of how to get an updated version of AccountsService integrated into their software repositories, or how to backport the appropriate code. The law goes into effect on January 1, 2027, Debian Bookworm is going to be supported by ELTS until July 30, 2033, and we don’t yet know if Debian will care enough about California’s laws to want to backport a new feature in AccountsService into Debian Bookworm (or even Trixie). Distributions based on Debian (such as Kicksecure and Whonix) may still want to comply with the law though, so something using AccountsService-specific APIs would be frustrating. Requiring a whole separate daemon for the foreseeable future just for an age verification API would also be annoying.

Another place the functionality could go is xdg-desktop-portal. This one is a bit non-ideal for a couple of reasons; for one, the easiest place to put the call would be in the Account portal, which returns more information than the account’s age bracket. This could potentially be considered non-compliant with the law, as it states that the operating system shall “[s]end only the minimum amount of information necessary to comply with this title”. This also comes with the backporting disadvantages of an AccountsService-based implementation.

For this reason, I’d like to propose a “hybrid” approach; introduce a new standard D-Bus interface, org.freedesktop.AgeVerification1, that can be implemented by arbitrary applications as a distro sees fit. AccountsService could implement this API so that newer versions of distros will get the relevant features for free, while distros with an AccountsService too old to contain the feature can implement it themselves as a stop-gap solution.

The message is longer, but he literally proposed Ubuntu Linux to become a Big Brother!

The first reply came from a retard:

By definition, not a Debian or Ubuntu problem:
https://www.merriam-webster.com/dictionary/vendor

He’s not completely wrong, though. Who’s the vendor of a free OS, no services included? But you can kiss goodbye to finding laptops with a preinstalled Linux distro, because that OEM would suddenly also become a software vendor.

After a number of people only considered the technical aspects, a smarter guy chimed in:

I am also not a lawyer but the law seems like it could easily be challenged and likely run afoul of privacy laws here in the US. The technical ramifications and enforcement of them can’t be implemented in a way that wouldn’t run afoul of privacy related rights (yes, even children have privacy rights) and also present a security quagmire.

Further it puts the onus all on the “developer” or OS vendor to essentially keep track and obey “signals”, or be fined. The spirit of the laws existence is to protect children but the implementation of this or a path-forward almost seems farcical to discuss. It’s very clear it’s drafting and implementation had no one who understands how this works in the room, and if they were, they were summarily ignored.

Getting ahead of it as you are, whatever solution, it won’t matter, because every larger distro is likely to implement their own way-to-do and same with every smaller one, and of course there will be those that ignore this completely or stop distributing in California and states that adopt such a law. The law’s spirit is in the right place, but it needs revision so it can be implemented appropriately.

But no, law’s spirit is nowhere near the right place!

Jon Seager, VP of Engineering at Canonical, in a separate thread:

Over the past couple of days, there has been a lot of commentary about Ubuntu and how it’ll respond to California’s new Digital Age Assurance Act (AB 1043), which will require operating systems to collect age information at account setup and expose an age “signal” to eligible applications from 2027.

Canonical is aware of the legislation and is reviewing it internally with legal counsel, but there are currently no concrete plans on how, or even whether, Ubuntu will change in response.

The recent mailing list post is an informal conversation among Ubuntu community members, not an announcement. While the discussion contains potentially useful ideas, none have been adopted or committed to by Canonical.

When we have a clear plan, we will publish it through our usual channels.

If and when. Mostly if…

Fedora

Thread on Fedora Discussion: California Age Verification:

Are you aware of this?

California’s Digital Age Assurance Act, effective January 1, 2027, mandates that operating system providers and application developers implement age verification measures to protect minors online. This includes collecting age information during account setup and providing age bracket signals to developers when apps are downloaded.

Comment #2:

Yeah …

Instead of actually fixing the issue, let’s make stupid legislation that makes a lot of noise and fixes nothing. How about something like “Hey, parents, if you refuse to properly educate and supervise your children we are going to fine you into the poor-house.” … and then actually enforce it …

The Fedora Project Leader, at #3:

Because this is a legal matter, I’m going to refrain from speculating or opining about this until I sync with the project’s nominal legal assistance concerning impact.

Same guy, at #7:

I think the point is to not have to have all the applications have to figure out how to ask for age information individually. The point I think is to ensure age information can be part of OS account creation and applications can query the OS to determine which age bucket a user is in. No telemetry… just a way for applications to query the OS… a local API… sounds a lot like a dbus service to me.

So what I am envisioning in my head is a family desktop computer… where the parents are the administrators.. and they create an account for their kid. When they create an account, the OS needs to have a way for them to optionally indicate the age bucket for the human associated with the account. Applications then could choose to query the OS concerning the age bucket and make UI/UX adjustments based on the age bucket info the OS returns.

At #12:

Apparently blocking the state’s an option: MidnightBSD Excludes California from Desktop Use Due to Digital Age Assurance Act.

The first believer in civil rights, at #14:

Why are you considering complying with that? There is no way this isn’t just the first step towards imposing all kinds of nitpicky compliance.

Absolutely write a letter.

I would argue, not complying and taking a public stance against it would be the only way to go unless you’re prepared for government overreach into operating systems to become commonplace.

Kudos to #15!

California Prop 12 regulates pork and egg production (crafted by “animal rights” groups with the objective of making both prohibitively expensive). This got contested all the way upstairs, and the Supreme Court found that under States’ Rights, if California (CA) wants to be lunatics, they are allowed to be lunatics, and upheld it. HOWEVER, the court also found that under the Commerce Clause, CA law did not apply outside of CA, and that CA could not demand egg and pork producers in other states to be equally loony before they could sell product into CA. In short, CA cannot in any way enforce this outside their own borders, not even by restricting commerce from other states.

So that’s where it stands, under court precedent: California and Colorado can do this within their own borders, but they can’t enforce it on any other state, nor can they prohibit the noncompliant from crossing state lines. (Same as they can’t stop vehicles driving in from other states.)

And under the above, an OS preinstalled in another state then that PC sold into CA would not be regulated, as doing so would violate the Commerce Clause.

Enforcing it at all is a different matter, since the internet knows no such boundaries, and geofencing won’t prevent someone from using a VPN, or driving to Las Vegas and downloading e.g. Fedora anyway (or just using an older OS, so long as they don’t need to use “software stores”). And there’s folks like me – I’m on satellite internet, and it geolocates me in another state entirely, about 800 miles away.

And exactly how do they plan to get users to comply? The only way to do so is if OS vendors enforce it. Fill in the age field, or it won’t install. After that, you’re into the murky grey area that surrounds software piracy, because absent identity verification (NOT required under this CA law’s text) you can’t stop users from inputting any age they like. One suspects were such ID verification enforced, it would work about as well as those states’ voter verification (ie. not at all).

What this DOES do is give the nefarious legal protection: “Your kid claimed he was 21, so it’s not our fault if he did $_age-restricted-by-law-thing on our site.”

Microsoft is the 800 pound gorilla here, and what Microsoft does is going to dictate whether this flies for everyone else. If they go along with it, anyone who doesn’t is functionally dead in the market, and such laws will spread elsewhere. If Microsoft says “you-and-which-army plan to enforce this?” then the law is DOA instead.

However, I fear Microsoft will say “Nifty opportunity to enforce that Microsoft login” and go right along with it. (Especially as I believe the next major iteration of Windows will be OS-by-subscription, which will require a credit card or bank account for billing. What did you think TPM was really about, hmmm?)

And yes, if parents hadn’t offloaded so much responsibility for parenting onto the government (albeit strongly “encouraged” to do so by mandatory public schooling) we wouldn’t be having this discussion, but that horse is long since out of the barn, down the road, and out of sight.

On the other hand…:

Other parts of the world (e.g., Europe) are pursuing not-dissimilar legal constructions.

At #70:

If this is open for discussion I would echo the suggestion for peaceful non-compliance. Fedora, let alone any other OS, has no ethical obligation to comply with the arbitrary demands of corrupt, delusional, megalomaniacs. And if history teaches us anything, it’s that complying with their capricious demands will only serve to further inflate their hubris.

I cannot imagine the implementation of this perverse requirement ending with a net benefit to the end user. In addition, I suspect some, perhaps even a non-trivial amount of users, will leave any distribution that does comply. But I could be wrong, this is just speculation.

It’s time for some action!

Class Action Suit anyone? I wish I were in a position to lead this but I’m not. Use our money to sue them and fight back. If corporations aren’t going to push back it’s only us that can fight back before it’s too late. Please someone take the lead!

Age Verification Explained: Rob Braxman Tech: Age Verification Mandates: The ‘Protect the Kids’ Scam That’s Building a Permanent Surveillance Grid.

Oh, I was delighted too soon:

Here is my thought on that: Some species of age verification is coming everywhere, like it or not. (U.S. Federal is in the works.) And at some point it become impractical to avoid it, at least if you want access to the modern internet.

It is always better to set the standard than to have someone else’s standard thrust upon us.

Therefore it would be better if, say, linux engineers preemptively design and implement the specification, to ensure that it does not overflow its bounds, to ensure it works sufficiently as required (so it doesn’t spawn worse), and to ensure it protects privacy as much as possible.

Become the standard, to limit what this can do.

Don’t wait until it’s “Microsoft did it this awful way, therefore that is now the standard that holds up in court.”

That was a cute one:

IMO, anything more than a boolean that a parent or guardian can set and unset at will is too much.

Nobody’s a lawyer, but…

Not a lawyer of course but this legislation seems to go well beyond just operating system providers if I’m reading it right. This section seems to say that every piece of software in existence is legally required to request information from the OS-provided api on download/launch:

(b) (1) A developer shall request a signal with respect to a particular user from an operating system provider or a covered application store when the application is downloaded and launched.

It also seems to forbid the application from accessing any other OS-level apis:

(4) A developer that receives a signal pursuant to this title shall use that signal to comply with applicable law but shall not do either of the following:

(A) Request more information from an operating system provider or a covered application store than the minimum amount of information necessary to comply with this title.

Can someone please correct me if I’m wrong?

Also, a similar proposed bill in New York mentions:

METHODS THAT REASONABLY PREVENT AGAINST CIRCUMVENTION

Depending on what California’s bill means by “good faith effort” in this section, could that also be implied by the California bill?

An operating system provider or a covered application store that makes a good faith effort to comply with this title

And if that’s the case, couldn’t one interpretation of “good faith compliance” with this in a way that isn’t circumventable mean that this api would need to live in the kernel? Which would mean that complying with this law could mean discussions with kernel developers.

At least some good news:

A federal judge in Virginia blocked the state from enforcing its social media age-limit law (SB 854) just a few days ago. The judge ruled that the mandate, which forced platforms to verify ages and limit minors to one hour of daily use, violates First Amendment rights by overextending to both adults and children and leaving out addictive interactive games.

A legal precedent is a judicial decision that serves as an authority for courts when deciding subsequent identical or similar cases, promoting consistency and predictability in common law systems. Precedents can be either binding, requiring lower courts to follow them, or persuasive, allowing courts to consider but not be obligated by them.

The bill seems completely nuts!

To my non-lawyer eyes, bill seems to make operating system providers liable for all installations/accounts in the state, including existing installations. So blocking downloads from California would seemingly have no effect on operating system provider liability:

1798.502.

(a) With respect to a device for which account setup was completed before January 1, 2027, an operating system provider shall, before July 1, 2027, provide an accessible interface that allows an account holder to indicate the birth date, age, or both, of the user of that device for the purpose of providing a signal regarding the user’s age bracket to applications available in a covered application store.

(b) If an application last updated with updates on or after January 1, 2026, was downloaded to a device before January 1, 2027, and the developer has not requested a signal with respect to the user of the device on which the application was downloaded, the developer shall request a signal from a covered application store with respect to that user before July 1, 2027.

Wait, what?!

How about the Brazilian version of this law that goes into effect in 16ish days?

Pink glasses at #100:

A lot of the current panic about Linux needing age verification seems overblown.

Laws like the California Digital Age Assurance Act are aimed at platform ecosystems that run app stores and user identity systems (Apple, Google, Microsoft). Linux distributions don’t operate that kind of centralized platform.

Fedora distributes software; it doesn’t run a consumer device ecosystem or a mandatory account system. That makes enforcement against a distro fundamentally different from enforcement against a commercial platform.

So this is something worth watching, but right now it looks more like speculation than an actual requirement for Linux distributions.

I strongly disagree with #112:

Oh, I don’t understand why such reasonable request from California makes such huge emotions. I think they are often not understanding what is requested from them. I think unlike law pushed in United Kingdom, California has made the step in the right way.

I agree with Neal, I would put users date of birth into /etc/shadow. It should not be exposed to every local application and it should not require manual modifications after children’s birthday. If we want something allowed to that information, use something policykit or similar.

  • I assume OS installation is done by an adult. Either a guardian or someone on his behalf. If there is any legal obligation, child cannot proceed on his own.
  • I think that means every Fedora installation will need one adult account (no need for date of birth in that case).
  • One or more child accounts will have stored date of birth in some private storage, might be /etc/shadow. Games have no need to know exact day of birth of anyone on the system, unless they want them to know.
  • System configuration policy will define mapping of exact age to PEGI-like groups. Especially when child is considered adult according to law.
  • System will provide low-level system call, which can respond with age group of requested user id (uid_t), which age group he is.
  • DBus service should provide it for an easy consumption.
  • System override could set that all accounts on this system belong to some maximal age group. Good for school devices, devices used exclusively by child.
  • Browsers like Firefox might pass age group in requests made by such users, which could not be disabled by the child.
    • to protect privacy of child, default sites should receive only information is underage true/false
    • sites allowed by guardians/system policy can receive also age group. For example list of social networks requiring age of 13 would belong here.
    • only explicit allowed sites could also receive directly date of birth from the system directly.
    • quite similar concept, like access to microphone, camera or notification popups from the browser
  • none of these information need to be put anywhere online, uploaded to OS vendor or other stuff. On Fedora, they should remain local unless needed for other online activity
  • I think this is much better solution than proving everywhere I am an actual adult. Every child has some guardian adult. Make it possible for them to set the rules. Ability of local applications to request child status and age group is valid basic step towards it.

For online services provided on Fedora, it would be nice to provide also underage accounts, but under certain conditions:

  • underage account is linked to one or more guardian adult account responsible for them, on the same or cooperating site
  • two separate guardian accounts might be needed for divorced parents, because they not always trust each other. It may include more IT proficient aunt/uncle.
  • age group is configured by the adult guardian, child itself cannot change it
  • could be useful for child’s commit rights, but dist-git admin could be only an adult, for example?

I think requirement to feed age group to OS vendor online database and store it there as mandatory is not in the bill text I have read. It says it needs to be in the OS somewhere. I have no problem with that. We do not need to restrict it to California. But might need to document in countries like California, only guardians can install the system and configure it for the kids. We should make it easy enough even for non-IT parents.

For example, parental control I have seen on Windows worked only in the Edge browser, no other browser. The reason is obvious, there is no a standard way to pass underage information into different browsers. California has made step in the right way to fix that, IMHO.

Parental controls on Android phone was trivially worked around by my nephew, when he just created his own adult account and added it to his phone or browser. How could we prevent that, I don’t even know as long term IT specialist. If Google had to obey OS underage information provided, then it would have refused the creation from kid’s machine. Parents should know where does they kids have accounts. If the kid has child account on google, you cannot solve it by blocking the whole site. Even more difficult it may became, when the kid shares the computer with his parent.

I skipped some of the 177 comments, but on my way to the end, I noticed this at #172:

The thread was fascinating, but such censorship means I’ll never comment anymore on any distro’s forums!

Mint

On Linux Mint Forums: California Age Verification:

Are you aware of this?

California’s Digital Age Assurance Act, effective January 1, 2027, mandates that operating system providers and application developers implement age verification measures to protect minors online. This includes collecting age information during account setup and providing age bracket signals to developers when apps are downloaded.

There are 187 comments! A thought from Europe (Massimiliano from Italy):

We should keep in mind that this is becoming a global standard, not just a regional experiment.
​Here in Europe, we are already moving down the exact same path and in some ways, we are even further ahead.

​The Digital Services Act (DSA): This is already in effect across the EU. it mandates that platforms ensure a high level of privacy, safety, and security for minors. While it doesn’t explicitly force one specific “age-gate” technology yet, it puts massive pressure on companies to prove they know who their users are.

​eIDAS 2.0 & the EU Digital Identity Wallet: Europe is currently developing a framework that would allow citizens to share “attributes” (like being over 18) without revealing their full identity. This is the exact “age bracket signal” I mentioned, just implemented at a government/EU level rather than just the OS level.

​The UK’s Age-Appropriate Design Code: The UK has had similar standards in place for a couple of years now, which actually served as the blueprint for California’s original laws.

We are moving away from the “click yes if you are 18” era toward a world where your device or your digital ID confirms your age before you even see the download button.

​This isn’t just an American shift but it’s a fundamental change in how the global internet works.

This, too:

I have the distinct impression that the argument of “child protection” is widely being abused by governments worldwide, to undermine our fundamental rights to privacy.

The ultimate underlying goal of those governments is, I fear, imposing harsh restrictions on freedom of speech. Because freedom of speech is a threat to the powers that be.

The first European, elsewhere:

Even if the OS only provides an API signal (e.g., is_under_18 = true), that signal is broadcast to every app and website you visit.
​Ad-tech companies don’t need your birth certificate to build a profile. If they can query a system-level API that confirms a user’s age bracket, they have just been handed a verified, high-value data point. They will correlate this “local signal” with other tracking markers (IP, browser fingerprint) to refine their shadow profiles.

​You mentioned Linux Mint as a safer alternative because we can inspect the code. While true, the law applies to the providers. If the law mandates this interface, how many “mainstream” Linux distros will be forced to implement it to stay compliant in certain jurisdictions?
​Even if the code is transparent, the metadata leakage remains. An open-source gate is still a gate. Once a website requires that local API “handshake” to grant access, the privacy barrier has been breached.

​You noted that the administrator simply enters the date. If it’s that easy to circumvent, then the law is “security theater” .
But if the law eventually demands verification (to prevent kids from just typing a fake year), we move right back to the original problem: the local system must eventually “phone home” to a government or corporate database to “verify” that the local entry is legitimate.

​The bottom line: we aren’t just choosing between “Local Storage” and “Cloud Storage.” We are discussing the creation of a mandatory digital identity layer within the OS. History shows that once a door is built, even with the best intentions, someone eventually finds a way to kick it in.

Stupid, indeed:

The only option for parental control should be dns option/s are given as a choice. No api, no birth date.

Every OS, VM, server, Android based TV/Anything would need a real birth date is stupid. Every OS just needs to state “Not for use in CA, USA.”

Was it “vendor” or “provider”?

​The law specifically targets operating system providers. While we often think of Linux as a monolithic entity, in legal terms, a “provider” could be interpreted as the entity that distributes the ISO.
​The MidnightBSD Precedent: as noted by BriarSMC, they chose to change their license to prohibit use in California. This is a clean legal exit.

​If Linux Mint refuses to implement the “age signal” API, they face a theoretical risk of civil penalties ($2,500 to $7,500 per affected child I suppose).
For a community project, this could be devastating.

​DarthLinuxrise mentions that Mint “won’t make that mistake”.

Technically, Mint in my opinion has a few paths:

  • The “Compliance” Path: Implementing a simple, local-only toggle in the user setup. While this satisfies the letter of the law, it creates the “digital lighthouse” effect I mentioned earlier, a verified signal that apps can scrape.
  • ​The “Niche/Geographical” Path: Like MidnightBSD, they could state the OS is not intended for use in jurisdictions requiring such features.

​Linux Mint is based on Ubuntu and Debian.
If Canonical (Ubuntu’s parent company) decides to implement this to stay compliant for their corporate and OEM partners (like Dell or HP), Mint would inherit that code by default. Removing it would require active de-engineering, which is a significant resource drain.

​The current text of AB 1043 emphasizes attestation rather than strict verification (like uploading an ID).
This means the OS just needs to ask and store the answer.
However, as I discussed with Graham43, the technical danger isn’t the input (which can be faked), but the output.
Once the OS is forced to provide a standardized API response (e.g., Signal: Category 4 / 18+), that signal becomes a permanent, high-value tag for the ad-tech industry and potential bad actors.

​In conclusion, while we hope for a “Linus-style” refusal, the pressure on distributions that provide “ready-to-use” desktops is immense.
We are moving toward a world where the OS is no longer just a layer between hardware and software but a legally mandated auditor of the user.

What other distro?

What is the likelihood that I will be forced to switch to another distro or go back to Windows?

Why don’t they just wait for Ubuntu to implement this shit?

The primary legal uncertainty is whether a community-led project like Linux Mint counts as an “Operating system provider” under the Digital Age Assurance Act.
The law targets those who “develop, license, or control” the OS. While Big Tech (Microsoft, Apple, Google) is the obvious target, the law doesn’t explicitly exempt open-source projects. If the California Attorney General decides to include them, Mint would have to choose between adding the interface or, as we’ve seen with MidnightBSD, simply declaring the OS “not for use” in that jurisdiction to avoid the $2,500–$7,500 per-user penalties.

​Even if the Linux Mint team refuses to add the code, they are part of an ecosystem. Mint is built on Ubuntu/Debian. If Canonical (Ubuntu) implements the age-bracket API to satisfy their hardware partners (Dell, HP, etc.), the code will exist in the repositories. Mint would then have to decide whether to actively strip that code out and a “de-engineering” task that requires time and resources.

​Switching back to Windows would likely mean moving into a more integrated version of this exact system. Microsoft already has the infrastructure for Microsoft Accounts to handle this. The irony is that the “switch” DarthLinuxrise fears might lead him exactly where the law wants him: into a closed-source environment where verification is seamless but privacy is even more opaque.

​As it stands, the 2027 mandate is for attestation (you type in a year), not verification (you upload an ID).
​The good news: You can still “lie” to your computer.
​The bad news: As I’ve argued, once the API exists to broadcast that “signal” to every website, the infrastructure for a permanent digital identity is in place. If “lying” becomes too common, the next legislative step is almost certainly a mandate for “strong” verification (IDs).

​We are currently in a “wait and see” period.
Major digital rights groups are already challenging similar laws. Their success or failure in the courts over the next 12 months will likely determine if Linux Mint ever has to write a single line of “age-aware” code.
​As for my opinion, I believe we are witnessing a fundamental shift in the “neutrality” of the personal computer. But until the first lawsuits are settled, it’s all in a state of flux.

I believe that by dismantling anonymity under the guise of “child safety,” we are building a master key that can be used for far more than just age checks.

By writing these posts and sharing these technical facts and opinion, I hope to contribute to a critical mass of dissent. If the user base remains silent, companies and legislators assume consent.
If we speak up, we keep the pressure on for a free and private internet.

The thread is really too long, so I skipped most of it. However:

The timing is indeed suspicious. In just the last few months of 2025 and early 2026, we’ve seen:
​Australia implementing a social media ban for under-16s with mandatory age assurance.
​The FTC in the U.S. issuing new policy statements encouraging “robust” age-verification that goes beyond simple check-boxes.
​The EU launching pilots for white-label age-verification apps.
​This is a global legislative trend. The “protection of children” is today in my opinion the universal key used to unlock the door to a mandatory digital identity for everyone.

​The only way to stop the “slippery slope” is to point it out while we still have the freedom and the time to do so.
I think that every person who moves from “I don’t care” to “I see what’s happening” is a win for digital freedom.

The length of some comments is unbearable. Occasionally, a little gem surfaces:

It looks like Pop_OS! has knuckled under and agreed to put in the age declaration that California’s demanding.

I fully agree with this:

If we accept the premise that any content capable of “traumatizing” or “influencing” someone should be preemptively monitored or removed, then we cannot stop at the internet. By that logic, we should apply the same 24/7 surveillance and censorship to cinema, music, video games, and literature.
​History is full of examples where authorities tried to “protect” the public by limiting what they could consume. We have seen these eras of moral panic before, and frankly, there is no reason to be nostalgic for them.

​The most critical flaw in this reasoning is the question of oversight: Who watches the watchmen?
What starts as a filter for violence or child safety can expand to include political dissent, religious views that don’t align with the state, sexual orientations or gender identities deemed inappropriate, sensitive health data, etc.

​The issue isn’t just about “having something to hide”, it’s about the fact that “what is wrong” is a subjective definition that changes with whoever is in power.

​The “protect the children” argument is incredibly effective because it frames the debate as a binary choice: you are either for surveillance or you are “pro-harming kids.”
​This is a false dichotomy. Being against a mass surveillance state does not mean you are against protecting minors. It means you believe the solution lies in parental responsibility, better education, and targeted law enforcement rather than dismantling the privacy of the entire population.

It’s also interesting how the “chainsaw” analogy focuses on the horror of the act, but ignores that in the physical world, we don’t put cameras in every living room just to prevent that one-in-a-million occurrence. We punish the criminal, we don’t watch the innocent.

From Southern Ontario:

Strangely, a lot of people ARE putting cameras in their homes and worse, training their children to accept, even love living in a surveillance world! Think “Elf On The Shelf” & “Mensch On A Bench”. I even find children trackers creepy! In my day, yup, I’m old, we did our very best to raise responsible children, capable of critical thinking and then set them free in the world. I remember my first big test by one of my teens. He asked me if he could attend an “all night party”. I felt my blood, practically, turn to ice! Then I thought, “you think you did a good job of raising this kid, now is the first real test!” Thus I replied ” I do believe you are a smart kid and I trust you will know if a situation is starting to go badly. I expect if that happens you will get your ass home, ASAP!” Then I asked: “Do you have a transit pass? Do you have at least 2 quarters for phone calls? (No cell pones then.) Do you have money for a taxi should the need be urgent? If yes to all of these then I say yes, you may attend.” Of course I did not lay down to sleep! About 1:30 AM my son walked through the door. A little surprised I inquired. “I thought you were to be out all night, why home so early?” He said “It got really boring. Just a lot of people drinking a lot and the more they drank the stupider they got. I got tired and came home.” NOW imagine if I were the control freak type parent and said “NO! Don’t you dare!” The kid of such a parent would sneak out a window and be sure to stay to the very end just to express their autonomy! My point is, the more control one tries to exert, the more determined people become to resist. The determination to resist will often come with detriments and will be done, most often, without critical thinking. I never said “no” to my children BUT I did ask a lot of pertinent questions and listened more than I instructed! That is real parental control! You can then say, “Good Luck kid! If it goes off the rails, come on back & I’ll try to help.” AND they will come back without fear of retribution.

Speculations, speculations, speculations…

Specific details will certainly emerge only once the system is officially implemented and the regulatory guidelines are finalized.
However, based on jurisdictions where age verification is already being enforced or heavily regulated (such as the UK or various European Union initiatives), the “honor system” is being replaced by “Hard Verification.”

​Here is what that looks like in practice elsewhere:

  • ​Third-Party “Double-Blind” verification: Instead of giving your ID directly to the OS provider, you provide it to a certified third-party service. That service then sends an encrypted “token” to your device confirming you are over 18 without sharing your actual identity documents with the manufacturer.
  • ​Facial age estimation: This is increasingly popular in the UK and Europe. A camera scan estimates your age based on facial features. It doesn’t identify who you are, but it estimates how old you are.
  • ​Bank/Credit Card Gateways: Some systems use a 0.00 or 1.00 credit card authorization as a proxy for age, assuming that only an adult can hold a valid credit card.

As I mentioned before, the real concern is that even with “privacy-preserving” technology, we are still creating a digital “papers please” environment.

Is this even true?

Alright, I have a good thing to report! It’s not regarding the California/Colorado proposals specifically, but the broader age verification issue. Apparently, Japan has put their foot down on the matter and refused to ever take part!

Chibi Reviews: Japan Bans Censorship of the Internet and Fictional Content by Saying NO to Age Verification

Seeing this today warmed my heart a little. Solid W for Japan!

THIS IS COMPLETELY FALSE, but it’s worth mentioning as an example of fake news on YT:

Ubuntu adding age verification via dbus.
The Lunduke Journal: Ubuntu Planning Mandatory Age Verification

Not such a bad idea:

I was planning to use Linux Mint for my first time using linux, but it would seem wise to wait, and see what distros fight back, and which ones don’t.
To take full control over anything in history you just have to start small, and slowly grow from their. Most big games started small, YouTube Started small, and many other things. So I am waiting to see who is really going to stand on their principle, or who will fall because they are too scared.

Another good point:

Let’s see if Debian will fold like a lawn chair as well or if the LMDE version persists as an option.

Massimiliano is omnipresent and over-insistent:

Since Linux Mint is open-source (GPL), users technically retain the freedom to modify the code and disable any local verification modules. However, the challenge isn’t just the OS, it’s the service level. If access to repositories or integrated web services is gated by age verification at the server level, local modification of the OS won’t bypass the requirement to access those external resources.

​The core of the debate remains how to verify age without compromising anonymity. Many advocates argue that mandatory verification effectively ends the ‘right to be anonymous’ online, transforming a safety measure into a tool for systemic digital identity tracking.

How could I disagree?

California, Colorado, they are the first. There will be more to follow.
What happeneing with the UK, US, Australia, Canada, and even the EU is losing it’s mind.

  1. Force all operatingsystem providers to comply with ageverification laws in the form of facial scanning or ID upload
  2. Secureboot enabled by default on all modern motherboards, only approved operatingsystems compliant with ageverification can be installed
  3. Internet Service Providers forced by law to block connections from devices without approved facial upload / ip upload
  4. VPN outlawed, connection attempt from vpn results in fines or imprisonment
  5. Injecting forced ageverification through os update / firmware update, making the device unuseable without compliance
  6. AI CCTV Surveillance, automatic facial recognition, full body biometrics, behaviour analysis, emotion detection, profiling.

I am aware not all of the above mentioned topics are directly related to forcing linux distributions to comply with age-verifcation laws which let’s be honest is just identity-collection, its a massive grab for control and surveillance has nothing to do with protection minors at all.
This being said is there internal debate among unix/linux/gnu/distro developers about “age verifcation”?
I do absolutely hope not a single distro will comply ever. If this becomes the new normal, who would want to live like that?

The same good news reported in the Fedora thread:

At least some good news.

A federal judge in Virginia blocked the state from enforcing its social media age-limit law (SB 854) just a few days ago. The judge ruled that the mandate, which forced platforms to verify ages and limit minors to one hour of daily use, violates First Amendment rights by overextending to both adults and children and leaving out addictive interactive games.

The one and only reference to North Korea!

Can someone explain to me like I’m 5?

How is this law in California any more important than laws in North Korea that would ban the use of Linux Mint entirely? It’s just some irrelevant oppressive hellscape and the people behind Mint don’t live there, so who cares what their worthless laws are? Are Mint also going to shut down entirely because of North Korean laws?

Are they expected to cater to the whims of every criminally psychotic politician in the world?

I don’t see Mint or any other distro putting up notifications on their website or installer saying that people in North Korea aren’t allowed to use it, or trying to geoblock them from downloading it.

So why not treat California the same way? As just some rogue evil government, and not even acknowledge they exist?

Massimiliano spoils the dream:

North Korea is isolated. California is the world’s 5th largest economy. If a law passes in North Korea, it affects zero percent of the global tech infrastructure.
​Most of the infrastructure the internet runs on GitHub, Google, AWS, Apple and Meta is headquartered in California. If a law says “you must do X to operate in this jurisdiction,” it hits the very tools used to build and host Linux Mint.

​Laws generally apply to people and assets located within a territory.
​North Korea: Has no legal “reach” over a developer in France or the US. They can’t sue you, they can’t fine your bank account, and they certainly can’t seize your servers.
​California: Most major tech companies have physical offices, employees, and billions of dollars in assets sitting right there. They are “low-hanging fruit” for regulators. If a Linux distribution relies on a US-based mirror or a California-based hosting service, they are legally tied to that “oppressive hellscape.”

​When a massive market like California or the EU passes a law, companies don’t usually build two different versions of their website. It’s too expensive.
​They just change the whole site for everyone.
​North Korea’s “market” for Linux Mint is effectively near zero. California’s market includes millions of developers and the companies that fund the open-source ecosystem.

While it’s fun to imagine a world where tech projects can just pretend California doesn’t exist, the reality is that ignoring the place where the servers, the money, and the lawyers live is a great way to get your project shut down by a court order rather than a “rogue government.”

And again:

You can fork the code but you can’t fork the infrastructure. Hosting a distro requires bandwidth, mirrors, and security signing keys. The moment your ‘rebel fork’ gets flagged for violating regional safety laws, payment processors (for your one-cent fee) and hosting providers will drop you faster than a kernel panic.

​Combining California, Brazil and North Korea on one invoice is a great way to get your bank account frozen by every anti-money laundering algorithm on the planet.

​In the end, Mint ‘capitulating’ isn’t about being ‘corrupted’, it’s about the fact that even the most idealistic devs prefer writing code to spending their life savings on international lawyers.

But Mint would inherit whatever Ubuntu implemented and, unless it’s a snap… OMFG! Ubuntu might implement this legal requirement as a snap! 😱

Further reading: Cláudia Ascensão Nunes: California’s Age-Verification Law Is a Civil Liberties Test (of course it is).

Why this law is antidemocratic

On various occasions, I was accused of being one of the following: a communist, a fascist, a libertarian, a conservative, a retrograde, or a Luddite. I’m a bit of all these labels, but also I’m something else. Here’s a short list of some of my beliefs:

“Even worse than communism”:

  1. Wealth should stem from work and from the creation of real value in any form, not from speculation and waste (think stock exchanges and cryptocurrencies).
  2. Lotteries, sweepstakes, and other random rewards based on anything but merit should be forbidden if the prizes have obscenely large values (the current case with all lottery systems, which don’t offer medium prizes but mostly “the big jackpot”).
  3. Patents of any kind should not exist or be limited to a couple of years.

Liberties:

  1. People’s rights and freedoms are more important than companies’ “rights” and their stakeholders’ interests.
  2. People’s freedoms are more important than a government’s attempts to regulate, control, and dictate.
  3. The society should be secular, and the state should not fund, promote, or privilege any religion.

“Libertarianism”:

  1. Individual freedoms are more important than “the collective good.”
  2. Free speech and the freedom of conscience should include the right to blasphemy. Your omnipotent god doesn’t need you to defend him.
  3. Rules and regulations should protect the weak, but there should be no “protection against stupidity” that usually leads to overregulation and to the infringement of other people’s rights and freedoms. Personal responsibility is the ultimate responsibility.
  4. No censorship of any kind should exist, except for national security reasons. No blocking of “pornography” for underage persons, no moral judgments from the state. As a kid and teen, I circumvented all the restrictions and censorship, and I did not become a monster like Putin, Trump, Epstein, and so on. Censorship does not protect; it leaves people unprepared to face reality. It’s also used by governments to avoid accountability.

Suggested labels: “Individualist Mutualist” (a bit oxymoronic, eh?), or “Idealistic Left-Libertarian,” or “Radical Civil Libertarian.”

Back to our sheep, we already see two categories of unwarranted interference from the state.

❶ Courts of law and sometimes governments:

  • Mandate ISPs and VPNs to block websites for copyright infringement, “digital piracy,” or other forms of intellectual property infringement.
  • Mandate ISPs and VPNs to block IPTV websites.
  • Mandate ISPs and VPNs to block child pornography websites.
  • Ask ISPs and sometimes VPNs to provide logs and info on people who distribute “illegal content” to prosecute them for “digital piracy.”

The pretext: “Protect the intellectual property.”

❷ Then, governments also:

  • Enact legislation to mandate age verification to access specific categories of websites.
  • Enact legislation to forbid access to social networks for minors or for minors below a certain age (13-16).

The pretext: “Protect the kids.”

And now, this! California’s Digital Age Assurance Act (and, soon, Colorado’s) wants the operating system and its application store(s) to ascertain a user’s age!

Is it anywhere in the world such a requirement? Grok answered:

No, there is no jurisdiction in the world where such a requirement is currently in force and being enforced. California’s Digital Age Assurance Act (AB 1043, signed October 2025) and Colorado’s proposed SB26-051 are among the first attempts to push age ascertainment to the operating system (OS) level, but neither is active yet.

The closest match is Brazil’s Law No. 15,211/2025 (signed September 2025, the “Digital Statute of the Child and Adolescent”). It explicitly requires both application stores and operating system providers (broadly defined, similar to California’s law) to:

  • Adopt “secure and auditable age verification measures” (self-declaration is explicitly prohibited).
  • Allow parents/guardians to set up and manage supervision tools.
  • Enable the provision of age signals to app providers via secure, privacy-protective APIs.

This law takes effect on March 17, 2026—so the legal requirement exists on the books, but it is not yet enforceable or implemented.

Everywhere else, governments target platforms, websites, or app stores only—not the underlying OS:

  • U.S. states (Utah, Louisiana, Texas, and others; some already partially active or delayed by court challenges): These are “App Store Accountability Acts.” They require app stores (Apple, Google) to use “commercially reasonable” methods to categorize users into age brackets (<13, 13–15, 16–17, 18+) and obtain parental consent for minors. Apple and Google have rolled out tools (e.g., Declared Age Range API) to comply, and in some cases they now block 18+ apps until adult confirmation. No OS-level mandate.
  • Australia, Singapore, Brazil (pre-Law 15.211 aspects), and a few others: Apple automatically blocks 18+ app downloads unless the user confirms adulthood via the App Store (to comply with local child-safety codes). This is app-store enforcement, not OS setup.
  • EU countries, UK (Online Safety Act), France, Australia (social-media ban for under-16s), etc.: Age assurance/verification is required on individual platforms (social media, porn sites, search engines) or via industry codes. Some use digital ID wallets or parental consent, but nothing touches the OS or app-store infrastructure at the device-setup level.
  • China and similar regimes: Real-name registration applies to internet services/accounts, not OS-level age checks.

Your other examples (ISP/VPN blocks for piracy/IPTV/child exploitation, logs for prosecution, website-level age verification, social-media bans for minors) are all service- or network-level mandates. Pushing the duty to the OS itself (asking for age at device/account setup and broadcasting an anonymous age-bracket signal to every app) is a new architectural shift. It only exists on paper in California (effective 2027), Colorado (still a bill), and Brazil (effective in 10 days). No government has actually enforced it anywhere yet.

In short: No country or region currently requires operating systems (or their app stores) to ascertain user age at the device/OS level. Brazil and California are the only ones that have passed exactly this kind of law, and both are still in the “future enforcement” stage. The rest of the world stops at the app-store or platform layer.

This world is becoming a nightmare! Way to go, America! (And Brazil.)

The Democratic Republic of New York is next

Oh, I forgot! There’s also the NY Senate Bill S8102A:

Requires manufacturers of internet-enabled devices to conduct age assurance to determine a user’s age category and provide all websites, online services, online applications and mobile applications on such user’s internet-enabled device and/or application store manufactured by the covered manufacturer with a digital signal that such user is a covered minor as well as the age category of such covered minor via a real-time application programming interface (API).

Wonderful.

But there is more.

New York is the second wokest US state after California. It, too, has adopted the same Advanced Clean Cars II (ACC II) regulation! It did so on December 29, 2022, four months after California.

So you shouldn’t be too surprised at this other news:

Once again, the state “is protecting you!” Because you’re too dumb, presumably.

A selected comment from a thread on Hacker News:

“Hey ChatGPT, my NYC landlord is raising my rent by $500, and says I must pay by Monday or leave. What do I do?”

ChatGPT – This is very likely illegal under Housing Stability and Tenant Protection Act of 2019 (HSTPA), specifically New York Real Property Law § 226-c (Notice required for rent increases), RPL § 232-a / § 232-b (Month-to-month termination), RPL § 232-c (Fixed-term lease protections), RPAPL § 711 (Legal eviction procedure) and NYC Admin Code § 26-501+ (Rent stabilization). Here’s what you should reply with… And here are some city resources you can contact…

ChatGPT now – IDK, pay a lawyer.

So under the guise of “protection” you are taking away the strongest knowledge tool common people have had at their disposal in a generation, probably ever.

A selected comment from a thread on Reddit:

The industries charging you $500/hour just lobbied to make sure you can’t get the same answers for free.

The NY Senate Bill S7263:

Imposes liability for damages caused by a chatbot impersonating certain licensed professionals.

Impersonating, eh? From their newsroom: AI Chatbot Ban for Minors Passes Internet & Technology Committee, among 11 Bills:

On Wednesday, February 25, 2026 the New York State Senate Committee on Internet & Technology, Chaired by State Senator Kristen Gonzalez, passed a package of legislation to regulate AI chatbots. The package include legislation to protect minors from unsafe features in chatbots (S9051) and to prevent AI from impersonating certain licensed professionals, including mental healthcare workers (S7263).

I can’t even.

The only good news of these days

The Reg: Chardlet dispute shows how AI will kill software licensing, argues Bruce Perens. The title is stupid.

In short, version 7 of the Python character encoding detector chardet, which was written from zero using Anthropic’s Claude but preserves the package name and offers an identical public API, has changed the license from LGPL to MIT.

And people went amok. “Oh, LLMs are copying previous code.” “Oh, the GPL/LGPL license cannot be changed!”

This is actually the single great piece of news of the day! That is, if courts hold this view and reject any challenges to the change of license.

I literally hate the communist GPL/LGPL/AGPL family of licenses!

The licenses that I like fall in the category of “I don’t care what you do with this code as long as you don’t hold me liable”: MIT, BSD-2-Clause, BSD-3-Clause, 0BSD (Zero-Clause BSD), Apache-2.0, Unlicense, WTFPL, CC0.

Permissive licenses mean freedom. Freedom as in fucking freedom!

Copyleft licenses are absurd.

No, I do not believe that Linux (or GNU/Linux for distros) is the number one non-Windows OS because of the GNU licensing. It only became so because millions of retards, including corporations, considered it to be “the universal solution to everything,” thus disregarding FreeBSD and NetBSD. And now, there’s no way back, because no hardware manufacturer writes drivers for FreeBSD or NetBSD, especially not for devices used in laptops. We barely have Linux drivers!

Actually, there are so many closed-source drivers, firmware, and other binary blobs that it’s become clear that a bloody license can’t change anything. Hardware with Windows drivers should be legally required to offer open-source drivers for at least two other operating systems. But legislators are busy with shit, not with things that matter.

The dogmatic followers of RMS created the false distinction between “free as in free beer” (or gratis) and “free as in speech” (or libre). That’s bogus. The real distinction is between “free as in thanks, I can do whatever I want with this shit” (truly gratis) and “free as in gratis but with restrictions or obligations” (such as “the sex was free, but she got pregnant and won’t get an abortion”), which is anything but freedom! Unless “libre” means “No soy libre, soy cubano.” This could be a choice; just don’t label it “libre”!

So just let me enjoy this little defeat of (L)GPL, no matter how tiny. LLMs or not, this is the way to go!