California's Digital Age Assurance Act, and FOSS
California’s new Digital Age Assurance Act, which requires operating systems and “application stores” to signal users’ age brackets to apps, is drawing fire for vague definitions and unclear technical scope. Commenters worry it could unintentionally rope in package managers, repositories, routers, containers, and volunteer-run open source projects, exposing maintainers to civil fines and compliance burdens they can’t bear. Supporters see it as a relatively privacy-preserving way to centralize age gating and aid parents, but critics fear it will be ineffective in practice and lay groundwork for broader erosion of online anonymity.
Scope and Definitions
- Many see the law’s core concepts (“covered application store”, “operating system”, “general purpose computing device”) as overbroad or unclear.
- Debate over whether package managers (apt, yum, Homebrew), repositories (Flathub, PyPI, GitHub), DNS, torrent trackers, cloud services, routers, and embedded systems could be deemed “app stores.”
- Some argue the statutory “distributes AND facilitates download” language narrows scope; others think a creative prosecutor could still stretch it.
Impact on FOSS and OS Vendors
- Concern that FOSS OSes and tools would be forced to implement age signals, even for volunteer-run projects with no commercial backing.
- People worry about massive potential fines changing the risk calculus for hobby and noncommercial contributors, especially those publishing containers or images.
- Some claim the law is effectively designed for major consumer OSes (iOS, Android, Windows, macOS), with FOSS caught as collateral.
- Suggestions range from adding simple age fields to accounts to extreme responses like “not for use in California” labels or geoblocking the U.S.
Enforcement, Liability, and Vagueness
- Clarified that only the state attorney general can bring civil actions, with fines tied to the number of affected children.
- Disagreement on how “affected child” and “actual knowledge” work: some read the law as allowing developers to rely on OS signals; others think the language could misattribute knowledge or invite abuse.
- Fears that vague wording enables future expansion or prosecutorial overreach.
Privacy, Anonymity, and Slippery Slope
- Some view this OS-level age flag as the least invasive alternative to ID checks and third‑party verification.
- Others see it as a first step toward universal age/ID verification, loss of anonymity, and greater platform and state control.
Parenting, Public Health, and Effectiveness
- Split between those who insist responsibility should remain with parents (using existing tools and network controls) and those who argue most parents lack the technical capacity, framing it as a public‑health problem.
- Many doubt technical feasibility: kids are highly motivated to bypass controls; any system will resemble ineffective “Are you 18?” dialogs.
Legislative Process and Politics
- Some call the law “performative” or a product of lobbying and regulatory capture; others see it as an earnest but technically naive attempt to centralize age signaling.
- Frustration that the FOSS community did not engage earlier in the legislative process.