System76 on Age Verification Laws
US state laws that require operating systems to expose a user’s age bracket via an API are raising alarms among privacy advocates, open‑source developers, and parents alike. Commenters debate whether OS‑level “age attestation” is a reasonable way to standardize parental controls or a dangerous first step toward government‑mandated identification, surveillance, and locked‑down computing. Many argue that such rules will be ineffective in stopping motivated kids, burdensome for small projects, and likely to evolve into stricter ID or biometric verification, while others see them as a lesser evil compared to pervasive platform‑run face scans and ID checks.
System76’s stance & community reaction
- System76 publicly criticizes age-related laws but says it will comply, likening them to other regulatory-driven OS features.
- Some applaud them for speaking up; others see the compliance caveat as a sellout and want outright refusal.
- Several argue anger should target legislators and big platforms, not small vendors who would be bankrupted by noncompliance.
What the California/Colorado laws do (and don’t)
- Thread focuses heavily on California’s AB1043 and a similar Colorado law.
- Supporters say these laws:
- Require OSes to expose a simple “age bracket”/parental-control signal via an API.
- Are based on self-attestation, explicitly disallowing ID checks, and are meant to standardize parental controls.
- Critics counter that:
- Developers must treat OS signals as primary but override them with “clear and convincing” contrary information, creating liability incentives to collect more data.
- Laws were shaped “in concert” with major OS vendors, which may advantage large platforms over small/new entrants.
- Non-signaling OSes risk giving users a “nerfed internet” as services default to lowest-age behavior.
Privacy, surveillance, and tracking concerns
- Many see any mandatory age signal as one more fingerprinting vector and a beachhead for stronger ID-based systems (face scans, government tokens, ISP-level checks, hardware attestation).
- Some frame this as part of a global trend (US states, EU, UK, others) toward de-anonymizing the internet under “protect the children” rhetoric.
- A minority argue that if the alternative is pervasive biometric verification per site, an OS-level self-reported flag is the lesser evil.
Free software, compelled code, and legality
- FOSS developers worry about being forced to implement APIs they object to, seeing it as compelled speech or forced labor.
- Others argue the laws regulate functionality, not expression, likening it to food labeling or accessibility requirements.
- There is debate over whether code is always protected speech and whether these laws are vulnerable under the First Amendment or other constitutional theories.
Child safety, parenting, and effectiveness
- Strong disagreement over whether OS-level controls meaningfully protect kids:
- Critics point to trivial bypasses (VMs, live USBs, alternate browsers, older siblings’ devices).
- Proponents reply that perfect enforcement isn’t the goal; laws are like alcohol-age limits—raising friction and setting norms.
- Many say the real issues are social media design, engagement-maximizing algorithms, and lack of digital education, not raw access to “the internet.”
- Several emphasize parental responsibility and education over technical gating, warning that infrastructure built “for kids” will ultimately enable broad censorship and surveillance.