Illinois just passed a law that puts Linux on the hook for age verification

Original Article ↗ Hacker News Discussion ↗

Illinois has passed a law requiring operating systems on internet‑connected consumer devices to support an age “bucket” signal (e.g., under 13, 13–15, 16–17, 18+), which apps and websites could use to limit addictive or personalized feeds and certain social features for minors. Commenters argue over feasibility and scope—especially for Linux and open source projects with no single commercial owner—while raising enforcement questions, privacy concerns, and fears of a slippery slope toward stronger identity and age verification. Others see OS-level self-declared age as a lesser evil compared to platforms demanding IDs or biometric checks, but note that major tech firms may be backing such laws to shift liability and entrench their power.

Scope and Mechanics of the Illinois Law

  • Law targets “operating system providers” (commercial or non‑profit) of internet‑enabled devices (smartphones, tablets, personal laptops/desktops with wireless or cellular).
  • Requires OS‑level age bucket declaration (under 13, 13–15, 16–17, 18+) by 2028.
  • Age is self‑declared, not verified; no ID scans or biometrics are mandated.
  • Goal is for apps/sites to query OS about whether a user is a minor and adjust features (e.g., “addictive feeds,” notifications, DMs) accordingly.
  • A separate part of the law tightly defines “addictive feed” as behavior‑based, personalized recommendation; some forms of user‑requested or subscription content are exempt.

Technical Interpretation and Edge Cases

  • Debate over whether this is truly “age verification” vs simple declaration. Most agree it’s the latter.
  • Some argue that for Linux and other OSes this is just another user attribute (like name), possibly per‑user and root‑controlled.
  • Others worry this will drive deeper OS‑ and hardware‑level enforcement later (TPM, secure boot, device attestation).
  • Server OSes, headless systems, containers, and VMs are raised as ambiguous: unclear whether the law practically touches these, especially since the statutory definition is consumer‑device‑oriented.

Privacy, Civil Liberties, and Slippery Slope Concerns

  • Many see this as privacy‑eroding: even age buckets can be logged, correlated over time, and used for profiling or marketing.
  • Strong fear of “slippery slope”: once OSes must ask age, future amendments may demand precise DOB, ID checks, or centralized identity systems.
  • Some frame this as compelled speech and potential First Amendment issue (code as speech, forced disclosure of age). Others note existing precedent for compliance requirements.
  • A minority argue that compared to ID uploads and face scans already being pushed in other states, this is a relatively privacy‑preserving compromise.

Enforcement, Jurisdiction, and Open Source Impact

  • Unclear who is actually liable in the Linux ecosystem: kernel, distros, OEMs, or U.S. corporate stakeholders (e.g., commercial vendors with Illinois presence).
  • Some expect major vendors (Windows, Android, commercial Linux) to comply, with open‑source projects either ignored, exempted, or forking out the feature.
  • Strong sentiment that the law is practically unenforceable against decentralized, international FOSS; some maintainers explicitly vow not to implement it.

Motivations, Politics, and Alternatives

  • Thread repeatedly links this to broader state‑level “protect the children” tech laws (porn, social media) and culture‑war politics.
  • Several suspect big ad‑tech/social platforms of lobbying for OS‑level age signaling to offload liability and entrench incumbents.
  • Alternatives proposed:
    • Make platforms, not OSes, strictly liable.
    • Content‑rating and RTA‑style tags, with local parental controls doing the filtering.
    • Device‑side controls that consume only minimum age required flags from services, rather than disclosing user age.