So define Operating System. Are embedded systems Operating Systems? Coz that's going to cast a rather wide net.
post
Doesn't even make sense. Virtually all Linux distros can function completely offline. How do you do age verification completely offline? Classic politician who doesn't understand tech trying to look like they're doing something to save the kids.
The only platforms for now where this might work are Windows, macOS, iOS, and stock Android, however as Muta hypothesized, if this extends to hardware-level, a law could just mandate SecureBoot and lock out the ability to implement custom keys, and then only allow a short list of state-approved OSes to boot on the hardware, which no doubt Windows would be on that short list.
Similarly, all non-Apple mobile devices as an extension to that could be locked exclusively to stock Android, eliminating custom ROMs like LineageOS or GrapheneOS as an option entirely, let alone mobile Linux distros.
Me, buying cellphone parts from another state to assemble myself like an 80% lower to avoid having to drink a Verification Can every time somebody calls me:
I think I just invented the concept of a "ghost phone"

That seems as reasonable as suggesting they could pass a law requiring everyone to hire a govt licensed computer user in order to interact with their devices, and otherwise touching a keyboard or touchscreen would be illegal.
It doesn't feel like a realistic estimation of what they would actually try to do. There's too much that is currently dependent on Linux, you'd do better to just dismantle and ban the internet.
They will make it a crime to not have any OS that is not compliant, that simple.
"(1) Provide an accessible interface at account setup that requires an account holder to indicate the birth date, age, or both, of the user of that device for the purpose of providing a signal regarding the user’s age bracket to applications available in a covered application store.
Sounds like it’s a text box that enter input into. Making it completely pointless.
Easy enough to send threatening cease and desist letters to distro maintainers that may not have a penny in savings. This is a huge gift to Apple and Microsoft that probably had enough of Linux hoarding in on their market share.
Apple and Microsoft are both rather large Linux customers. On desktop, they sell their operating systems, but both of them use a lot of Linux in the enterprise. Apple more so, but Microsoft is no slouch.
MacOS is FreeBSD under the hood, which would also suffer from this.
I think that's a bit different. If all desktop OSs are affected by this law, Apple is in no better or worse position than their competitors. The mach kernel that macos is built around would still be available. TBH, I'm not even sure how reliant Apple still is on the mach source. If such a law were to effectively outlaw Linux, it would have massive implications for pretty much every company with a moderate or bigger enterprise footprint.
There's a shirt that you could buy where a kid is asking his dad what clouds are made of. Dad replies, "Linux servers, mostly." It's no less true today than it was then.
It's not the kernel, which is their own work for a long time now. It's the userland utils, which are almost entirely taken from FreeBSD and track that project.
Although BSD utils are updated at a glacial pace, so it probably wouldn't be much work for Apple to do that themselves.
You think they'll pass up the chance to enforce an increase in mass surveillance?
Define "Operating System"...
I guess my washing machine & car are also going to be "not for use in California."
Those Cisco switches & Broadcom DSLAMs would be tricky too ... I guess the internet's "not for use in California."
And the air-gapped power station control system? "not for use in California."
It is annoying that these laws come in (I'm also including magical thinking about encryprion backdoors for "the good guys") without any form of real-world, practical assessment. Complete waste of tax payers money and undue stress for everyone.
FFS.
Imagine you’re not allowed to use your washing machine if you’re under 18.
The law only specifies "computer, mobile device, or any other general purpose computing device."
Which is extremely vague. It appears that the intention was to just affect end user devices. Not specific purpose systems.
I'm going to report the shit out of any of these companies if they have locations in California and Colorado (if it passes in CO). If the law is scoped that wide, there's no way they'll actually be compliant. Even corporate desk phones have an OS. :-D
Linux distributions should react by asking users to confirm they're not in California. They'll backpedal fast.
All this age verification crap. Where is the fucking parents? I get that big tech has some responsability in all this. But how about we just make the responsible choice, of not letting a 8 year old near tiktok forinstance? Oh, it is just another excuse for private survailance you say? I see, I see...
I'm a parent and legit think that majority of parents should not have been parents and have no minimum required skill to raise a human being. It's sad because it's really not that hard but most people don't think a day ahead when raising their kids and just follow a "vibe", so spending a weekend on parental controls is an insurmountable task.
I'm not a parent and wish there was some kind of minimum requirement.
I AM a parent. And I will take the fight. Even though all other parrents will call me the "tin foil hat" rather that, than letting my child become a predators next meal online.. These parrents has no idea what social media is all about. It's a fucking addiction. The children can't see this, this is why it's our job to protect them.
As usual, the solution is education. Parental education needs to be prioritized imo. That said, I have no idea how we would implement such a thing. Most likely better general education would help at least.
Just want to clarify that nowhere in the actual law does it require verifying the age of the user. It does not require IDs or face scans.
https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260AB1043
Please read it. It is a very short law <15 minute read tbh.
The law does exactly what you ask for. Parents setup the device and put their child's age. If they lie or circumvent the system then the parents get fined if their child is affected by content on the internet.
Everyone needs to realize that all the age verification stuff is just a step towards the purpose, which is having any and all computer operation tied to the person — i.e. as Cory Doctorow has put it, the war on general computation.
As a Californian parent, I'm teaching my kids to use Linux to be safer against surveillance and control. It is 100% my responsibility because I chose to have children and let them use computers. It's a dangerous world out there.
IDs in databases get leaked.
How about don't implement it and when California realises they need computers then they might change their mind?
Yeah I agree with the article, people will just say "Do not use in California" then....F off. OSes are VERY different all over the place.
I dont see this as enforceable. Linux in itself is multi-user. Everyone is just going to put some bogus year for age and continue on. I also dont see websites caving and adding it all in because that would cost a metric ton and be inconvenient for everyone involved. What about server OSes? OSes that have a machine as the only user. Or embedded devices?
It also does NOT protect Children in any way.
This operating system contains code known to the State of California to cause cancer or reproductive harm.
How is it unenforceable?
Real question
I’d say it’s probably easy to investigate avenues they’d have to enforce it. Like how would they make Canonical, a British company, enforce age verification on Ubuntu, a product they give to users for free?
There’s no contract, no transaction, no legal entity need be involved in the process.
Gavin Newsom is such a fucking tool.
Tbf every single politician is.
Every politician should be... At least here in America. They are supposed to be our representatives, regardless of how they feel.
They are not. Not the grand majority of them, anyway.
If you run for office to be different from all the rest and win, do you immediately become corrupted upon election?
People wonder why the Dems are unpopular. 2 of my Dems here in Colorado are pulling the same OS age gate shit right now. What I want to know is: "who fucking asked for this?". Everyone seems to be doing it at the same time, but many people don't want it. Smells fishy. Let's not elect these assclowns to anything ever again. Why are you doing authoritarian shit when we elected you to advocate on our behalf.
In my book, a take that extremely authoritarian and unconstitutional should end your political career instantly. You can watch it all on your TV at home like every other clueless boomer (shout out to the boomers who are with it, actually understand, and care). How can we send people to represent us who will openly sell out our and our children's futures for a few thousand dollars in campaign contributions?
of all the shit out there, that's what needed attention?!
Sounds like California needs to try out the ligma OS because they can suck my nuts.
Nailed it.
Gavin Gruesome at it again
This is being pushed by social media companies that don't want to be responsible for age verification
In essence, while the bill doesn't seem to require the most egregious forms of age verification (face scans or similar), it does require OS providers to collect age verification of some form at the account/user creation stage—and to be able to pass a segmented version of that information to outside developers upon request.
So you just fake a date and call it a day… thank you Cali…
For real though I can’t imagine the sysadmin and docker nightmares that arise from having to completely overhaul your account orchestration scripts to input a garbage birthday.
I don’t think anyone thought of the fact that an account on an OS doesn’t always correspond to a human.
And are they going to require ID to verify birth dates, or is this just going to be a drop down menu? If the latter, I'm pretty sure everyone's birth date is 1/1/1901. I'm so tired of this surveillance shit masquerading as "save the children" nonsense. I hate to say it, but this is a parenting problem and if your kids are more tech-savvy than you are, they WILL find a way around these safegaurds.
Sorry but I don't think the article text backs up the title?
The claim is that they have to enforce age verification, but the quoted law says:
Provide an accessible interface at account setup that requires an account holder to indicate the birth date, age, or both, of the user of that device for the purpose of providing a signal regarding the user’s age bracket to applications available in a covered application store.
Doesn't this just mean it needs to ask for an age at setup, so e.g. parents can set it up with an age and they can automatically be restricted?
I don't see anywhere actual verification is required, if you're setting it up yourself then just lie?
Honestly, this sounds like my preferred path if we are gonna do anything.
And I don't understand, because windows already does this and has for years. I don't live in California though, so I don't know the particular nuances they are asking for.
The problem is, and has always been, getting parents to use the tools. So unless you're sending parents to jail for not doing this, then it's totally optional and most won't use it.
If you want screentime limits, content filters, browsing history, restricted programs, age verification, wallet control, friends list filters, etc. It exists and is available on Windows and Xbox for free.
I think the next bit from the article I didn't quote explains that:
"(2) Provide a developer who has requested a signal with respect to a particular user with a digital signal via a reasonably consistent real-time application programming interface that identifies, at a minimum, which of the following categories pertains to the user." The categories are broken into four sections: users under 13 years of age, over 13 years of age under 16, at least 16 years of age and under 18, and "at least 18 years of age."
I think the idea is that you would say that under 16s can't use social media. Then you'd enforce this not with the horrendous Australian strategy of having everyone IDed, but instead you would enforce it by having an API that websites and apps could use that would tell them the age of the user.
So basically:
- Parent sets up device for kid and sets their age.
- Kid tries to download Facebook app
- Gets denied because they are under age
- Kid tries to go to facebook website instead
- Website sends request to browser for user's age, browser asks Windows (or whatever OS) for age and provides this age back to Facebook
- Facebook denies access because user is under age
Windows might already have parental controls within Windows, but it's the ability for apps and websites to know the age (or in this case age range) that is the important part.
I much prefer this than handing over ID.
Windows can do that too, for the applications and websites that support it. There is no point in forcing it onto other ecosystems if parents are not willing to use the tools in the ones they already exist in.
Windows doesn't ask at install, and also this law requires them to ask for already set up accounts too.
This will make it a lot more visible.
So this is where devils advocate comes into play. Pretty sure we all are agreed that this law, or anything like it, is 'not good'. And I'll leave it at that. Just keep that context in mind as I elaborate further.
Windows actually does do this on install. However, the Microsoft Family feature uses Microsoft Accounts. So technically, sure it's not the OS (though it IS part of the OS, as you don't need to download anything extra to enable it's functions).
But you have to go out of your way now to do an offline windows install without a Microsoft Account. If you're that savvy, you're capable of monitoring your child without the help of big government. If you're a child, then nothing but honesty is keeping you from jumping walls.
But that is windows, and this is Linux. Now I'm not making accusations, but do we really want to push the idea that this form of control needs to be pushed out across everything, simply because the current solution that would work for most families isn't done at the "OS" level?
And to top it off, I don't even see it working. Most family devices are set up on an account with a single login. Managing access is not a 'one and done' process, at some point you will have to provide permissions, install software, change active hours, approve screen time requests, troubleshoot related problems, and more (and soooo much more if your kid is technically adept). Is it no wonder that most parents just give kids free reign to their computers and consoles?
So before we go around and ruin the experience and privacy of everyone, can we at least ask what the people who want this have done instead? Cause it really does feel like it's coming from a group who wants everything done for them.
I'm not sure exactly why people keep bringing up privacy concerns here. The law does not require collecting IDs or face scans. It requires os providers to add a screen where the account holder specifies the age or DOB of the user. The OS is not allowed to send that information to 3rd parties unless it is required by the law. And when they do need to send it, they are required to send the minimum information (just the age range, not even the DOB).
This law actually does more to penalize the parents that give their children free access to the internet. If the parent circumvents or enters the wrong age then they are penalized.
In addition it also forbids developers from asking for more verification data unless they are confident that your age range is incorrect. Which stops developers, for instance Discord, from requesting IDs without reason.
I do not think this law is written well at all. But I also would not mind more structure to how age attestations are done.
I'm sure many parents are capable of monitoring their children online. They either just don't care or don't think they should have to.
Fair on the privacy aspect, but again, I'll point out that Microsoft Family already does the age bracket thing. I think how it's done is slightly different, as software/websites have to disclose age groups rather than requesting it. Different sides of the same coin to be sure.
As for parents, I think it's a mixed bag. I know a lot who are a mess at computers. Most don't even know these tools even exist. Those that do, don't have the time to do it properly (it only takes one night when your kid gets locked out of their account doing schoolwork due to screen time limits and your trying to troubleshoot why your approval to your kids request isn't going thru via your phone, etc). But there certainly are also those that don't care at all or feel they shouldn't have to do it. It's getting better though, I see a lot less young people with tech blindness every year.
I can sympathize with parents that don't have time or don't know that the tools exist. But this law (in theory) isn't affected by that.
The screen is displayed to the parent on account setup so they don't need to know it is there because it will be right in front of them.
Screen limits are not required by this law at all and are not even mentioned. This is just to keep children from accessing aps that says they are not for children. Ie. Facebook asks the users age range (<16 in this example). Then blocks the user since they are not 16+. Not sure why a child would need FB for school work so they should not be affected.
There is no clause requiring or providing an approval from parents. So if there is then that is the OS's fault.
I theory the parents don't need to setup controls per app because it is FB deciding what age brackets are allowed. And if they include the kids one and the child gets hurt online then FB would be liable. Not the parent.
I agree. This doesn't seem any more egregious than clicking a button on a website that says "I am over 18".
Which website is that?
The one with naked people on it.
But also, every FreeDos install ,server, managed network switch, IoT device, gas pump, etc. now needs to verify user age.
Also, it has to make "reasonable" effort to verify the age. Maybe just asking your age isn't considered reasonable by the state. Since the law doesn't lay out what to do, anything you do might become unreasonable depending on the winds of the day.
Nah it seems it doesn't apply to physical devices (except general computing devices as mentioned elsewhere)
(f) This title does not apply to any of the following:
(1) A broadband internet access service, as defined in Section 3100.
(2) A telecommunications service, as defined in Section 153 of Title 47 of the United States Code.
(3) The delivery or use of a physical product.
(3) seems to imply the OS that runs your switch or gas pump isn't included. But I see nothing in the law that clarifies servers or any CLI only interface, or even any OS that doesn't have accounts.
Where do you quote "reasonable" from? The only part of the law with that word is referring to a different, already existing law (or the bit about reasonable technical limitations causing the wrong signals sent in the API).
Is a mobile phone not a "physical device"? An operating system always has to run on physical hardware, so does this just invalidate the entire thing?
Nah I don't think it does. You don't really get that because the intent of a law is important in court cases.
Mobile phones are specifically covered:
(g) “Operating system provider” means a person or entity that develops, licenses, or controls the operating system software on a computer, mobile device, or any other general purpose computing device.
I'm just not sure. It seems contradictory to me, since the manufacturer of a physical device is also "a person or entity that controls the operating system". Unless they sell the hardware with no OS installed? This exemption doesn't seem to mean anything.
With how they've defined "App Store", basically any product that can download applications is affected by this, including devices that don't even have the concept of a user account. I'm a little unclear still on what's required of an entirely offline OS.
You're right that mostly the reasonable thing was related to previous law.
But why do they assume that I am going to create an account to simply use an OS?
Ok I did it, I read the full text of the law, and you're right.
The existence of Linux or anything not big tech and the broad range of options within seems to be ignored. Does a CLI only OS need to provide a GUI for its "accessible interface"?
On a different note, I did see the last point here:
(f) This title does not apply to any of the following:
(1) A broadband internet access service, as defined in Section 3100.
(2) A telecommunications service, as defined in Section 153 of Title 47 of the United States Code.
(3) The delivery or use of a physical product.
(3) seems to imply the OS that runs your microwave isn't included.
I am also using my phone with no account linked to it, as it is not required. It still seems to be an ignored usecase, even with the added context you provided.
Yeah perhaps. Or that "account" doesn't really need to bw what we think of as an account.
Could it be covered, but they would still have to ask? It says if it wasn't done at setup it has to ask, so perhaps an account-less OS would still be expected to ask for an age and provide it when asked?
top 99 comments