If you are a registered entity (even non-profit), you can be fined millions of dollars.

It is a very dumb law.

Still fucking stupid and just a slow creep towards some bullshit like "kernel level age verification" where most Linux distros can't possibly comply because the chip manufacturers won't work with developers to certify unless they pay a $10,000 fee.

Thanks for the additional info!

So the OS would also have to have built in content filters or what?

I can actually imagine this being pretty useful on phones so you can give a kid a phone but prevent it from installing certain software (from normal sources)

Anything but giving parents/users responsibility.

Sudo su root!

Sudo su root now!

I'm giving root to my kids if and when I feel like they can handle it.

This literally IS putting the responsibility on parents.

The law requires that part of "account setup" includes asking the user's age bracket, and then allowing apps installed via "stores" to retrieve that value from the OS. The entire burden of trust in this implementation is placed on the owner of the hardware, exactly where it should be.

For real. Let's repeal all the laws around age, and make parents responsible. Drinking, smoking, driving, body art, firearms, etc. Let parents decide!

They need to do what Midnight BSD did, exclude California residents from the license.

How does BSD work, does it run all the programs Linux can run? Can I run Steam on it?

The law is not for the individual person, but for organisations that develop the OS. So they would go to Arch linux org and start threatening them with huge fines, unless they do something here. And all the headache of how exactly to implement this would fall on arch developers. At which point I suspect they would go the same route as Midnight BSD and just forbid the use in California, because as you rightly said it is impossible to implement age verification in DIY distro.

I disagree. This is a first step towards something far worse.

It sets up the infrastructure for getting user ages and allowing services and websites to get an attestation from the operating system. Once that system is widely used and becomes ingrained, they can create a follow-up bill that demands the attestation be cryptographically verifiable by a trusted party.

In that scenario, the only way the operating system's promise that you're not a minor would be trusted is if it was signed by whoever holds the private keys—and that's definitely not going to be you, the device owner.

It would either be the government, or more likely, the operating system vendor. In the former case, now services can cryptographically prove that you're a resident of $state in $country, which is amazing for fingerprinting and terrible for anonymity. In the latter case, you can guarantee that only the corporations will be holding the key (like with Microsoft and secure boot), and you can kiss goodbye to your ability to access services on FOSS operating systems like Linux or custom Android ROMs.

This proposal is just a way to get their foot in the door with something palatable. If you've ever come across banking apps on Android using Google Play Services' SafetyNet feature to restrict access to only "secure" devices, you'll know exactly how this turns out: either you use the phone you own the "approved" way with a stock ROM where Google has more permissions than you do, or you're not doing your banking on your phone.

Agree with everything you say, I don’t like that it has to happen but having the device report whether you’re a child or adult makes more sense than having every service do it poorly themselves.

There is no good use for this. Too many ways to abuse it, and we're going too far into surveillance. The gov really doesn't need to know how many times somebody shit today.