OS must verify your age before use

[Andy Chee]

One way to fix it is to set requirements that such a warning only be displayed when there is a demonstrable risk to health by exposure. 

There is a demonstrable risk to teenager mental health by exposure to social media.

[pqass]

California lawmaker wants to require anyone using ANY operating system -- Windows, Linux or otherwise -- to verify their age before use
WTF is it with some people that like dystopian things.

And how will the OS verify age? 

Any system must keep users real identity anonymous to the requestor and untrackable by the verification authority.  Otherwise, it'll be a privacy nightmare and won't be accepted (how's Discord new rules going?).

One possible solution^* could be:
Website or local app produces a session token which is hashed and submitted to a gov't Age of Majority verification site (with valid login) returning a signed version of the submitted hash valid for a period of time.  Requestor validates the signature against one of a list of verification authority public keys (a few hundred may be manageable) or a new certificate usage field type.

But this would require a standard (RFP) and gov't infrastructure.  Many sub-national gov'ts already have a plastic card so this would be an electronic extension of that.

____________________________
* I'm not a cryptologist.

[hans]

I wonder what would happen to all IoT devices running FreeRTOS, QNX, ThreadX, OpenWrt, Zephyr, ...

Good point.  Some home appliances are now complex enough to have operating systems.  Does your "smart dishwasher" running Linux for its network stack have to verify the user's age?  Or is this restricted to devices with viable display devices? (I'm assuming a 7-segment display showing "8008135" isn't dangerous to children.)

What about my smartTV.. Its primary function is to watch TV, not to browse the interwebs. It still has a webbrowser though, so I can visit whatever site I want. Oh UK blocks certain sites?  I can install a VPN network wide on any router, which I presume is not binding for any age requirement as a router is by-definition a multi-user device (otherwise you can just connect your PC to your ISP modem).

Why are politicians so oblivious about what/who these age/ID requirements are going to stop? Regular users know how easy and affordable it is to grab a VPN/proxy tunnel and reappear in another country where those laws don't apply. Power users are completely unaffected.
And I'm fairly certain with AI slop we'll have widely available tools that can fool facescans as well. And if it doesn't, you generate a new persona and you can try again.
So they will have to drop the face scan option and require full ID cards.. which gets leaked again.. so ultimately only the criminals get handed bigger and bigger data banks to harvest our data from.

I hope this will backlash very hard very quickly. It has to. Otherwise I foresee a lot of people just unplug their computers and request a paper form to declare their taxes like its the 80s again.

[soldar]

The law says

An operating system provider shall [...] Provide an accessible interface at account setup that requires an account holder to indicate the birth date, age, or both, of the user of that device

So, when you set up the main account or a secondary account you are requested to state a DOB or age for that account. Just your word for it. No checking.

I suppose this could work if a parent sets up an account for their minor child but other then that I cannot see how it can not easily be defeated.

A minor can easily download and install any OS and state any age and nobody is going to check.

Maybe I am missing something.

[mendip_discovery]

Do they define what an OS is? I ask as does the firmware on an STM32 get into the muddy waters?

Does this mean all mobile phones now need to have age verification?

I used to accept that legislators were computer illiterate back in the 2000 as there were still plenty that have never used a computer. These days its harder to accept but yet they still put stuff in place without thinking of how its going to work.

[magic]

Or just repeal the legislation.  It's clearly defective.

Repeal the people who passed it.
Or the whole system which allows such people to do anything more than flipping burgers.

[paulca]

In related news. 

Apple are already adding age verification to iPhones apparently as we speak.

Anthropic said, "No!" to the government who wanted to use Claude for government, "Anthropic said, our model has guard rails preventing it's use for surveillance.  Gov said, "Then turn that off.".  Anthroipic said, "No".

The result?  The administration flagged them as a "Supply chain risk".  This means that any company doing business with the US gov can no longer use any Anthropic software or even have it in the same environment.  Petty playground stuff, but it is where we are today.

This is not to "protect the children", but it is about the children.  The target is not those who pass the tests, the target is those who try and fail.  The children being taught that submitting to this kind of a ID check, even in their favourate games on their phones, is "Normal".  Long before they have the ability to 'consent' to it, long before the parents have even worked out what is happening, their children are conditioned into the dystopia highlighted as a warning, not a map, by Ben Elton, blind faith.

[tom66]

I wonder what would happen to all IoT devices running FreeRTOS, QNX, ThreadX, OpenWrt, Zephyr, ...

Good point.  Some home appliances are now complex enough to have operating systems.  Does your "smart dishwasher" running Linux for its network stack have to verify the user's age?  Or is this restricted to devices with viable display devices? (I'm assuming a 7-segment display showing "8008135" isn't dangerous to children.)

What about my smartTV.. Its primary function is to watch TV, not to browse the interwebs. It still has a webbrowser though, so I can visit whatever site I want. Oh UK blocks certain sites?  I can install a VPN network wide on any router, which I presume is not binding for any age requirement as a router is by-definition a multi-user device (otherwise you can just connect your PC to your ISP modem).

Why are politicians so oblivious about what/who these age/ID requirements are going to stop? Regular users know how easy and affordable it is to grab a VPN/proxy tunnel and reappear in another country where those laws don't apply. Power users are completely unaffected.
And I'm fairly certain with AI slop we'll have widely available tools that can fool facescans as well. And if it doesn't, you generate a new persona and you can try again.
So they will have to drop the face scan option and require full ID cards.. which gets leaked again.. so ultimately only the criminals get handed bigger and bigger data banks to harvest our data from.

I hope this will backlash very hard very quickly. It has to. Otherwise I foresee a lot of people just unplug their computers and request a paper form to declare their taxes like its the 80s again.

I mean, if you start thinking about it - it gets absurd.

My car has CarPlay and a media player,  I guess you could watch adult content on it. At least while in park.  So does the car need to verify age?

Basically the concern seems to be that teenagers are looking at more extreme pr0n and getting access earlier and earlier because of the proliferation of smart devices - and this is causing problems with violence towards women, sexual misdevelopment etc.  It is an issue, but it's not an issue solved by making life difficult for ordinary adults. Whether or not they want to look at naked people doing natural, or unnatural things - age-gating the internet effects everything from sites like Imgur blocking the whole UK because they don't want to deal with the OSA, to verifying age for social media, to making it impractical for smaller websites to operate with the significant costs that these laws impose. 

It is a venerable goal, to stop kids seeing this content, which we know to be harmful.  But it's not an achievable goal without parental intervention. Here's an idea.  If you buy a phone for your kiddlywink, when you first turn it on, it'll ask if you if you want to see adult content or not.  Press 'no' for a kid's phone.  This signal then passes to the application layer and advertised to websites, which can choose to censor or not  (it's impractical to force them, you just have to do it on good faith, because the internet is a global marketplace).  This is what the law is intended to do.  The trouble is, the lawmakers wrote the law in such a way that it applies to refrigerators and cars and open source kernels, because they're morons.  These filters will be bypassed; you're never going to stop everyone.  Lawmakers need to recognise that.

[paulca]

It started with p0rn, if you think it's still about that, you haven't been paying attention.  It's in children's games for chat access and about to be on all social media if they go ahead with the under 16s ban.

You already need to submit to this kind of process if you want a job in the UK.  There are dozens of providers to offload the "onboarding, ID and background checks" which use the systems put in place for "Digital ID Mandatory roll out".  The only thing that changed there is they removed the word "Mandatory".  Making it "optional" to enroll in the digital ID scheme.  Optional in the same sense that eating is.

Making it more difficult for adults to access things is only a small part of it.  Remember there will be children facing these prompts and immediately submitting to the biometrics scans, photo and document uploads.  All when they are too young to legally consent to them.

EDIT:  My kid has a phone and a tablet.  Both Android.  Both are setup as "Child devices".  ie.  The account is the parents.  What the child's android can do is fairly controllable.  However.  My kids is still presented with ID checks in Roblox, Minecraft and others.  She has already taken her photo for them and failed to verify.  So her data is now collected.

The other way to look at this and the "slip of term" has already emerged in several places by accident.  KYC.  Know your client.  A requirement placed upon banks to verifiy the identity and background for fraud checks of all it's clients.

The banks and those with money just flipped this around and sold government on AI and digital ID.... as KYC, Know your cititzen.

Now the banks can use government digital ID and background check systems and when they do business with a fraudster just tell the government it was their fault.  They verified the citizen.

[BadeBhaiya]

Targeted ads can't work without age filtering you silly users! You wouldn't want a child being advertised hair regrowth serums or hot singles in {YOUR AREA} would you?

[I wanted a rude username]

[Cyclotron]

See above for original image.

Good ol' defenestration

[SiliconWizard]

https://lists.ubuntu.com/archives/ubuntu-devel/2026-March/043510.html

[SiliconWizard]

And now it expands to Colorado, NY and ... Brazil.

[pdenisowski]

The disaster is that if it starts in California, serving as a lab for the most dystopian stuff for a good while now, it will spread to the whole western world.

Well, paper plates are still compostable in the Carolinas, so there's hope 

[thm_w]

California lawmaker wants to require anyone using ANY operating system -- Windows, Linux or otherwise -- to verify their age before use
WTF is it with some people that like dystopian things.

And how will the OS verify age? 

It doesn't, it just asks for your age, like thousands of websites and account sign up forms do already.

[Cyclotron]

California lawmaker wants to require anyone using ANY operating system -- Windows, Linux or otherwise -- to verify their age before use
WTF is it with some people that like dystopian things.

And how will the OS verify age? 

It doesn't, it just asks for your age, like thousands of websites and account sign up forms do already.

You can "identify" as any age, right?

[shapirus]

You can "identify" as any age, right?

For the time being. Rest assured, they will not stop at this.

[SiliconWizard]

The Californian bill (and for now, probably the similar bills elsewhere) does apparently not require more than indeed asking for the user's age at "account creation" (which is already pretty questionable if you consider what an OS "account" is or at least should be). Then it mandates that "apps" having an age bracket should check if the age declared in the OS account in use is within range. So it does give access to a personal information (age) to any app or service. This is a problem and completely stupid in terms of OS security - it doesn't match the Unix model whatsoever.

But yes, rest assured that once that pill has been swallowed, they will switch to mandating stricter verification through third-party services, which is already in the works elsewhere.

[Cyclotron]

You can "identify" as any age, right?

For the time being. Rest assured, they will not stop at this.

This topic really seems to be on the bubble as far as skirting the rules against politics. 
 
California even passed a law forbidding school staff from engaging parents about their children's activities and attributes at school, which can have very detrimental impacts on a child's well-being, both physically and mentally.  Alternatively, in this thread's case, CA lawmakers are forcing children and all to provide such personal details to companies and governments.

Obviously, up next is the issue that you can't trust anyone to report their true age.
So next, they will issue those nice government-controlled digital IDs that are "optional".

Think of the children!
Absurd.

[thm_w]

Alternatively, in this thread's case, CA lawmakers are forcing children and all to provide such personal details to companies and governments.

Already been the case for decades if you create a Minecraft account or Roblox account, or whatever other account kids like to use. Nothing new here.

[Cyclotron]

Alternatively, in this thread's case, CA lawmakers are forcing children and all to provide such personal details to companies and governments.

Already been the case for decades if you create a Minecraft account or Roblox account, or whatever other account kids like to use. Nothing new here.

I don't know, I feel that this is different. The potential scope change seems enormous, doesn't it?

For the OS requirement, all people must enter data to use the OS. If every OS, mobile, TV, radio, router, Wi-Fi, switch, desktop, thermometer, stove, refrigerator, dishwasher, test equipment, Car, Bluetooth speaker...  I don't know where it stops, actually. Linux is running everywhere.

The limitation in the law says "any other general purpose computing device." What does that even mean?  A calculator computes, and a calculator App provides general computing. I'm sure there will be lots of lawsuits to spend money to figure all of this out.

[pqass]

I'm sure this will be unpopular here but...     I believe every country should be able to enforce their laws as they see fit.

Currently, US defaultism is everywhere.  It's coercive that the US embeds their laws (DMCA, copyright) into trade deals.  Unfettered access to users world-wide will no longer be assumed.

Anonymity has created transnational real-world problems like: hate, luring, incitement to violence/suicide, gambling, etc.

It's high time Internet borders are enforced like physical ones.  And that media company officers answer for what they publish on the Internet.

So next, they will issue those nice government-controlled digital IDs that are "optional".

I get it. You're worried about gov't overreach and tracking.  This is unjustified paranoia in a democratic society as you have input here through elected representatives who shape laws.  Fix your democracy if you don't trust your gov't.  IRL you can't get anywhere without the gov't knowing who you are; eg. SS#/SIN, credit card, passport, drivers license, bank card, etc.

Just like plastic IDs, Age of Majority verification that doesn't reveal real identity nor facilitate tracking can be engineered (and that doesn't rely on 3rd party for-profit nannies).   There are Internet RFPs for everything.  Propose one that just meets the need and it may be adopted world-wide.  Otherwise, the risk is every jusidiction imposing their specific solution.

Non-US, western gov'ts will be tightening screws as their voters are demanding action.

[Cyclotron]

I'm sure this will be unpopular here but...     I believe every country should be able to enforce their laws as they see fit.

Currently, US defaultism is everywhere.  It's coercive that the US embeds their laws (DMCA, copyright) into trade deals.  Unfettered access to users world-wide will no longer be assumed.

Anonymity has created transnational real-world problems like: hate, luring, incitement to violence/suicide, gambling, etc.

It's high time Internet borders are enforced like physical ones.  And that media company officers answer for what they publish on the Internet.

So next, they will issue those nice government-controlled digital IDs that are "optional".

I get it. You're worried about gov't overreach and tracking.  This is unjustified paranoia in a democratic society as you have input here through elected representatives who shape laws.  Fix your democracy if you don't trust your gov't.  IRL you can't get anywhere without the gov't knowing who you are; eg. SS#/SIN, credit card, passport, drivers license, bank card, etc.

Just like plastic IDs, Age of Majority verification that doesn't reveal real identity nor facilitate tracking can be engineered (and that doesn't rely on 3rd party for-profit nannies).   There are Internet RFPs for everything.  Propose one that just meets the need and it may be adopted world-wide.  Otherwise, the risk is every jusidiction imposing their specific solution.

Non-US, western gov'ts will be tightening screws as their voters are demanding action.

The agreements that your country signs with other countries are up to you and your countrymen.
I assume you trust your government when it agrees to those terms, or you're working to fix your democracy.

I see no reason for countries not to defend their intellectual property in their negotiations. I'm not a fan of copyright and patents, but those are part of the legal systems of various countries, so why shouldn't they defend them like borders?

From my perspective, I prefer, as much as possible, to be my own choice. In my view, the US Constitution gets something very right. It does not define any rights of people but only the limits on government.

I don't expect you to know all of this as I don't know everything about the history and views of all other countries. There are two concepts woven into the fabric of the US.
1. All rights belong to the people
2. Government can't be trusted and must be controlled, not the people

What you see is as unjustified paranoia, I see is infringement on my rights. So as you've indicated, that's what I convey to my representatives.

Now that maybe that's a bit clearer. Do you feel the age verification in OSes is a good thing, and you're arguing that, or are you suggesting that these laws might work their way into your country when you sign trade agreements? I'm honestly unsure.

EDIT:
I'm worried this is turning very political, and I'm just going to get out now.  I'm leaving my rebuttal above, but I'm not going to pursue this any further, as I don't see it as in the spirit of the rules or likely to prove insightful for the new laws the topic brought up.

[Randy222]

Bill: "the OS wants my ID"
Jane: "Bill, thats weird, just use your own GNU OS"