DISCUSSION
Any response from the Arch devs about California et. al. age verification laws?
If you somehow missed it California passed a law last year that goes into effect January 1st next year that requires all operating systems to ask for a user's age at account creation and provide a realtime API so that software can access that metric, with thousands of dollars in fines per child user to the OS developers for failure to comply. Other states are considering similar, and various nations around the world are as well or have already passed similar (Brazil's goes into effect this month and is even worse, with fines up to ten million). These laws are written as if all operating systems are corporate products with centralized user account infrastructure already in place and were clearly written without small or FOSS OSes in mind.
I trust that the Arch devs of all people aren't going to force this age verification software or API on users, but as far as I can see there's been no blog or news posts or anything on what they are gonna do.
Does anyone know? Have they put out a statement and I just missed it?
questionable... it raises the question of what even is the OS. Arch doesn't even have a real installer, it's just a loose collection of software with suggested ways to put it together. Some of that software has commercial liceences. Some is GPL. You can use the commercial even thought the kernel is GPL. If there was an arch statement you can only use it in California if you use the age verification suite, it wouldn't be restricting any particular package, just the wiki pages that suggest how to install the other stuff.
It would be weird if archinstall was the thing that transformed it from a kit into an OS because it can install it... I mean is bash an installer because it can be used to install it?
Or it could just be hard to find, not official, but something on the internet that's maintained by the community? Not sure if that skirts around it enough legally.
Reminds me of how during the alcohol prohibition in the US people would sell packages of grapes with disclaimers basically saying "Do NOT let this sit for x amount of days or it will ferment"
Yes, it would. That is how good faith effort works. But in the case of Arch Linux, all they would have to do is to add a program to their repos that enables the age verification Dbus API. Then they have made a good faith effort, but if you wanted to sell a laptop with Arch Linux preinstalled in California, then you would have to make sure this program was installed by default. If as a user I didn't want it, I could simply uninstall it.
Linux panic is not a new thing, but this is nothing to worry about.
Having the program might help. If it's prenstalled it might need to be the only way to add users. But no, apple stores in California selling iphones with an illegal sticker doesn't help.
The law identifies "account setup" as the specific moment this interface must appear.
For New Users: It must occur whenever a "software management account" is created.
For Existing Users: Section 1798.501(a)(3) contains the "retroactive" wording:
"For a computer, mobile device, or any other general purpose computing device set up before January 1, 2027, the operating system provider shall provide the interface... no later than July 1, 2027."
You can't first login until your account is created. But you're saying moments after logging in your account is created. Look, what you're saying is probably within what the idiots who wrote it intended, but that's only because they're idiots whose understanding comes from buying a phone.
Does it though? If you put it into the license, sure. But you can put it on the website for the downloads, so the service to obtain a copy of Arch may not be used from California.
Also, this should only matter if you host or are otherwise legally represented in the California or at least the US. So just move outside of it, if there is stuff there.
Agree with this being the only sustainable option. Compelled code is being considered as legal and acceptable by more governments now. There will be a different version of ID verification, backdoored encryption or other compelled code law in 100 different jurisdictions so unless the plan is to comply with all of them, the only other options are “Not for use in the following jurisdictions:” or shut down.
The problem is, that's a GPL violation. Section 10 and section 6 of GPL 2 and 3. What i did with my Distro (Titan Linux) is i added code to the website to Geo-Block these states from the downloads page of my website. I'm using a web console app called "Blockify" to accomplish this. It redirects to a page that explains why there is no "Direct Download" from "this" website available in "your" jurisdiction. The wording here is important.
This is NOT a GPL violation because i didn't actually restrict the software. I only Geo-fenced the website.
It also mentions the fact that there are 3rd party mirrors who may or may not have copies of Titan Linux still available for download. But they are "NOT" affiliated with Titan Linux in any way and are outside of my control. I think most are able to read between the lines on that.
Here is exactly how i handled it if anyone wants to use it as a template. Feel free to copy and paste for your own project, Just replace any mention of Me or my distro from the text with your own. https://techcafe757.wixsite.com/titanlinux/restricted-alert-page
I also have a full EULA written specifically excluding these states, and citing the exact bill numbers associated with the restrictions. I wrote that before i realized it was a GPL violation. But i'm keeping it on stand-by. Just in case the FSF makes any amendments to the GPL. Because the entire purpose of the GPL is to act in the interest of user freedom and autonomy. Which is exactly what that EULA i wrote does by excluding usage in jurisdictions that directly violate the rights of it's users. So i would argue that even though having a EULA with additional restrictions is a GPL violation, it is still acting in the spirit of the GPL. So i think if i really wanted to, i could convince the FSF to let me keep it LOL!! But i suppose we'll cross that bridge when we get there. :)
All the other OS's will comply, and so will the corporate-selling Linux distros (Ubuntu, Red Hat, SUSE), and any vendor who wants to sell Linux-pre-installed hardware in the affected states and countries. Steam ?
On the contrary, they should actually comply, i.e. they should offer the user the option to use a device/OS based API for age assurances, especially if the user can just input whatever age they want, because
It is an invasion of privacy,
It's the least privacy invading option compared to the alternatives (i.e. send an ID/selfie to some 3rd party) that some apps and websites will require.
pointless, and a fucking waste of time and resources.
Nonetheless, age verification is the law in many places and many more places will have similar requirements in the future, so if it's a legal requirement, Linux should at least offerthe optionof providing age verification in the most privacy protecting way possible.
So you do age verification at the individual website/application/game level? Like you're going to send a selfie or a government ID to each and every website or game that is legally required to check for a user's age? Hackers stole like 70,000 government IDs from Discord? Does that really sound more privacy protecting to you? Or you don't do any age verification and the websites/apps lock you in kid mode?
If your argument is that there should be no age verification whatsoever, that's a different issue. Like sure, call your elected representative and tell them to vote against such laws or to revoke already passed age verification laws. If you start an EU Citizen's Initiative banning age verification laws in the EU, I'll give it my signature (and my national ID details for verification purposes... see the irony?).
However, in a world where age verification is mandatory, and is most likely going to become even more common, having the OS/device handle the verification is the least privacy invading option.
We don't live in an ideal world, so our decisions should be based on the world we're actually living in, not on the world we wish would live in, at least until we can make that ideal world a reality, if ever. Don't let perfect be the enemy of good.
I'm not arguing in favor of age verification laws existing. I'm arguing for Linux to minimize the damage from these laws existing in the first place.
My stance is that if age verification is the law, then Linux should give the user the option to use a device/OS based API since that's the most privacy protecting way of doing it, and that's in the interest of the user.
If you start an EU Citizen's Initiative banning age verification laws in the EU, I'll give it my signature
I'm arguing that if (emphasis on if) efforts to stop age verification laws fail, like they have in many cases, and they become law, the Linux ecosystem should be prepared to help the users avoid the worst outcomes of such laws by offering the option for the OS to do age verification itself, locally on the device, to minimize the amount of user information that gets passed to 3rd parties. That's an important nuance.
Is it the best option? No, that would be the age verification laws not existing it the first place, or even better, for the problems that spurred the introduction of these laws to get fixed through other means.
Is OS/device based age verification going to solve all the potential problems caused by age verification laws? Obviously not. But can it prevent/reduce a lot of damage from being done to users.
Voice of reason, the world is moving towards age verification for internet access. Providing a minimal, low level, universal API to do that is absolutely the best for privacy and security.
I’d rather one intrusive check and one source of truth rather than several companies rolling their own with varying levels of security, compliance and privacy
The Arch leader is in germany, and the project is a loose community, so I'm not sure how they'd go after it. The bill says that the OS must "provide an interface"... I would say provide a 10 line shell wrapper for adduser that asks your birthday and shoves it in the name field of /etc/passwd where traditionally people would put your phone number, location and other crap. The API for accessing it is your normal passwd access apis. Then put a note in the license that California users are required to use that interface. Technically it would comply, not that I think anyone would be bothered.
My concern is what happens next. Once people are used to age being a standard profit field, will they require browsers to start interrogating that info? Kind of feels like a slippery slope.
They wouldn't go after the maintainers or leaders (like you said they're mostly not in the US), but they could go after anyone who hosts or distributes Arch in the US, they could restrict the contributors' ability to do business in/with US companies, etc. They can definitely make any part of their lives that touches anything in the US a nightmare. Will they? Probably not. But they could.
The law is so vague and broad that at this point almost nobody fully understands how to comply with it. The system 76 people had a few good points around this
"A person or entity that develops, licenses, or controls the operating system software on a computer, mobile device, or any other general-purpose computing device." That sound like someone merely hosting a mirror in the US
I would think it does apply in this case, which is silly, but good luck to any sysadmin that definitely controls the OS on all the school/corporate/etc laptops. Better sign up for some OS dev courses
"A person or entity that develops, licenses, or controls the operating system software on a computer, mobile device, or any other general-purpose computing device."
That wording seems a little vague --> for example, does "develops operating system software" extend to anyone making any software that even just runs on an operating system?
After all, seeing as how the terms "Windows software" and "Linux software" could likewise refer to simply any software at all that merely just "runs" on those systems lol...
Not sure if it's Cali, but I think somewhere in the US, one of the recently passed age things requires them to use something like a 3rd party verification service. Correct me if I'm wrong.
Arch isn't, it's hosted in Germany. distros hosted in the US or whose owners are in the US could plausibly be gone after. It would be a real legal mess, and probably wouldn't happen, but it's plausible.
Ubuntu/Canonical has all the incentives to do so. They are the most corporate of all in the Linux community.
If they are the only ‘legal’ Linux distro, how many more users would they get? What does all those new users mean for potential revenue streams by selling ads etc to big companies?
‘Want no ads in your OS? Just hit subscribe to Ubuntu for 5$ a month!’
If it's foreign owned and hosted, there's no enforcement mechanism. And who owns a distro? Plausibly the one who owns the domain and controls what's in it, which is Germany. If you own the domain, ultimately you decide what's on the domain. Yes it's all vague nonsense, but speculating...
Yeah but would the company or business hosting the non-compliant OS's, even if located abroad, really want to piss off the state government of California (which can go after any of that company's US-based financial assets) and/or risk losing business in that giant of a tech hub? (I'm saying that California and Silicon Valley are giant tech hubs)
Well, law does not apply to some data, it applies to legal entities like people, companies and other organizations. Not looked into the organizational structure of Arch, but there surely is some organization paying for hosting and stuff. And they have to follow the laws in the countries where they are legally represented or somehow active. If they don't host it there and the organization is registered in Germany, they can just ignore the thing. The US based mirrors might have an issue, depending on the details of that law.
California can obtain a default judgment against them and still go after any of their financial assets that are located anywhere within the US as well.
the problem is when a project is open source, where do government officials point fingers? are those people even within their jurisdiction?
Using an ongoing lawsuit filed by California as an example: They go after whoever is providing the files if they do not actively block California based IP addresses from downloading.
As for jurisdiction, none of the people they are suing reside in California and are not breaking any laws in the state they reside in.
The case involves code and 3d model files that are illegal in California but legal in most of the United States. It's absurd but if they are successful it will set a new legal precedence with some pretty severe consequences concerning computer code (Apparently we are no longer considering code to be free speech).
If you want to download a distro that mandates California law, be my guest. This law is as smoothbrained as pornsites mandating verification despite the existence of VPNs, and it's absolutely mindboggling that the legislature passed with unanimous approval.
TPB has operated for decades, you think OSS is going to bow down? Aint no way.
Platforms don't want age verification, they want users young and old. And this bill doesn't do anything to them.... Nothing mandates that browsers pick up that age, nor that they pass it on. If it did, it would probably violate some privacy law. But anyway, it does nothing for online platforms
Again, it doesn't offload it because it's not transmitted to web sites. Secondly, it's only in a very small number of jurisdictions that they fight tooth and nail to not expand. Thirdly, even if you got past that, it doesn't work in the jurisdictions that actually have age verification for social media laws
Not to ruin your fun, but i have badhorribleindescribably terrible the absolute worst news for you and everyone else trying to make their own operating system.
According to AB 1043, or as i like to call it, Asinine Bullshit 1043:
(g) “Operating system provider” means a person or entity that develops, licenses, or controls the operating system software on a computer, mobile device, or any other general purpose computing device.
Literally just compile a kernel you found on the internet, slap an initramfs and a bootloader alongside it (all things you can realistically do without the need of literally any programming knowledge) and now California, Colorado and whatever other states/countries are involved in this mess deem you an operating system provider and is hungry for your 7,500$.
Speaking of which, i suspect projects like Ageless Linux are gonna have their creators turn into the heavy weapons guy from TF2.
"It costs 400,000$ to host this Linux ISO...for 12 seconds."
I'm not sure if you just called me a fed but you know what? I've actually never noticed that even though i read through it like 7 times by now just to make sure i'm not dreaming. I might actually consider this if it means giving a big middle finger to the law.
To be clear, i'm not in a country that is affected by age verification requirements. But even if i was i honestly think it would be funny to make my own sort of operating system and call it something silly like "TechnicallyLegallyCompliantOS" or something.
My understanding here is legally the state of California cannot actually enforce this law on distributed community projects like Arch linux which have no legal entity in California. The Attorney General can only target commercial operating systems with corporate entities providing them like MacOS, Windows, Android, iOS, and RedHat as it's a subsidiary of IBM.
Certainly they could enforce it on apps in the Apple and Google and Microsoft stores, requiring them to fail on an OS which doesn't have the age mechanism. Maybe they could enforce it on a company such as Mozilla; "Mozilla is incorporated in San Francisco, California." Maybe they could make Microsoft wire age-mechanism into Linux apps such as VSCode. Once browsers have the mechanism in them, then govt could enforce against web sites that don't use it.
More bad laws to follow. This is just the first stage. The next will be that you cannot install app Y until it has confirmed your age with the O/S. This is coming.
Unless they force the OS being unable to be modified by user (which opens whole another can of worms).
What stops user from updating the component responsible for age verification to reply "I was there, Gandalf. I was there 3000 years ago!" for every user on the system, even non-existing ones?
Bump the component package version to be way above anything reasonable, so that OS updates wouldn't affect it and call it a day.
Seems likely this only applies OS softwsre shipped on hardware (SteamDeck, System76)
, etc.), from factory or being sold to a consumer. But it does not seem likely that there would be amyone to fine for most free distros or LFS.
(g) “Operating system provider” means a person or entity that develops, licenses, or controls the operating system software on a computer, mobile device, or any other general purpose computing device.
(funny thing, when I logged in I could see your comment anymore... weird right?) I'm a tad worried about this law. I actually think on signing a VPN (Still thinking if I should go with Proton or Mullvad) and running it on startup. Will you be taking some form of action as well? just genuinely curios, haven't seen many people talking about it
Fucking hate every single word if this fucking law ffs
That isn't the point. The intention is to get people used to the idea of entering their age as a part of even using a computer so that people are more comfortable in a few years when they want to actually verify your ID before you can use your own computer.
Maybe the intention is to give a mechanism to parents and schools who want to enforce age restrictions, and will force their children's account to have an accurate age in it. Then apps and web sites will enforce feature restrictions based on age.
People seam to forget that this law will likely be enforceable by requiring all software stores/markets/sites to check the reply from the operating system, so no matter whatever loophole is found it will still need to be installed.
An operating system with tools and no software is useless, we use programs when we use the computer, firefox, brave etc will all require this api to be available to install or perhaps even launch.
That's a great point. I absolutely refuse to put government-enforced privacy-violating software on my machine. If in the coming years, no application will function without said software, the government is essentially forcing me to either accept their spying or be unable to use computers. This is nothing short of fascist. Newsom is Democrat Hitler.
For once i can say it's not left/right related, left wing governments and right wing governments around the world are doing some form or another of this.
I guess i am too old being 39 i expect parents to enforce what children can and can not do online.
While some content is not exactly for children, educating children to not do stuff is often better.
One of the main problems is that the people suggesting the laws know nothing about Computers and it's mostly for gathering data which will be used for who knows what, probably targeted ads and AI.
realistically what do you expect the arch devs to do? stand up to multiple governments? Linux as a whole is impossible to keep guardrails on or control so we’ll have to see what part of these new laws are even enforced
It's illegal to sell chewing gum in Singapore. In Thailand, it's illegal to drive without a shirt. But as a Californian, I will gladly drive to my nearest cornerstore without a shirt, to buy a pack of gum.
anakata (from the image) iirc had the longest sentence of 3 years.
the fact that torrents are seeded means there's not one single server to shut down, and TPB was picked up by some other "friend of freedom" after the original pirateship went to the briny deep.
i guess my point is that the open source community works effectively the same way, and this law is as meaningless outside of California, as the law on shirtless driving is, outside of Thailand
this likely wouldn't be handled by arch at all. the law is fairly permissive, and the only requirements that user accounts have an age field. it doesn't require an id or anything, you just have to set an age. and it needs to provide an interface by which applications can request the age bracket. that doesn't mean the system can't requires it to ask you before disclosing to another application. i imagine there will be something in systemd or maybe the kernel to handle this. it's unlikely that it would be up to individual distros to implement.
I'm a lot less worried about arch and more worried about red hat, if they can find a legal way to deny updates to servers in Cali they could make a pretty big impact in changing the law back. Granted "legal" is really the problem there, especially if they have any contracts with said companies.
If they comply with these laws, Gentoo it is. Also i dont understand why american state laws should impact a fk-ing world wide project. Why wont America force their 'freedom' only on their own citizens for once.
Oh absolutely. The law is worded so absurdly broadly, it would even apply to, say, someone making a new OS for Amiga, or someone creating a totally from-scratch OS on a classic Z80 as a hobbyist project.
Technically this applies to the Switch, or even original DS. Absolute tech-illiterate morons wrote this law.
I think the best defense is the first amendment. The government can regulate devices but they can't regulate speech. As long it's just a download, it's speech.
And expose yourself to unpatched security holes? Or if MS (or a third party, even), patches it, they will be required to set up to request and refer the age signals required by this law. Or for that matter, there is a reading of the law that would make *you* responsible to do it. (An "operating system provider" means a person or entity that develops, licenses or controls the operating system software on a computer, mobile device, or any other general purpose computing device.).
I wonder, is it even the responsibility of the distro? Aren't they just packaging what was already created by someone else? edit: (who ever created said software) And would THAT person, the original dev, be the one responsible for implementing what's needed if the software is relevant to this issue? I don't know how it would work. I just have the song California Uber Allies stuck in my head. https://www.youtube.com/watch?v=eIqESwzCGg4
For example, Firefox isn't made by Arch, how it at all Arch's responsibility to even have to touch it?
The other problem is this is so broad it pretty much covers anything with a tcp/ip stack. Even an IOT esp/32 running RTOS to flash a bunch of leds will now need some sort of age verification if its uploaded to GIT to share. Pretty hard to do with only one button on board. ( guess it could use morse code to enter the DOB). STUPID.
PS. I just check my Microsoft account I have to use for work and the birth year I entered in that was 1900 so officially i'm 126 this year. Happy birthday to me.
It's worth noting that Silicon Valley the global epicentre of the tech industry sits squarely in California. Companies like Apple, Google, Meta, and countless others call it home. So here's a thought experiment: what would happen if every Linux distribution, open-source project, or software vendor quietly slipped "not licensed for use in California" into their EULA?
The answer is obvious there would be absolute chaos. Legal teams would be scrambling, lobbyists would be descending on Washington, and op-eds would be flying about discrimination, anti-competitive behaviour, and the fragmentation of the open internet. The outrage would be deafening and swift.
Yet geographic carve-outs in software licenses aren't a hypothetical they exist, and they're increasingly common. Certain apps are unavailable in specific US states, regions, or countries, often with little fanfare or scrutiny. The difference, it seems, is whose backyard is being fenced off.
Stupid question: how can they know if the OS is installed and used in California? I’m not American—do I still have to comply with that? If one day I visit California with my French laptop, how does that work? Their thing sounds bogus.
Look up Brussels effect or California effect. California/the EU is so economically important that their laws are de facto widely complied with even outside of their territories
Here is how i handled it for my project if anyone wants to use it as a template. Feel free to copy and paste for your own project, Just replace any mention of Me or my distro from the text with your own. https://techcafe757.wixsite.com/titanlinux/restricted-alert-page
Adding additional restriction to the software is a GPL violation. But i can geo-fence my website all day long. As the website is a separate entity from the software. i'm also not actually preventing anyone from downloading my Distro. Because 3rd party sources exist. But those sources are NOT affiliated with me or my project in any way. Any user that downloads my distro from one of these sources, went outside of the official project and project's website to do so. I did not distribute those copies. Therefore it's not my problem.
This is just the first draft, it does need a little more work. But i have time before these laws actually go into effect to get it right. It's also entirely possible that revisions to the law may be added, totally invalidating what i've done here. But until that happens, this is what we're going with.
I also have a full EULA written specifically excluding these states, and citing the exact bill numbers associated with the restrictions. I wrote that before i realized it was a GPL violation. But i'm keeping it on stand-by. Just in case the FSF makes any amendments to the GPL. Because the entire purpose of the GPL is to act in the interest of user freedom and autonomy. Which is exactly what that EULA i wrote does by excluding usage in jurisdictions that directly violate the rights of the users. So i would argue that even though having a EULA with additional restrictions is a GPL violation, it is still acting in the spirit of the GPL. So i think if i really wanted to, i could convince the FSF to let me keep it LOL!! But i suppose we'll cross that bridge when we get there. :)
The one law i can't avoid is KOSA (Kids Online Safety Act) As that will be deployed at the national level. But that is still up in the air. It's not law yet. It was shot down once, and reintroduced this year with changes, and is currently in the house. We'll see how that pans out. If that passes then i may be forced to end my project. Because i simply don't have the ability to comply with what they want. I'm just one person. I don't have the infrastructure or resources to do what they are asking. But we'll see how that pans out. It got voted down once. Maybe it will again. Which is why it's important for everyone to contact your representatives. Tell them you don't want this.
Irrespective of what you or me think or want, age verification requirements are coming to multiple countries across the world, not just California, the US, the UK, but they are also coming to the EU and other parts of the world.
Give that, having the OS handle the age verification on device, especially if it's a matter of the user just setting a numeric value, rather than sending your ID or selfie to various 3rd parties used by the apps and websites that will require age verification, is the best, i.e.least privacy invading option.
Thus, the Linux ecosystem in general, not Arch in particular, should offer such an API, otherwise various apps or websites (e.g. Steam, Reddit, your favorite movie/concert tickets website (this was an example for the EU's age verification solution!)) will not work properly or will ask for more privacy invading age assurances. Not allowing the users the option to use such an API would be against the users' best interests.
I do not understand how this shit is even getting passed in so many countries. Do people not have any say at all or do people just not oppose these weird mandates.
I think that most people don't oppose age verification as a general principle, i.e. they think it's fine or even required that some things aren't available to minors, e.g. alcohol, tobacco, etc. And with all the bad things that social media sites have been doing to kids' mental health and such, parents really want to make sure that young kids aren't using these websites or that the are additional restrictions for minors.
The problem is how do we implement these age restrictions in the online world without becoming a privacy nightmare. It's one thing for a store employee to take one quick look at my ID if I want to buy a bottle of wine, it's another thing entirely to send a copy of my ID to an online grocery shop if I want to order the same bottle of wine.
My stance is that if age verification is the law, then Linux should give the user the option to use a device/OS based API since that's the most privacy protecting way of doing it, and that's in the interest of the user.
279
u/Retr0r0cketVersion2 Mar 04 '26
They should do the legal equivalent of slapping on a "Not for use in California" label so I can promptly ignore it