Age Verification Laws Are Coming for Your Operating System

California's new Digital Age Assurance Act requires operating system providers to verify user ages before allowing access to certain content. The law targets both mobile and desktop platforms. New Jersey, Ohio, Arkansas, New York, and several other states are either planning or have already passed similar legislation. Brazil is reportedly considering its own version.

The problem isn't the stated goal—keeping children safe online. The problem is that legislators wrote these laws without understanding what an operating system is or how software development works, particularly in the open-source world.

Canonical, the company behind Ubuntu, said it's "investigating how to implement age assurance without compromising its core open source principles or user privacy." Fedora and Red Hat developers noted something more fundamental: decentralized projects lack the account infrastructure that Apple and Microsoft use to track user ages. There's no central registry. No single point of control. That's the entire point.

When Good Intentions Meet Bad Implementation

The laws vary significantly in their requirements. California's version essentially operates on an honor system—users self-report their age and the system accepts it. Not particularly effective, but at least it's minimally invasive.

New York's proposed bill goes much further. It explicitly forbids self-reporting and leaves the acceptable verification methods up to the attorney general. That likely means government IDs or biometric data submitted to your operating system.

Carl Richell, CEO of System76, pointed out the implications in a recent blog post: "The challenges we face are neither technical nor legal. The only solution is to educate our children about life with digital abundance. Throwing them into the deep end when they're 16 or 18 is too late."

He's right about the educational component, but he's being generous about the technical challenges. Open-source distributions might need to geo-block users in certain states if they can't meet verification requirements. That contradicts the foundational principle of free software—that anyone, anywhere, should be able to use it.

The Data Breach Question

Sensitive data storage doesn't have a great track record. Discord leaked 70,000 government IDs last year due to similar verification requirements in the UK and Australia. Equifax's breach affected roughly 70% of American adults. When legislation mandates the collection of government IDs or biometric data, breaches aren't a possibility—they're a statistical certainty.

The laws also create a new attack surface. Proprietary verification systems embedded in open-source software would undermine the transparency that makes auditing possible. You'd have to trust that the black box handling your government ID is secure. History suggests that's optimistic.

A Motorola Partnership Nobody Expected

While legislators complicate the software landscape, Motorola announced a partnership with GrapheneOS at Mobile World Congress. GrapheneOS is a security-hardened Android fork that strips out Google services and proprietary code. It's currently only available for Google Pixel devices, which creates an odd situation where the most privacy-focused Android option requires buying a phone from the world's largest advertising company.

Motorola plans to ship GrapheneOS-compatible devices starting in 2027, likely including the Signature, Razer Fold, and Razer Ultra models. The operating system won't replace Motorola's standard Android build—it'll be an optional installation. More interesting: Motorola will port several GrapheneOS security features into its own Android builds.

Future Motorola hardware will support GrapheneOS requirements like memory tagging extensions and hardware-backed security from the factory. Current Motorola devices can't run GrapheneOS due to hardware limitations.

The timing is noteworthy. As legislators push for mandatory age verification systems, a major manufacturer partners with a project built on the opposite principle—minimal data collection and maximum user control.

The Technical Updates

Bazzite, the Linux gaming distribution, released a major update incorporating KDE Plasma 6.6. The update reduced system image sizes by 200 megabytes and fixed a critical bug causing 100% disk usage on game mode images within 24 hours of discovery. That's the advantage of immutable distributions—when something breaks, fixes deploy quickly across all installations.

Linux From Scratch released version 13.0. For the uninitiated, Linux From Scratch isn't a distribution. It's a manual for building a Linux system entirely from source code. The learning curve makes Arch and Gentoo look approachable. If most distributions are cars you buy from a dealership and Arch is a kit car, Linux From Scratch requires you to manufacture the parts before assembling them.

Version 13.0 is the first systemd-only release, which will upset some people. It always does.

Where the Anger Should Go

Michael Tunnell, who covered these stories on his This Week in Linux show, made a point worth repeating: the criticism shouldn't target Canonical, System76, or Red Hat for trying to comply with poorly written laws. "We need to put the blame where it should be, which is the politicians who are creating these laws based on not understanding at all what they're talking about," he said.

That's correct, but it misses a deeper issue. These laws passed because legislators didn't consult with people who build software before mandating how software should work. The age verification requirements demonstrate what happens when policy moves faster than understanding.

The smart fridge question looms: if these laws define operating systems broadly enough, does the Linux-powered screen on your refrigerator door need age verification? What about your car's infotainment system? Your thermostat? The legislative language is vague enough that nobody knows.

Source code is considered free speech under U.S. law. Compelling developers to write specific code—for age verification or anything else—raises First Amendment questions that haven't been tested in court. Maybe that's the path to challenging these laws. Or maybe it isn't. Either way, it's a question that shouldn't need asking.

—Bob Reynolds