age verification laws are coming for your operating system
legislators have decided that the best way to protect children online is to make your operating system ask how old you are. not websites. not app stores. the actual OS. and they're not just targeting Windows and macOS - Linux distros and BSDs are technically on the hook too.
the laws
california's AB 1043 (the "Digital Age Assurance Act") was signed in october 2025 and takes effect january 2027. it requires every operating system to collect the user's age during account setup and expose it to third-party apps through a real-time API.
colorado passed near-identical legislation in march 2026. illinois and new york have bills in the pipeline. brazil's version went live on march 17, 2026, and it explicitly names operating systems and app stores. it requires auditable age verification, an age-signal API, and parental consent before minors can download anything.
nine US states passed some form of age verification law in 2025 alone. the EFF called it "the year states chose surveillance over safety."
why it doesn't work
the technical problems with this approach are almost too obvious to list:
- the laws only require self-reported birthdays. no actual ID verification. as System76 put it: "they can lie. they will lie."
- most Linux distros don't have "account setup" in any traditional sense. you can install arch without ever seeing a GUI wizard
- a toothbrush with a wifi chip could technically qualify as a "device running an operating system" under some of these definitions
- fines of up to $7,500 per minor for intentional violations would be devastating for community projects with no corporate backing
- some legislators are simultaneously pushing to ban VPNs, which is the obvious workaround
the whole thing assumes that an OS works like an iPhone - one device, one user, one account, one app store. that hasn't been true for decades on the desktop, and it's never been true on Linux.
how distros are responding
the responses range from grudging compliance to outright defiance.
compliance track: ubuntu is reviewing with legal counsel. community members have proposed a D-Bus interface (org.freedesktop.AgeVerification1) that stores age brackets locally without phoning home. fedora is exploring minimal approaches like a local API or a flat file in /etc/ populated during setup. System76 pointed out that since users can just lie, they'd rather implement something minimal than let their users get a "nerfed internet."
resistance track: MidnightBSD updated its license to ban residents of brazil, california, and potentially colorado, illinois, and new york from using the OS at all. DHH's Omarchy Linux and Adenix GNU/Linux rejected compliance on principle.
silence track: arch has no official statement. forum threads about it appear to have been deleted. most smaller distros are waiting to see what the big projects do.
who's behind it
a reddit investigation traced $2 billion in nonprofit grants and 45+ lobbying disclosures through IRS filings, senate records, state ethics databases, and campaign finance records. the conclusion: this is a coordinated push to build surveillance infrastructure at the OS level, running under the banner of child safety. the organizations pushing these laws face zero new requirements for their own platforms.
this isn't a grassroots effort by concerned parents. it's institutional money buying legislation that creates a universal age-tracking API on every device.
why you should care
even if age verification stays as a self-reported birthday, the infrastructure is the problem. once every OS has an API that broadcasts user age to every app, the next step is requiring real ID verification to populate it. then you've built a universal identity layer into the operating system itself.
the pattern is always the same: build the pipe first, then change what flows through it.
eli5
imagine the government told every car manufacturer to install a breathalyzer before the engine starts. but instead of actually checking your blood alcohol, it just asks "are you sober?" and you press yes. kids would press yes. drunk people would press yes. the only thing it actually accomplishes is putting a government-mandated sensor in every car that could later be upgraded to do real checks - like tracking where you drive or how fast you go. the breathalyzer (age verification API) doesn't solve the problem it claims to. but the wiring it installs (OS-level identity infrastructure) is very useful for other things later.