Several US states are passing laws that require operating systems and app stores to verify user ages. California, Colorado, Illinois, and New York are either already on the books or moving fast. The stated goal is child safety. The practical effect is a mandate for centralized data collection that doesn’t map cleanly onto how open-source software actually works.
<h2>The Linux problem</h2>
Most age verification frameworks assume a centralized account system and a curated app store. Linux distributions have neither. There’s no single gatekeeper, no mandatory login, no unified distribution channel. Requiring age attestation APIs during OS setup is straightforward if you’re Apple or Microsoft. For Canonical, Fedora, or Arch, it’s genuinely unclear what compliance even looks like.
Distros are responding in different ways:
<ul>
<li>Canonical (Ubuntu) and Fedora are exploring minimal, privacy-conscious approaches like local D-Bus interfaces or <code>/etc/</code> config files that could satisfy the letter of the law without requiring accounts or data transmission.</li>
<li>System76 (Pop!_OS) has been more proactive politically. The CEO met directly with a Colorado senator, who reportedly suggested excluding open-source software from the bill entirely. That’s a real opening, if it holds.</li>
<li>Omarchy Linux and Adenix GNU/Linux have flatly refused to comply.</li>
<li>MidnightBSD took the most dramatic step, updating its license to exclude California residents from desktop use starting in 2027.</li>
<li>Linux Mint, Arch, SUSE, and NixOS haven’t taken official positions yet. Most will probably wait to see what Ubuntu and Fedora do, then follow.</li>
</ul>
The open-source exclusion that System76 is pushing for in Colorado could matter a lot. If it passes there, it sets a precedent other states might follow.
<h2>Valve’s fight in New York</h2>
Valve is dealing with a different but related problem. The New York Attorney General sued over loot boxes, and as part of that case, the AG’s office demanded that Valve implement additional age verification globally and collect significantly more user data.
Valve refused publicly, which is unusual. Their position is that payment processors already handle age verification at the point of purchase, and that layering additional data collection on top of that creates privacy risks without meaningfully improving child protection. They’re not wrong about the privacy implications - any system that collects and stores age verification data at scale is a data breach waiting to happen.
<h2>The underlying tension</h2>
Both situations point to the same problem. These laws are written with large commercial platforms in mind, and the compliance mechanisms they require - centralized accounts, mandatory data collection, age attestation APIs - carry real privacy costs. When applied to open-source software or privacy-focused platforms, the fit is poor.
The child safety framing makes these laws politically difficult to oppose directly. But the actual mechanisms being proposed collect and store sensitive data about millions of users, including adults, with no clear security requirements for how that data gets protected. That’s worth being honest about, even if the stated goal is legitimate.

Collections

Several US states are passing age verification laws that require operating systems and app stores to verify user ages, creating compliance challenges for Linux distributions and platforms like Valve's Steam. Linux distros lack the centralized account systems these laws assume, leading to varied responses: Ubuntu and Fedora are exploring privacy-conscious local solutions, System76 is lobbying for open-source exemptions in Colorado, while some distros like MidnightBSD have taken extreme steps like license changes. Valve is fighting a New York AG demand for expanded age verification and data collection, arguing payment processors already handle this and additional data collection creates privacy risks. The core tension is that these child safety laws are designed for large commercial platforms and impose centralized data collection mandates that fit poorly with open-source software architecture and privacy-focused platforms.

Age verification laws are putting Linux distros and Valve in a tough spot

This is bullshit! Parents are going to verify for their kids and thats it.
Or what percentage of children own computers that their parents don’t know about? Like 0.5% of children maybe?
Doing this “for the children” makes no sense at all!

By the way Valve has been handling things, they deserve all the success and money from satisfied customers they can possibly get.

<ul>
<li>Omarchy Linux and Adenix GNU/Linux have flatly refused to comply.</li>
<li>MidnightBSD took the most dramatic step, updating its license to exclude California residents from desktop use starting in 2027.</li>
</ul>
based

Average use of “for the children” reasoning to further spy on you. Lovely

im the farthest thing possible to a linux glazer but… sudo rm age_verification? not possible? no?