California’s recently enacted Assembly Bill No. 1043, also known as the Digital Age Assurance Act, along with similar legislation in other states and countries, sets a requirement for operating systems to implement age verification at the account setup stage. Effective January 1, 2027, the legislation mandates operating systems to collect the user’s birth date or age and provide an age-bracket signal, categorized as under 13, 13–16, 16–18, and 18+, to app developers via an API upon request.
While commercial operating systems like Windows already possess the infrastructure to comply, open-source systems such as Linux face unique challenges. These distributions often lack centralized account systems, mandatory online identities, or unified app stores, complicating compliance efforts. Discussions are ongoing among major open-source contributors, like Fedora and Canonical, as they seek technical and legal solutions.
Proposals to address these compliance challenges include a standardized Linux D-Bus API, which would return only age-bracket data and keep such information accessible only to root users. Nonetheless, there are legal advisories and no concrete compliance strategies as of yet. Some smaller projects, like MidnightBSD, are opting to prohibit use in affected states to bypass compliance.
Critics, including privacy advocates, warn of potential overreach, arguing these laws may escalate into broader surveillance mechanisms and foster data profiling, with vague parameters that could lead to political content restrictions.
The movement for age verification is not limited to the U.S.; international instances include Brazil’s Digital Statute of the Child, with similar laws contemplated across the UK, EU, Australia, and Singapore. While global in reach, these regulations introduce significant hurdles for the open-source community—echoing concerns about prioritizing surveillance and data control over user privacy and safety.

Collections

California's Assembly Bill No. 1043 (Digital Age Assurance Act), effective January 1, 2027, requires operating systems to implement age verification at account setup and expose age-bracket signals to app developers via an API. Commercial OS vendors like Microsoft have existing infrastructure to comply, but open-source systems like Linux face significant hurdles due to their decentralized nature, lack of mandatory accounts, and fragmented distribution ecosystem. Proposed solutions include a standardized D-Bus API returning only age-bracket data restricted to root access, though no concrete compliance strategies exist yet. Some smaller projects like MidnightBSD are simply banning use in affected jurisdictions. Privacy advocates warn the laws could enable surveillance and data profiling. Similar legislation is emerging globally in Brazil, the UK, EU, Australia, and Singapore, amplifying the challenge for the open-source community.

Navigating Age Verification Mandates for Operating Systems: Challenges and Approaches