{{Header}} {{title|title= Age Signaling and Interface Documentation and Design for {{project_name_short}} }} {{#seo: |description=Overview of age signaling related interface design considerations for {{project_name_short}}, including privacy implications and why no default age or bracket should be preselected. }} {{intro| This page documents interface design considerations for age signaling requirements that may apply in some jurisdictions. }} = Disclaimer = This is not legal advice. As per [[Terms of Service]] wiki chapter, there is [[Terms_of_Service#No_Legal_Advice|No Legal Advice]]. {{quotation |quote=The Services are not for use by anyone under the age of 18. |context=[[Terms of Service]] chapter [[Terms_of_Service#Minimum_Age|Minimum Age]] }} = Introduction = Some jurisdictions are proposing or enacting rules that require an operating system provider to expose an account setup interface that collects either a birth date, an age, or both, for the purpose of signaling an age bracket to applications. = Background = Law passed, in effect January 2027: * https://california.public.law/codes/civil_code,_division_3,_part_4,_title_1.81.9 ** https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260AB1043 Draft law status: * https://leg.colorado.gov/bills/SB26-051 ** https://leg.colorado.gov/bill_files/110990/download This is [[unspecific|unspecific to {{project_name_short}}]]. Most Linux distributions, most general purpose operating system may be affected. {{quotation |quote=App Store and Device-Level Age Verification |context=EFF: [https://www.eff.org/deeplinks/2025/12/year-states-chose-surveillance-over-safety-2025-review The Year States Chose Surveillance Over Safety: 2025 in Review] }} [https://www.linkedin.com/company/mcneeswallacenurick/ law firm] blog post: [https://www.mcneeslaw.com/age-verification-laws-app-developers-compliance/ New laws in some states require app developers to verify users’ ages] Open questions: * Will server operating systems have to comply? Absurdities: * [https://github.com/microsoft/MS-DOS Microsoft is distributing MS-DOS 4.0]: Do they have to stop distributing MS-DOS or comply with this law? May be applicable to binary builds only, not source code? * https://www.freedos.org/ FreeDOS] == Other Projects == === On the unfortunate need for an "age verification" API for legal compliance reasons in some U.S. states === * [https://lists.debian.org/debian-devel/2026/03/msg00016.html debian-devel]. * [https://mail-archive.com/search?l=devel@lists.fedoraproject.org&q=subject:%22Fw%5C%3A+On+the+unfortunate+need+for+an+%5C%22age+verification%5C%22+API+for+legal+compliance+reasons+in+some+U.S.+states%22&o=newest&f=1 fedora-devel] ** [https://lists.fedorahosted.org/archives/list/devel@lists.fedoraproject.org/thread/MYM452NNXF3ZJ7HPBYT4HDNTKRK2FWBX/ fedora-devel] * [https://www.mail-archive.com/search?l=ubuntu-devel@lists.ubuntu.com&q=subject:%22On+the+unfortunate+need+for+an+%5C%22age+verification%5C%22+API+for+legal+compliance+reasons+in+some+U.S.+states%22&o=newest&f=1 ubuntu-devel] * [https://lists.freedesktop.org/archives/xdg/2026-March/thread.html#14764 xdg-devel] === More === * https://discussion.fedoraproject.org/t/california-age-verification/181968 * https://discussions.unity.com/t/play-age-signals-api-support-is-unity-preparing-for-this/1689525 * https://forum.manjaro.org/t/california-and-colorado-laws-an-os-age-verification/185960 * https://x.com/midnightbsd/status/2027101491211718765 {{quotation |quote=California results are not authorized to use MidnightBSD for desktop use in the state of California effective January 1, 2027. California law [CA AB1043 https://legiscan.com/CA/text/AB1043/id/3269704] requires a complex age verification system implemented for operating systems with no exceptions for small open source projects. |context=https://github.com/MidnightBSD/src/commit/7d956a27123f2d77a05313826c29a0329a923254 }} * https://github.com/MidnightBSD/src/blob/master/COPYRIGHT#L7 * https://x.com/midnightbsd/status/2027820452828139625 * https://x.com/midnightbsd/status/2028195352520626576 ** https://docs.google.com/document/d/1_NKq0bpN1pOrMpHePuilJY7saXqXqhss6LwPTC6nSto/edit?tab=t.0#heading=h.45e7p9clyiqo = {{project_name_short}} = == Privacy Friendly Choice == * Users may misstate age: One might expect users to lie about their real age. * Bracket-preserving entries: From the user's perspective, it might make sense, for privacy, to provide an age within their age bracket without revealing their real age. * Family friendly example: For a family friendly experience, a user might choose an age of 10 even if they are older. * Adult example: Someone of a higher age might choose 18 even if they are much older. * No recommended defaults: However, for legal reasons, it may be prudent for {{project_name_short}} to abstain from recommending privacy friendly defaults. == Fingerprinting Risk == Low. Due to... {{quotation |quote=The Services are not for use by anyone under the age of 18. |context=[[Terms of Service]] chapter [[Terms_of_Service#Minimum_Age|Minimum Age]] }} TODO: Likely the following will happen. On most (if not all) systems that upgrade every system, there will be a file $HOME/.age-api/age-bracket with content 4. Therefore the impact of this will be low. = Interface Design Choice Details = == Mandatory Blocking == Device/account setup must be '''required'''. Bold added. {{quotation |quote=1798.501. (a) An operating system provider shall do all of the following: (1) Provide an accessible interface at account setup that '''requires''' an account holder to indicate the birth date, age, or both, of the user of that device for the purpose of providing a signal regarding the user’s age bracket to applications available in a covered application store. }} == Age of the Primary User Wording == Why ask the clumsy What is the age (in years) of the primary user of this device? instead of "How old are you?" Because the law requires asking for the age of the user. Not necessarily "you". {{quotation |quote=(i) “User” means a child that is the primary user of the device. }} == Age versus Day of Birth == Bold added. Underline added. {{quotation |quote= 1798.502. (a) With respect to a device for which account setup was completed before January 1, 2027, an operating system provider shall, before July 1, 2027, provide an accessible interface that allows an account holder to indicate the birth date''',''' age, '''or''' both, of the user of that device for the purpose of providing a signal regarding the user’s age bracket to applications available in a covered application store. }} == Prompt for Age instead of Age Bracket == Why prompt for the age instead of the age bracket? The law clearly asks for day of birth or age and not for an age bracket. {{quotation |quote= 1798.502. [...] allows an account holder to indicate the birth date''',''' age, '''or''' both, [...] }} == No Default Choice == Why not configure "under 13" or "older than 18" by default? {{quotation |quote= 1798.502. [...] allows an account holder to indicate the birth date''',''' age, '''or''' both, [...] }} Therefore, a family friendly by default or adult by default setting is not permissible. = Alternatively = Are you currently located in, or ordinarily resident in, any comprehensively sanctioned jurisdiction? Or are you acting on behalf of someone located there? Are you currently located in, or ordinarily resident in, any comprehensively sanctioned jurisdiction (for example Cuba, Iran, North Korea, Syria), or acting on behalf of someone located there? Yes / No If Yes → prohibited. B. Not offered in certain US states (if you choose that strategy) Are you currently located in, or ordinarily resident in, California? Yes / No = Objections = * This is only a draft only. Wait for the final law. ** Not a draft. The law is final and passed. will come into effect in January 2027. * Not applicable. ** {{quotation |quote=(g) “Operating system provider” means a person or entity that develops, licenses, or controls the operating system software on a computer, mobile device, or any other general purpose computing device. }} * Applies to commercial vendors only. ** There is no passage in the law that mentions commercial or vendor only. * Jurisdiction not applicable. ** it's similar to like a financial service. bank account. a EU bank providing financial services to USA, Canada etc. services won't do that unless they're authorized by the banking authority of that country (USA, Canada, ...). hard argument to make solid. someone can point out "but there's an agreement where this isn't necessary in this specific case" thereby creating the impression the the argument is generally junk.See also [[Trust#Legal_Jurisdiction|Legal Jurisdiction]] * You should just ignore this and not comply. ** [[Trust#Legal_Compliance|Legal Compliance]] * Should deny CA residents. ** Not a solution. * Users can trivially bypass this by lying about this age. ** This is correct, but but law doesn't mandate yet it being reasonably difficult to bypass. In the future, laws that require making this reasonably difficult to bypass. Fortunately the law doesn't mandate yet ID verification, certified software ([[Miscellaneous_Threats_to_User_Freedom#Device_Attestation_such_as_SafetyNet|Device Attestation such as SafetyNet / Google Play Integrity API]]), locked bootloaders ([[Miscellaneous_Threats_to_User_Freedom#restricted_boot|restricted boot]]), [[Miscellaneous_Threats_to_User_Freedom#Administrative_Rights|administrative ("root") rights refusal]], cryptographic secure APIs, etc. This might be part of the [[Miscellaneous_Threats_to_User_Freedom#War_on_General_Purpose_Computing|War on General Purpose Computing]]. * Implementation is not good enough. ** Opinionated. A reasonable effort has been made. 4 related mailing lists have been contacted, see [[Age-api#On_the_unfortunate_need_for_an_"age_verification"_API_for_legal_compliance_reasons_in_some_U.S._states|On the unfortunate need for an "age verification" API for legal compliance reasons in some U.S. states]]. [[Age-api#Development|Development]] has been done. ** {{quotation |quote=(b) An operating system provider or a covered application store that makes a good faith effort to comply with this title, taking into consideration available technology and any reasonable technical limitations or outages, shall not be liable for an erroneous signal indicating a user’s age range or any conduct by a developer that receives a signal indicating a user’s age range. }} * The base distribution (Debian) need to implement this, not derivatives such as {{project_name_short}}. ** It is correct that Debian may also need to implement this. However, {{project_name_short}} has no influence on that. The topic has been raised at the Debian mailing list [https://lists.debian.org/debian-devel/2026/03/msg00016.html debian-devel: On the unfortunate need for an "age verification" API for legal compliance reasons in some U.S. states]. * You should use the standard API. ** An age API convention/standard does not exist yet. If one were to exist, it would be considered. * Other distributions. ** might react in various ways. *** wait and see *** not taking it serious *** waiting to get a fine / sued *** TOS (terms of service) prohibiting California residents * Prohibit California residents in TOS (terms of service). ** todo * A VM is not an {{os}}. ** Possibly. Risky. * probably technically illegal but not enforced unless as long as no adult content is shown to children ** Possibly. Risky. * enforcement will take years and it's a bit like being stuck my lightning (rare) ** Might be true, but is but risky. * [https://california.public.law/codes/code_of_civil_procedure_section_410.10 California's long-arm statute is broad: California courts may be able to exercise jurisdiction on any basis consistent with state/federal constitutions.] * Should do this/that instead. ** [[Limitations_on_Free_Speech_on_Website_and_Chat#Personal_Liability|Personal Liability]] = Development = * https://github.com/Kicksecure/age-api = Related = == Lawsuits == May be related to app store age verification rather than operating system age signaling: * https://ccianet.org/library/ccia-v-paxton-wd-tex-sb2420-complaint/ * https://www.texaspolicyresearch.com/texas-app-store-law-faces-first-amendment-lawsuit/ == Resources == * https://actonline.org/2025/01/14/the-abcs-of-age-verification-in-the-united-states/ * https://www.eff.org/pages/does-tech-even-work * https://news.bloomberglaw.com/legal-exchange-insights-and-commentary/states-use-app-store-controls-to-keep-online-content-from-minors * https://developer.apple.com/documentation/declaredagerange/ {{Footer}} [[Category:Documentation]]