California's OS Age Verification Law

[illutari]

I hadn't seen any other posts about it, and figured it could be a good conversation for the catchall forum. California passed Assembly Bill No. 1043 back in October which made age verification requirements for operating system providers (goes into effect Jan. 1, 2027)

https://leginfo.legislature.ca.gov/f...02520260AB1043

1798.501.

(a) An operating system provider shall do all of the following:

(1) Provide an accessible interface at account setup that requires an account holder to indicate the birth date, age, or both, of the user of that device for the purpose of providing a signal regarding the user’s age bracket to applications available in a covered application store.

(2) Provide a developer who has requested a signal with respect to a particular user with a digital signal via a reasonably consistent real-time application programming interface that identifies, at a minimum, which of the following categories pertains to the user:

(A) Under 13 years of age.

(B) At least 13 years of age and under 16 years of age.

(C) At least 16 years of age and under 18 years of age.

(D) At least 18 years of age.

(3) Send only the minimum amount of information necessary to comply with this title and shall not share the digital signal information with a third party for a purpose not required by this title.

(b) (1) A developer shall request a signal with respect to a particular user from an operating system provider or a covered application store when the application is downloaded and launched.

(2) (A) A developer that receives a signal pursuant to this title shall be deemed to have actual knowledge of the age range of the user to whom that signal pertains across all platforms of the application and points of access of the application even if the developer willfully disregards the signal.

(B) A developer shall not willfully disregard internal clear and convincing information otherwise available to the developer that indicates that a user’s age is different than the age bracket data indicated by a signal provided by an operating system provider or a covered application store.

(3) (A) Except as provided in subparagraph (B), a developer shall treat a signal received pursuant to this title as the primary indicator of a user’s age range for purposes of determining the user’s age.

(B) If a developer has internal clear and convincing information that a user’s age is different than the age indicated by a signal received pursuant to this title, the developer shall use that information as the primary indicator of the user’s age.

(4) A developer that receives a signal pursuant to this title shall use that signal to comply with applicable law but shall not do either of the following:

(A) Request more information from an operating system provider or a covered application store than the minimum amount of information necessary to comply with this title.

(B) Share the signal with a third party for a purpose not required by this title.

Is there a plan to comply with this new legislation, or just to amend licenses/agreements to not allow California residents?

And with other states queuing up legislation of their own (Colorado), how will Kubuntu handle this kind of demand from government entities?

[die.boer]

stumbled upon a same thread over at EOS forums , with some interesting comments ...
https://forum.endeavouros.com/t/new-...-users/78327/2

[notabug]

An extensive thread ongoing at the Linux Mint Forum
https://forums.linuxmint.com/viewtopic.php?t=464675

[Snowhog]

TITLE 1.81.9. Digital Age Assurance Act

1798.500.

For the purposes of this title:
(a) (1) “Account holder” means an individual who is at least 18 years of age or a parent or legal guardian of a user who is under 18 years of age in the state.
(2) “Account holder” does not include a parent of an emancipated minor or a parent or legal guardian who is not associated with a user’s device.
(b) “Age bracket data” means nonpersonally identifiable data derived from a user’s birth date or age for the purpose of sharing with developers of applications that indicates the user’s age range, including, at a minimum, the following:
(1) Whether a user is under 13 years of age.
(2) Whether the user is at least 13 years of age and under 16 years of age.
(3) Whether the user is at least 16 years of age and under 18 years of age.
(4) Whether the user is at least 18 years of age.
(c) “Application” means a software application that may be run or directed by a user on a computer, a mobile device, or any other general purpose computing device that can access a covered application store or download an application.
(d) “Child” means a natural person who is under 18 years of age.
(e) (1) “Covered application store” means a publicly available internet website, software application, online service, or platform that distributes and facilitates the download of applications from third-party developers to users of a computer, a mobile device, or any other general purpose computing that can access a covered application store or can download an application.
(2) “Covered application store” does not mean an online service or platform that distributes extensions, plug-ins, add-ons, or other software applications that run exclusively within a separate host application.
(f) “Developer” means a person that owns, maintains, or controls an application.
(g) “Operating system provider” means a person or entity that develops, licenses, or controls the operating system software on a computer, mobile device, or any other general purpose computing device.
(h) “Signal” means age bracket data sent by a real-time secure application programming interface or operating system to an application.
(i) “User” means a child that is the primary user of the device.

We; and I would suggest all other Linux support forums; aren't a 'Covered application store' or an 'Operating system provider' as defined. This California Bill doesn't apply to us.

[oshunluvr]

Colorado has one pending also.

[illutari]

We; and I would suggest all other Linux support forums; aren't a 'Covered application store' or an 'Operating system provider' as defined. This California Bill doesn't apply to us.

I'm not suggesting Kubuntuforums itself would be liable, but the Kubuntu team on github or Canonical itself with Ubuntu could be targeted.

California was just the beginning.

Colorado: https://leg.colorado.gov/bills/SB26-051
Illinois: https://www.ilga.gov/Legislation/BillStatus?GAID=18&DocNum=3977&DocTypeID=SB&LegId= 0&SessionID=114
New York: https://www.nysenate.gov/legislation...02/amendment/A

There's clearly a consolidated effort pushing others towards the same laws.

I saw somewhere that some Ubuntu devs were starting to investigate the possibility of how to comply with these requirements so, I guess we're all just along for the ride with whatever they choose?

TBH I really don't want my PC to be treated as an API endpoint for anybody to call, and pull data about ME. That's not the current dynamic of sharing user data now, and I don't want to support the start of that practice. Today they say it's an age requirement, tomorrow it's a name and address requirement -- this is just one more chip away at privacy and an overreach of government authority.

Not to mention, if OS's are now required to host an API endpoint so sites and apps can call and get data about the user, doesn't that mean anybody can do the same? Won't this just open any users under the age of 18 to a whole new whole of predatory targeting, both by companies and actual predators?

[claydoh]

I guess we're all just along for the ride with whatever they choose?

Pretty much. Kubuntu IS Ubuntu, it is not a separate entity.

[kernelbasher]

It's just biggest P*ss take ever