Re: On the unfortunate need for an "age verification" API for legal compliance reasons in some U.S. states

Hi,

(dropping non-Debian recipients)

I was wondering why so many US states are pushing for this legislation
instead of the federal government doing just one law and why this all
is happening in the US right now. While digging I came across this
group of anonymous researchers who claim that this is the result of
Meta lobbying for age verification on the OS side, so that the
dopamine inducing service producer would not be kept accountable or
required to have any restrictions as the they could argue that the OS
or the app store has already taken care of doing the restrictions and
policing.

I do not know if any of this is true, I am just sharing that I found
this: https://tboteproject.com/git/hekate/attestation-findings


On Wed, 11 Mar 2026 at 13:33, Jamie Null <[email protected]> wrote:
>
> I'm going to be completely honest.
>
> While following California's laws may sound like a smart idea, and it
> might be a smart idea, it's really difficult when a lot of jurisdictions
> in the world want their share of the pie while simultaneous proscribing
> the implementations of other jurisdictions.
>
> Here's a summary that I have compiled based on my readings of various
> bills.
>
> CA = California (Passed)
> CO = Colorado (Not yet passed)
> NY = New York (Not yet passed)
>
> == Age range ==
> CA: Under 13, 13-16, 16-18, >18
> CO: Under 13, 13-16, 16-18, >18
> NY: Under 13, 13-16, 16-18, >18
>
> == Availability ==
> CA: All software
> CO: All software
> NY: All software
>
> == Verification method ==
> CA: Declaration
> CO: Declaration
> NY: Actual verification (how?, Contrast: CA CO Prohibited)
>
> == Liability for tampering/incorrect input ==
> CA: Restricted liability
> CO: Semi-reduced liability
> NY: Much less reduced liability
>
> == Other weird requirements ==
> NY: Encryption (??), Retroactively requesting info, anticircumvention
> CA: Retroactively requesting info
> CO: Retroactively requesting info
>
> == Prohibited practises ==
> CA: Collecting additional information (Contrast: NY Verification)
> CO: Collecting additional information (Contrast: NY Verification)
>
> While some parts of existing bills do not contradict the bills of other
> jurisdictions, other parts do, making implementation difficult. A single
> implementation cannot accommodate both New York and CA/CO.
>
> Also, how would an open source project implement this to NY requirements
> if anyone can, I don't know, ``<packagemanager> remove
> <ageverificationpackage>, or just rebuild their OS without whatever
> script that does the age verification?