Re: Age Verification laws

--Sig_/=q3No/TQT4VdNIYC_OOX/.J
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

On Mon, 2 Mar 2026 11:25:06 -0500
Lucas Holt <[email protected]> wrote:

> Hello,
> I'm the MidnightBSD project lead.=C2=A0 I've been trying to make sense of
> the age verification law passed in California and up for discussion
> this week in Colorado.
>=20
> My interpretation of this law is that it needs to be implemented at
> the adduser flow, not just for X11/Wayland use.=C2=A0 There were likely
> need to be standard hooks somewhere for GUI apps to get it
> consistently across operating system implementations but likely some
> of us will be rushed to implement something to comply.
>=20
> Here's the current plan I've developed. It's still a draft and has a
> few issues, particularly with the group membership
>=20
> https://docs.google.com/document/d/1_NKq0bpN1pOrMpHePuilJY7saXqXqhss6LwPT=
C6nSto/edit?usp=3Dsharing
>=20
> I am interpreting app store to also include package repositories and=20
> thus package manager integration is also needed.
>=20
> I think the california law would not require actually storing the age
> or date of birth, just the ranges.=C2=A0 However, I've been told that some
> other states have laws that would require DOB so this plan includes
> that, although I've not had time to confirm it yet. I've only looked
> at CA and CO laws.
>=20
> Apologies for the new thread, I just subscribed after someone pointed=20
> this was being discussed.
>=20
> Lucas Holt
> [email protected]
> ________________________________________________________
> MidnightBSD.org (Free OS)
> JustJournal.com (Free blogging)

I'm curious why you believe it needs to be implemented in adduser.
AFAICT, it likely does need to be present on systems even without a GUI
(or with a non-standard GUI), but D-Bus can work in non-GUI
environments.

While it's possible some states may require giving a date of birth, do
they require *storing* it? The original design I proposed provided the
APIs but left storage up to the individual implementation (this is of
critical importance to Whonix, which cannot store a date of birth on
disk due to fingerprinting concerns). If the only information that
needs to be returned from the API is an age bracket, is it enough to
accept a date, turn it into an age bracket, and then store only that?

Some users in the thread have claimed that an age verification API such
as this would be illegal under other laws even though it's required by
some, so it may be essential to allow the feature to be turned off in
some manner (probably not as obvious as a "turn this off" button, but
others have suggested asking the user where they are located).

The law passed by California doesn't explicitly mention age-gating
content that I can see, it does explicitly mention exposing the user's
age bracket to developers so they can refrain from collecting data they
aren't legally permitted to collect. This is the primary reason I
proposed something based on D-Bus; it's probably the easiest thing for
web browsers to integrate with given that they already integrate with
other D-Bus services. Mediating access through a file on disk or a
bespoke daemon could be problematic for sandboxed applications (one
user in the thread mentioned that files can be passed through to
sandboxed apps, but to me that sounds very clunky and like it may go
wrong or expose more data than should be exposed). I don't know what
MidnightBSD's sandboxing situation looks like, so maybe this isn't a
concern for you.

I do like the idea of taking inspiration from Apple's implementation.
They seem like they're the most likely people to get it right.

Apologies if a lot of what i just said makes no sense in the context of
BSD, I'm not much of a BSD user.

--
Aaron

--Sig_/=q3No/TQT4VdNIYC_OOX/.J
Content-Type: application/pgp-signature
Content-Description: OpenPGP digital signature

-----BEGIN PGP SIGNATURE-----

iHUEARYKAB0WIQS8QsiCjFi4DcDBX+Q5rdye4jrrCAUCaaYvbwAKCRA5rdye4jrr
CKP8AQCJ4+PjN5DW6YmMxreVQlkt9mHWXbnrHesB9VD709YgOQEAnYjJTz2H2XjS
q00h+rrfU4cYWC4/dUbefseAOTlVywA=
=gfR8
-----END PGP SIGNATURE-----

--Sig_/=q3No/TQT4VdNIYC_OOX/.J--