Re: Age Verification laws

This is a multi-part message in MIME format.
--------------lhzJNy2JD0ASqGITKTy2WLau
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit


On 3/2/26 7:46 PM, Aaron Rainbolt wrote:
> On Mon, 2 Mar 2026 11:25:06 -0500
> Lucas Holt<[email protected]> wrote:
> I'm curious why you believe it needs to be implemented in adduser.
> AFAICT, it likely does need to be present on systems even without a GUI
> (or with a non-standard GUI), but D-Bus can work in non-GUI
> environments.
>
> While it's possible some states may require giving a date of birth, do
> they require *storing* it?

regarding adduser:


            1798.501.

  (a) An operating system provider shall do all of the following:
(1) Provide an accessible interface at account setup that requires an 
account holder to indicate the birth date, age, or both, of the user of 
that device for the purpose of providing a signal regarding the user’s 
age bracket to applications available in a covered application store.

Account setup for a MidnightBSD installation is going to happen when the 
OS is installed or after it's installed.  During install, the adduser 
flow is used. Thus, we need it added there. The law doesn't say it only 
applies to GUIs.  In fact it defines as " “Application” means a software 
application that may be run or directed by a user on a computer, a 
mobile device, or any other general purpose computing device that can 
access a covered application store or download an application."  I can 
download an app in lynx on a system console.  I can download an app 
using mport package manager (or apt, yum, pacman or whatever on linux)  
On linux, package managers are shared by several distros so folks in 
that ecosystem need to agree on how that is handled.  On MidnightBSD, we 
have our own package manager as well as Ravenports.  Then there's the 
question if it applies to npm, pip, cargo, ...

 From my perspective as an OS provider, I need to comply with setting 
the age on account creation, the "covered app store" likely would apply 
to package installation with repositories thus my package manager needs 
changes, and then the application level. On this list, folks are focused 
on the application level and that's fine.

My assumption is that different operating systems are going to implement 
this in different ways and provide some mechanism for checking it.  That 
variation is then going to be exposed with some "common" library or 
software such as dbus or whatever that makes it generic for web browsers 
to use.  (at least I hope so)

This law was clearly written around how Microsoft, Apple and Google 
manage downloads for phones or their systems.  They have apple id, 
microsoft accounts, etc to manage users. However, for most *NIX systems, 
we only have local accounts or ones managed by LDAP.   In order to 
comply, we must store it locally.

The missing parts are that california has another related law that 
defines the content pieces and that other states have suggested that DOB 
should be stored, although I don't think that's law yet. (Texas i 
believe)   California and Colorado are asking for age or DOB as input 
and providing ranges as output.  Technically I don't think we need to 
retain the age to comply but we do need to be able to provide range 
checks.  The issue is what other horrible law gets passed next.  We may 
need to know the DOB or age for that.

I'm not a lawyer and I don't know how privacy laws in other regions 
would apply to storing DOB or age.  Combined with a user account which 
make have a name on it, it would be PII in my book. That should put up a 
red flag for any developer.

Had I written this law, I would have specified it was for consumer 
devices only and clearly defined app store.  The intent is likely to 
just block downloads of adult titles, violent games and so on from kids 
as well as for web browsers to provide to sites.  It's not scoped that way.

-- 
Lucas Holt
[email protected]
________________________________________________________
MidnightBSD.org (Free OS)
JustJournal.com (Free blogging)

--------------lhzJNy2JD0ASqGITKTy2WLau
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 8bit

<!DOCTYPE html>
<html>
  <head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
  </head>
  <body>
    <p><br>
    </p>
    <div class="moz-cite-prefix">On 3/2/26 7:46 PM, Aaron Rainbolt
      wrote:<br>
    </div>
    <blockquote type="cite" cite="mid:[email protected]">
      <pre wrap="" class="moz-quote-pre">On Mon, 2 Mar 2026 11:25:06 -0500
Lucas Holt <a class="moz-txt-link-rfc2396E" href="mailto:[email protected]">&lt;[email protected]&gt;</a> wrote:
</pre>
      <pre wrap="" class="moz-quote-pre">
I'm curious why you believe it needs to be implemented in adduser.
AFAICT, it likely does need to be present on systems even without a GUI
(or with a non-standard GUI), but D-Bus can work in non-GUI
environments.

While it's possible some states may require giving a date of birth, do
they require *storing* it? </pre>
    </blockquote>
    <p>regarding adduser: <br>
    </p>
    <div
style="color: rgb(0, 0, 0); font-family: Verdana, sans-serif; font-size: 14px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: justify; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; white-space: normal; background-color: rgb(254, 254, 254); text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial; margin: 0px 0px 1em;">
      <h6
style="font-size: 1.1em; line-height: 1.3em; margin-top: 0.909em; margin-bottom: 0.909em; display: inline;">1798.501.</h6>
       (a) An operating system provider shall do all of the following:</div>
    <div
style="color: rgb(0, 0, 0); font-family: Verdana, sans-serif; font-size: 14px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: justify; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; white-space: normal; background-color: rgb(254, 254, 254); text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial; margin: 0px 0px 1em 1em;">(1) Provide
      an accessible interface at account setup that requires an account
      holder to indicate the birth date, age, or both, of the user of
      that device for the purpose of providing a signal regarding the
      user’s age bracket to applications available in a covered
      application store.</div>
    <p>Account setup for a MidnightBSD installation is going to happen
      when the OS is installed or after it's installed.  During install,
      the adduser flow is used. Thus, we need it added there. The law
      doesn't say it only applies to GUIs.  In fact it defines as " <span
style="color: rgb(0, 0, 0); font-family: Verdana, sans-serif; font-size: 14px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: justify; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; white-space: normal; background-color: rgb(254, 254, 254); text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial; display: inline !important; float: none;">“Application”
        means a software application that may be run or directed by a
        user on a computer, a mobile device, or any other general
        purpose computing device that can access a covered application
        store or download an application."  I can download an app in
        lynx on a system console.  I can download an app using mport
        package manager (or apt, yum, pacman or whatever on linux)  On
        linux, package managers are shared by several distros so folks
        in that ecosystem need to agree on how that is handled.  On
        MidnightBSD, we have our own package manager as well as
        Ravenports.  Then there's the question if it applies to npm,
        pip, cargo, ... </span></p>
    <p>From my perspective as an OS provider, I need to comply with
      setting the age on account creation, the "covered app store"
      likely would apply to package installation with repositories thus
      my package manager needs changes, and then the application level. 
      On this list, folks are focused on the application level and
      that's fine.   </p>
    <p>My assumption is that different operating systems are going to
      implement this in different ways and provide some mechanism for
      checking it.  That variation is then going to be exposed with some
      "common" library or software such as dbus or whatever that makes
      it generic for web browsers to use.  (at least I hope so)  </p>
    <p>This law was clearly written around how Microsoft, Apple and
      Google manage downloads for phones or their systems.  They have
      apple id, microsoft accounts, etc to manage users. However, for
      most *NIX systems, we only have local accounts or ones managed by
      LDAP.   In order to comply, we must store it locally.  <br>
      <br>
      The missing parts are that california has another related law that
      defines the content pieces and that other states have suggested
      that DOB should be stored, although I don't think that's law yet. 
      (Texas i believe)   California and Colorado are asking for age or
      DOB as input and providing ranges as output.  Technically I don't
      think we need to retain the age to comply but we do need to be
      able to provide range checks.  The issue is what other horrible
      law gets passed next.  We may need to know the DOB or age for
      that.  </p>
    <p>I'm not a lawyer and I don't know how privacy laws in other
      regions would apply to storing DOB or age.  Combined with a user
      account which make have a name on it, it would be PII in my book. 
      That should put up a red flag for any developer.</p>
    <p>Had I written this law, I would have specified it was for
      consumer devices only and clearly defined app store.  The intent
      is likely to just block downloads of adult titles, violent games
      and so on from kids as well as for web browsers to provide to
      sites.  It's not scoped that way.</p>
    <pre class="moz-signature" cols="72">-- 
Lucas Holt
<a class="moz-txt-link-abbreviated" href="mailto:[email protected]">[email protected]</a>
________________________________________________________
MidnightBSD.org (Free OS)
JustJournal.com (Free blogging)</pre>
  </body>
</html>

--------------lhzJNy2JD0ASqGITKTy2WLau--