California's Age Verification Bill Passes with Linux Exemption Intact (linuxiac.com) 117
California's age-verification bill has passed in its legislature — but with its open-source carve-out intact, reports the blog Linuxiac:
Back in May, we reported that California lawmakers amended Assembly Bill 1856 to carve open-source operating systems out of the state's upcoming age verification requirements. Three months later, that exemption survived the legislative process intact, and the bill has cleared both chambers of the California Legislature... sending the measure to Engrossing and Enrolling, the final legislative preparation stage before it can be presented to Governor Gavin Newsom...
For operating systems that are covered, AB 1856 builds on California's Digital Age Assurance Act, which is scheduled to take effect on January 1, 2027. Under the current text, when an operating system runs on a device and includes an account setup feature, its provider must offer an interface that asks the account holder for the birth date, age, or both, of the device's primary user during account setup. The operating system must then be capable of providing a digital age signal to covered application stores and application developers through a reasonably consistent real-time API. Instead of exposing a precise birth date, the signal identifies one of four age ranges: under 13, 13 through 15, 16 through 17, or 18 and older... Covered application stores must request the signal from the operating system and make it available to developers.
For operating systems that are covered, AB 1856 builds on California's Digital Age Assurance Act, which is scheduled to take effect on January 1, 2027. Under the current text, when an operating system runs on a device and includes an account setup feature, its provider must offer an interface that asks the account holder for the birth date, age, or both, of the device's primary user during account setup. The operating system must then be capable of providing a digital age signal to covered application stores and application developers through a reasonably consistent real-time API. Instead of exposing a precise birth date, the signal identifies one of four age ranges: under 13, 13 through 15, 16 through 17, or 18 and older... Covered application stores must request the signal from the operating system and make it available to developers.
WSL for the win (Score:5, Insightful)
Dear god, politicials are ignorant.
Re: (Score:1)
How is the World Surf League involved? https://www.worldsurfleague.co... [worldsurfleague.com]
Re: (Score:1)
Not really, they just reflect the ignorance of the voters that reelect them.
Re: (Score:3)
Don't even need WSL. The exception wasn't for "Linux", it was for "GPL, BSD, MIT" and some other licenses. Yeah, just license things as close-sourced BSD/MIT, and you're all good!
Re: WSL for the win (Score:2)
I don't understand the government here.
https://planet3dp.com/legislat... [planet3dp.com]
Among other things, California will effectively ban open source slicers like orcaslicer, require locked bootloaders, ban "jailbreaking" them, etc.
You think we won something? (Score:5, Insightful)
Re: You think we won something? (Score:2)
You realize they'll get your birthdate within a day or two as you transition into a new group. Maybe on a service or two it takes a couple of weeks to update, but it's still close enough.
Once a feature becomes available to you at an age change you're going to want to transition to that group as soon as possible.
Re: (Score:3)
The OSS exception prevents something being taken away. That is a win, even if we did not win something.
My hope is that tons of teens will find out how actually easy installing and using Linux is.
Incidentally, Windows "infrastructure" is NOT ready for standardization at all. Too insecure, too unreliable and no 2nd source.
Re: (Score:2)
And what is that something?
All the OS age verification stuff does is avoid the third party age verification systems currently in place for things like Discord and other stuff. If you use Windows, macOS, iOS, or Android, the age verification can be done via an attestation from the OS. All the Linux exception does is not require Linux to support it.
That means a Linux user wanting to use Discord and accessing
Re: (Score:2)
And what is that something?
Is that a serious question? Do not be a child. Think before you post.
Re: You think we won something? (Score:1)
He did think... his post laid out a plausible chain of consequences stemming from the legislation. Maybe it's right or maybe it's wrong, but he added something to the conversation instead of resorting to name-calling.
Re: (Score:2)
Nope. He used a cheap rhetoric manipulation trick of pretending something was not clear. I called him out on it.
Re: (Score:2)
That "something" is the difference between getting KO'd by a hook to the jaw and taking it on the shoulder. They took a shot, the defensive tactic worked and the fight is still on. Good time to start thinking of counter-punches, maybe come up with a strategy to win instead of going on about how we should have just thrown the fight.
Re:You think we won something? (Score:4, Insightful)
The exception only gives websites and other software a way to break if you insist on using Free Software. Every malicious bot, every child predator, every last bad actor is going to pretend to be Free Software, and people needing to comply with the law are simply going to block everything that isn't made by Google, Microsoft, or Apple. The reason that this got through the legislature is that it is the opposite of a win for Free Software, it is a devastating loss.
The commercial software vendors are going to create a framework that is going to insist on software signed by one of them to be "legitimate," and everyone that needs this verification to meet the standards of the law is going to simply block traffic that doesn't provide it. Free Software will still technically be legal, but it won't interoperate, and so it won't be usable.
You can see a bit how this works with Google Chrome on Linux. It mostly works great, until you need to watch something that requires Widevine, and then it either doesn't work at all, or it works with artificially reduced functionality. This is not because Chrome on Linux is less secure, or less capable, but rather because it is different. This isn't stopping piracy, the streams still escape. In fact, there are streaming services that I don't pay for, despite wanting to watch their content, simply because I would have to boot into something besides Linux to use their service, and the extra work isn't worth the hassle.
The difference is that this law is going to cover essentially every service that we want to use on the Internet. Every website, every app, every service with accounts that wants to be able to do business in California (and that's basically everyone), is going to require this age verification. Not only are they going to get in trouble if they don't get this information, but they actively want the information so that they can use the information to sell to advertisers. These operations aren't going to work on a non-validated code path. They are simply going to require commercial software verification and block everything else. It is not only the path of least resistance, it is the path of greatest profit.
No where does the law require that services work equally well without age verification. No where does the law say that the standard has to be open and implementable by Free Software. The reason that this exception stayed in the final bill is that the commercial software vendors saw this and realized that if they were going to be forced to build this API they could at least use it as an opportunity to shoulder out their competition for the long term.
Heck, this doesn't just work against Free Software. It is going to work against any newcomer to the party. Anyone creating a new device is going to have to use negotiate to use software blessed by Microsoft, Apple, or Google, because website and application operators are going to be skeptical of anything else. Anything else is going to look like a bot, or an attack, or some other bad actor.
Re: (Score:3)
Except that now, not providing the age bracket signal will itself be a signal. This could be the beginning of a new way of information on the web being specifically refused to people on open source operating systems.
Re: (Score:2)
And that is exactly why this exception is good. It provided precedent.
Re: (Score:2)
Except that now, not providing the age bracket signal will itself be a signal. This could be the beginning of a new way of information on the web being specifically refused to people on open source operating systems.
Imagine, a web free of Facebook, Twitter, Discord and their ilk. Sign me up!
Re: (Score:2)
Most teens won't care if the State knows their age. They just wanna use the computer to play their Fort Knights and their Tick Tocks. They're being frog-boiled into this new reality and won't put up much of a fight when Big Brother finally goes elbow-deep into their personal business.
Linux distro from the Microsoft Store (Score:2)
My hope is that tons of teens will find out how actually easy installing and using Linux is.
They will learn how easy it is by using the Windows Subsystem for Linux and downloading a Linux distro off of the Microsoft Store. No need to compromise anything, you get Windows and Linux on the same desktop.
Re: (Score:2)
The companies in question are going to get in serious legal trouble if they fail to comply in verifying the ages of their users. Microsoft, Google, and Apple are all going to give these companies an API that will move that burden from themselves to the makers of the operating system. Discord, to use an example, will be able to say that they asked Microsoft, Google, and Apple to verify ages, and then that they relied on the information that they were given. What's more these companies actually want to kno
Re: (Score:2)
"Most sites" have no reason to do age verification.
It's obvious that people are arguing about this without actually saying what their personal interest is.
Are this many people afraid they won't be able to get their discord porn channels because mom won't let them borrow her credit card?
The non-porn situations all involve privacy-raping social media that already knows more about their users than the users know about themselves.
"The gubermint is going to find out I exist!" doesn't seem like an honest argument
Re: (Score:2)
You are entirely correct. I took another look at what the law actually required and I am definitely crying wolf (at this point). Thanks for taking the time to point this out to me.
There is definitely a slippery slope there, but I agree with you, California is far enough away from the event horizon of that slope that my histrionics are not warranted. Not only that, but the carve out for Linux actually is helpful. Thanks once again.
Re: (Score:2)
Can we just vote the bastards out? Please? It would also help if we could permanently attach scarlet letters that would essentially make them un-electable in the future.
Re: (Score:2)
Its an age bracket now. In three years the owned media will start pushing "accurate age information would have prevented this", in 10 years it will be a left vs right thing. ...
Or, at least, they'll push for more age brackets other than just, "under 13, 13 through 15, 16 through 17, or 18 and older" as well as other characteristics to better align with common marketing demographics... For example, from A definition of demographic segmentation and how to use it [apteco.com]
Age: 8-24, 25-34, 35-44, 45-54, 55-64 and 65 and above. ...
Gender, Income and occupation, Ethnicity and religion, Family info
Always remembering that we're the product ... /s
Redhate (Score:1)
Redhat will be subject to this requirement because their license places additional restrictions on the GPL and they are therefore in violation and have no right to use the code covered by that license
Re: (Score:3)
Their distro is by far the worst to use anyways. Broken in so many ways.
Re: (Score:2)
Their distro is by far the worst to use anyways. Broken in so many ways.
Now, now. Be fair. Ubuntu works really hard to leapfrog them from one release to the next in the worst to use department. And I think it's high time we all recognize that supreme effort.
Re: (Score:1)
I have not used Ubuntu in a long, long time, due to numerous problems and shortcomings. Hence I am not surprised they have regressed further.
Re: (Score:2)
Re: (Score:2)
But Unity is gone now
Unity was a symptom, not the disease.
Re: (Score:2)
Re: (Score:2)
Re: Redhate (Score:1)
The kernel is not the operating system, only part of it. As long as Google is keeping parts of their system closed it makes legal sense to subject them to the requirement. As long as they are putting a lot into play services...
Re: (Score:2)
It doesn't really matter. The base Android OS isn't covered, but that doesn't matter for most users because the developer entity that actually compiled the device's OS is either the hardware manufacturer or the service provider, and the user isn't permitted to modify and redistribute the images provided to them.
Re: (Score:2)
Redhat will be subject to this requirement because their license places additional restrictions on the GPL and they are therefore in violation and have no right to use the code covered by that license
The law does not contain any such language, things like Redhat Linux and SteamOS are fine. (Though steam's client app would be covered as an app store)
The actual language it uses is:
Operating system provider does not mean a person or entity that distributes an operating system or application under license terms that permit a recipient to copy, redistribute, and modify the software.
It doesn't say anything about the GPL, license compliance, or that the license terms may not have restrictions.
Excellent (Score:2)
Nothing better to make kids install and use Linux than denying them social media otherwise!
Re: (Score:2)
finally, the year of linux on social media!
Re: (Score:2)
If that happens, at least one good thing would have come out of social media ...
Re: (Score:2)
Social media sites are going to get in trouble if they can't verify ages, and they want the age information so that they can sell it to advertisers. Microsoft, Apple, and Google are going to create APIs that the various services are going to trust. If your alternative implementation of the API response isn't signed by a key controlled by Microsoft, Apple, or Google it will be blocked outright. This loophole is not a victory, it is a huge defeat.
These operations can get in actual legal trouble if they d
Re: (Score:2)
We (the residents of California) believe you, but the politicians/lobbyists don't.
Witness the real time collapse of our film industry.
The continuing damage from AB 5.
(see:
Trucking and Shipping Latest Victims of Californiaâ(TM)s âoeCruelest Law,â AB 5
https://www.pacificresearch.or... [pacificresearch.org] )
The 3d printer regulation bill (although we're just the latest state proposing this)
And the billionaire tax proposition.
The irony is if/when California does truly start running into difficult problems (all it tak
Don't you hate it (Score:3)
"the birth date, age, or both,"
When a form (either paper or online) asks for your age, date of birth, and todays date.
Surely they can do the maths
Re: (Score:3, Funny)
It's the same shit porn sites asked kids in the 1990s. "What is your date of birth".
Yes sir, I was born on january 1st 1970. Now let me the see the titties.
Re: (Score:2)
They asked my operating system that question. It checked it's clock and this is how it answered.
So it got a bit mixed up with the semantics of who the "you" in "your date of birth" is.
Re: (Score:2)
Re: (Score:2)
It violates the law to request the age signal when you're not required to by law, so for most sites blocking users for not having it would be a big red flag that they're in violation.
So "a lot of sites" still mostly means porn sites.
There is nothing in the law that prevents open source browsers from providing the signal api.
Re: (Score:2)
Surely they can do the maths
Usually that kind of thing is not about doing math and more about validating inputs.
Dual purpose age-bracket signal :o (Score:1)
Re: (Score:3)
No. It is data with pretty low information content. You need a _lot_ more to do tracking.
Look, I do not like this law one bit, but pushing alarmist misstatements is not the way to fight it.
Re: (Score:3)
Re: (Score:2)
Re: (Score:2)
I suspect the vast majority of us are just as fine with lying to Microsoft as we are with lying to Facebook. And as a privacy freak myself, the law itself honestly sounds about as tame as we could have hoped for (short of no law at all); but almost guaranteed Microsoft / Apple / OEMs are already rubbing their hands together and cackling with evil glee over having not just an excuse, b
Re: (Score:2)
Re: (Score:2)
Your problem is functional illiteracy, combined with arrogance. Read the story again. DOB is _not_ transferred. Incidentally, your quote, which you apparently do not understand, strengthens my argument. And, FYI, I do did GDPR audits for a few years. I know what I am talking about instead of the mindless and harmful panic you are trying to spread.
Re: (Score:2)
First, those age brackets are necessarily dynamic or the OS would be out of compliance the day after installing - Because y'know, people tend to age one day per day, at least until we have space stations orbiting Sgr-A*.
And second, if you visit Facebook the day before you turn 18 and the day after, whaddya know, they magically now know your actual birthdate without ever needing to be explicitly told. This ain't rocke
Re: (Score:2)
If the website keeps track of when you transition from one bracket to the next, they what your birthday is.
Re: (Score:2)
It's against the law for sites to request the data when not required by law to do age verification.
If we're talking about social media apps, they get everything by having your device ID and contacts list. They know exactly who you are and what your real age is.
If we're talking about porn sites, the only way they'd ever see a transition of age category is if you're trying to use the site every day before you're allowed and being rejected, then finally on your 18th birthday it lets you.
It seems more likely th
Re: (Score:2)
And I'll be sure to let the offshore scammers know it's illegal, I'm sure they'll be quaking in their boots.
Re: (Score:2)
No. It is data with pretty low information content. You need a _lot_ more to do tracking.
And the legislators somehow make the blatant assumption that forcing computers to announce "The user of this computer is underage" when queried would never be used by bad actors to more directly focus their attention on individuals identified as children.
Re: (Score:2)
I'd hardly call exact date of birth "low information content".
And yes this does reveal exact date of birth, regardless of the bullshit obfuscation that it supposedly only reports age range. The server simply tracks the reported result every time the user connects, and on some specific day the result CHANGES to announce their date of birth.
-
A N D R O I D ?? (Score:2)
AFAIK Google's Android OS is based on Linux and may fall under the exemption. I suspect there are people trying to enforce the GPL2 surouce-code obligation against Alfabet. Apple's iOS is based on Net?BSD, can be closed but may or may not meet the legal definition.
Re: (Score:2)
Well, does the bill make the carve-out based on the underlying kernel or the actual OS running on top of it?
It's true the Android is based on the AOSP kernel, but Android (the parts that the user actively interacts with) is definitely not open source.
Oh the forked future... (Score:2)
They know it's a bad Bill (Score:2)
You got a lot of bad laws like this because voters are dumb and they don't pay a lot of attention to politics and we don't teach them things like this.
Re: (Score:3)
You got a lot of bad laws like this because voters are dumb and they don't pay a lot of attention to politics and we don't teach them things like this.
I'm with you right up until "and we don't teach them things like this." If we've learned anything from the birth of the internet, it is that knowledge and the availability of information are weakly correlated, at best.
Re: They know it's a bad Bill (Score:2)
You're confusing teaching with making information available.
Public schools generally do not teach critical thinking and only limited problem solving.
Re: (Score:2)
It's not meant to be a useful law it's meant to be a trap during the midterm campaigns. Anyone who votes against it is going to get a bunch of ads about how they put children in danger dun dun duuuun!
You got a lot of bad laws like this because voters are dumb and they don't pay a lot of attention to politics and we don't teach them things like this.
As a Californian, I definitely would NOT have voted for this had I been given the opportunity.
And yeah, we LITERALLY have campaign ads running now to the extent of, "Pedophile murderers are being released to the streets ... and Candidate X voted for it THREE TIMES!!!!"
Re: (Score:2)
Anyone who votes against it is going to get a bunch of ads about how they put children in danger dun dun duuuun
That's actually so true. Those bastards, regardless if they voted for or against, they just want a piece of their opponent's blood. They don't really give a shit about the subjects that were supposed to be protected by those laws.
If we're wondering why (Score:3)
Three in five Americans favor stronger oversight of social media companies, Reuters/Ipsos poll finds [yahoo.com]
Americans want kids shielded from the internet. They don’t trust websites or the government to do anything about it [fortune.com]
So, you want a realistic, down to earth show, that's completely off the wall and swarming with magic robots?
On a more serious note this is the result of any lack of legislative progress on a national ID or any better way to identify people online so instead we have an unenforceable patchwork of standards and now we'll have an unenforceable patchwork of state laws on top of that. What a mess.
Re: (Score:2)
The USA has national ID, it's called a passport. (Real ID was supposed to be a national ID, but it's been watered down so that it effectively isn't one.) The passport or passport card is the gold standard of ID because it verifies both nationality and citizenship.
The USA also has national online ID verification, it's called ID.me. It's shit, but it exists.
Re: (Score:3)
25 years after 9/11 my state has started to issue real ID cards. All the 9/11 hijackers had legitimate identification to begin with. I feel safer already.
Re: (Score:2)
Exactly, a passport is insufficient as an actual ID as DLs are used today for a number of reasons and real ID is still all state level patchworks, thus it's watering down. Also all of those are still not universal as they require outlays of money, any actual system will have to contain new funding and be free to obtain, that's the only way to make it actually mandatory.
ID.me is also a private entity which makes it a total non-starter for an actual national level usage.
An actual solution to this issue is go
Re: (Score:3)
Exactly, a passport is insufficient as an actual ID as DLs are used today for a number of reasons
The passport is more than sufficient as an actual ID. It is sufficient for ID in all situations. The Driver's License verifies the right to drive, and the ID at the state level. It's the driver's license which is insufficient as an ID, not the passport. The passport always verifies identity.
ID.me is also a private entity which makes it a total non-starter for an actual national level usage.
Welcome to capitalism.
Re: (Score:2)
It is not, it's too complex to obtain, too expensive currently (it would have to be made free) and was just never intended to be used that way. DLs were not either but they are already more sufficient, most places can verify a DL but only airlines and travel places are equipped to use a passport.
If we want to go that route it will require a bunch of funding because there are plenty of citizens who don't have the funds or necessary info to obtain a passport. Every try to get a new birth certificate in Amer
Re: (Score:2)
Using passport as national ID is common and you could have just googled it to find out like I did https://en.wikipedia.org/wiki/... [wikipedia.org]
Re: (Score:2)
And if you read that you'd see the majority keep those separate. Example in the EU only one nation uses passport as national ID (Ireland)
Re: (Score:2)
Traci Lords used a driver's license to get her first job.
Re: (Score:2)
We now have a Real.ID tacked onto your state ID which since I don't fly or enter government buildings, have never needed. ID.ME sounds sketchy since it is a third party handling it, but like it or not I may need one soon just to access US Treasury Bonds in a month or two.
Re: If we're wondering why (Score:2)
Real ID is all but worthless outside of an airport. For example ICE doesn't accept it.
Re: (Score:2)
The passport isn't a national ID. There are still plenty of people that live in the US legally who cannot get a US passport.
Re: (Score:2)
The legal immigrants all need a passport to get in. Not a US passport but a passport nonetheless.
Re: (Score:1)
Um... so... good? I'm all for bureaucratic bullshit preventing the government from taking away our rights and increasing surveillance. Unfortunately this isn't all that true as the government will just contract all this out from the privat
Re: (Score:2)
I'm all for bureaucratic bullshit preventing the government from taking away our rights and increasing surveillance.
How is having a national ID taking away your rights? Do you have a SS card? A passport? Are you the type of person who wants VoterID as well?
they can probably afford to homeschool.
And that's how you add a 3 of the 5.
Re: If we're wondering why (Score:2)
We should not need a national ID. State IDs should be fine. There is no reason they should be a problem.
Re: (Score:2)
They could but then why do so many other nations have National ID then? Is our system of using Social Security as a stand-in suitable and secure?
Re: (Score:2)
No, and in fact we should never have used SSNs for anything but social security and taxes.
Other nations presumably have National ID because they don't leave so much up to states. States are actually relevant here.
Re: (Score:2)
The reason SSNs get used for everything is because of the lack of any other national ID since the states each do things slightly differently. All our credit ratings are tied to SSNs and not state DLs. It helps a lot of things to have a national standard of identification, particularly in today's age of the internet.
On that same note I can just as easily justify the statement that state driver's licenses should have never been used for anything besides driving.
Re: (Score:2)
State driver's licenses exist, at least today and for decades (as long as I can remember is itself, alas, a significant number of those now — but longer than that) alongside state ID cards which resemble them and perform the same function.
SSNs were never intended to be used for anything else, and should not have been. But here we are with allegedly non-social credit scores.
Re: (Score:2)
SSNs were never intended to be used for anything else, and should not have been.
I agree with this and most people do and yet here we are, I even had to give it to the government itself when I applied for Precheck. Something is clearly lacking and so far the attempt to patchwork make state IDs the replacement by all accounts has not worked.
Re: (Score:2)
you're not "hiding" or "tricking anyone" by not having a national ID. The government knows who you are...
So we forgo all the logistical advantages of such a thing even though the negative consequences have already happened according to you. This isn't a very compelling argument.
Re: (Score:2)
Do you think the process of using SSNs for identification is good, secure and sufficient for a modern world?
What is the point of one? If you can't imagine that then why have the conversation, you should be able to steel man my argument here otherwise you have no argument against it.
Re: (Score:2)
Where did I say anything about that?
You didn't have to, that's the current system so any potential national ID has to be compared against what we do now.
Only reason is to track elections better so the States can't cheat. But you clearly don't want to stop that. So why do you need a national ID?
If that's your steelman then this is not a serious discussion. Post back under a real username if you want a real argument, I am not giving an AC effort, I don't respect you.
There was no way to get rid of the exemption (Score:2)
The whole thing would have failed otherwise, because it would have effectively outlawed (F)OSS Operating Systems. That cannot be constitutional.
Is Android exempt? (Score:2)
Personally (Score:2)
I would rather see all Social Media abolished entirely before mandating that everyone provide
a very trackable ( and you know it will be ) ID just to utilize the internet.
They can claim this is about keeping the children safe all they like but we all know it's total
bullshit.
Re: (Score:2)
They need to be smarter (Score:2)
the signal identifies one of four age ranges: under 13, 13 through 15, 16 through 17, or 18 and older
This is still not good enough, it's actually gonna make things worse
The app is supposed to be rated with age that it's appropriate for. Then it can only get ONE signal: Yes or No on the age check. Revealing something like 16-17 still becomes someone's target, and God forbids if they decide to do something with that. It's even MORE dangerous than without age check because they'd have no clue how old a user is and may have to refrain due to that uncertainty.
Complete moronic (Score:2)
Re: Complete moronic (Score:2)
Re: Complete moronic (Score:2)
This is good (Score:2)