this post was submitted on 29 Aug 2026
861 points (99.9% liked)
Linux
14835 readers
1197 users here now
A community for everything relating to the GNU/Linux operating system (except the memes!)
Also, check out:
Original icon base courtesy of lewing@isc.tamu.edu and The GIMP
founded 3 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
How does that make any sense? How is the license for a piece of software relevant to verifying age? If I make a site that is objectively harmful to minors, I can just make it open-source and I'm exempt? Or, if I make a completely innocuous site that doesn't actually do anything but is closed source, I would have to comply?
But really, nothing should be doing strong identity verification outside of stuff like government (e.g. passports), or anything that commonly exploits identity for crime (e.g. major financial operations).
I think it's actually a common sense exemption comparable to things like the FMLA having a carve out for small persons with a small number of people. FOSS operating systems bring a lot of value to businesses, higher education and presumably California's government, but the many devs who make contributions that create this value on a volunteer basis could feasibly determine that they will either simply refuse to comply with it and pull these OSes from California, or that even if they did want to comply, they have an argument that compliance is simply an insurmountable burden for them to develop and maintain, in addition to maintaining the other features that actually provide the majority of the value.
On top of these, as others have pointed out, it's a trivial for a sufficiently capable user to modify an open source program to circumvent this. Furthermore, there are a ton of FOSS OSes where development is not based in California, and it would be a ridiculous waste of time and money trying to enforce the law on them. I kind of doubt Canada is going to extradite the OpenBSD devs (or at least the folks your donations to the project go to) to face trial in the US on this, for example.
In a way, it's an unusually aware law that lets legislators avoid the egg on their face of passing a toothless law when it comes to FOSS OSes, while still letting them please the "Think of the children!" crowd and squeeze more data and money (in fines) from Microsoft, Google and Apple, who will be subject to the law.
The overall goal of the law is still terrible, but the way they went about making this exception shows a rare understanding of technology for legislators, even if it was due to public backlash and relevant technical input, rather than the legislators suddenly understanding the tech they want to control themselves.
So why not target that? RHEL and Ubuntu are big corporate distros. Plenty of other big corporate software is open source too.
Because, as I already mentioned, the companies behind those distros are based in North Carolina and the UK, respectively, not California. It makes no sense for them to comply with a silly law in California, when they could just as easily rent servers outside of CA to their clients based there for whatever business needs they have, tell their clients to figure out compliance for the clients on their own, and ignore the law. Otherwise, they would have to take on the perpetual responsibility of maintaining compliance not only for their own contributions that they pack in their respective distros, but also for any upstream contributions that would be subject to these laws by upstream contributors they have no control or influence over. If some dev from Poland comes up with a great new idea for the kernel and it gets widely adopted, but doesn't comply with this law (because why would a Polish dev waste their free time adding this?), now Red Hat or Canonical would have to either forgo those new features that their clients will be hearing about, or waste time and money reviewing all these commits to make sure they don't miss any contributions that would touch on something covered by this law and updating and supporting their updates to ensure compliance.
Even if they did want to comply with the law to be able to sell their OSes in California, it would open up a huge can of legal liabilities for them that is nearly entirely dependent upon the actions and work of individuals they don't control, and they have plenty of trivial ways of circumventing California's jurisdiction if they decided doing so was the better course of action.
First off, we're talking about operating systems and not websites.
Second, if it's open source, the users can just edit out the age verification, no matter how it's implemented. And if it's open source, you simply can't prevent that behavior.
In theory, the closed source systems make that more complicated, to the point where we can "rely" on those safeguards.
There's a logic here, even if I totally disagree with the premise of the OS needing anything to do with the user's age. Parents need to parent and we've had solid enough parental controls for a long time now that make this type of monitoring and control easy.
FYI the article title (and the name of the law) are both misleading. The law does not require age verification, only age attestation.
Does that make the law even dumber? Probably, lol.