Age Verification: Exempting Linux Is Not Enough

Across the United States, state governments are debating or implementing online age-verification laws. These laws prevent users from accessing content deemed sensitive until they verify their age, often using technology that is insecure and that infringes on personal privacy. Several age-verification bills have been circulating in Congress, but none have yet passed the Senate. In the meantime, state governments have been enacting their own age-verification frameworks, California being the most prominent example. California has the largest economy of any U.S. state, and it’s not a close race. Because of the sheer weight of California’s economy, most companies would rather build a single product that meets California’s requirements than maintain a separate version for every other state. The result is that when California adopts a law, the rest of the country effectively follows suit.

In many ways, California’s approach to age verification respects users’ privacy far more than alternative methods do. California requires users to enter their age bracket when they first set up an account on a device. Websites then query the user’s age bracket before serving any content. This mechanism is a much better solution for preserving anonymity than, say, uploading a face scan or a photo of a government ID. Still, online trackers are incredibly sophisticated, and adding an age bracket to each browsing session gives them an even clearer picture of who is behind the screen.

Fortunately, following lobbying from open-source advocates, California’s legislature has decided to exempt open-source operating systems, such as Linux, from the requirement to collect users’ age brackets. But this misses the point entirely. Under age-verification law, web providers must classify their content by sensitivity level. This is not a fixed category the way “alcohol” or “tobacco” is; it is an open-ended classification that each provider must define and that any future legislature can expand. This necessarily creates a two-tiered internet, one in which information is censored by default until a user engages with an age-verification mechanism. If a site hosts content deemed sensitive and a Linux user accesses it, the site will default to serving the most heavily censored version of that content, because the site is unable to verify the user’s age. This compels users to engage with age-verification mechanisms even when their operating system is exempt from the law.

Rather than blocking entire categories of content, such as pornography, California’s law targets how content is delivered to users identified as minors via their age bracket and what data is collected from them. Separate from AB 1043, the Protecting Our Kids from Social Media Addiction Act (SB 976) and the California Age-Appropriate Design Code Act (AB 2273) require web hosts to reduce the addictive and manipulative design patterns of their content-delivery algorithms unless a guardian grants explicit permission. With the legal precedent set and the verification infrastructure already built, other states now have both the authority and the tooling to compel web hosts to restrict access to content beyond what California itself requires. A video of two men holding hands is not, by any reasonable standard, sensitive content. But in a system where the ‘sensitive’ category is open to legislative reinterpretation, any content whose visibility is politically contested becomes a candidate for reclassification.

Exempting open-source operating systems is not good enough. Age-verification law establishes a two-tiered internet in which information is censored by default. Every state that adopts such a law widens the gap between the content a user is permitted to see and the content that is actually there.