Age verification online used to be a website problem. You’d hit a “confirm you’re 18” screen on a specific site and that was that. A new set of US state laws takes a different approach: they push the job down into the operating system. When you set up a computer or phone, the OS would record an age bracket and pass it to app stores and, in some cases, websites.
In March 2026, System76, the company behind Pop!_OS and one of the best-known Linux hardware makers, published a response from its CEO, Carl Richell. It became one of the most-discussed Linux stories of the year, because it spelled out what these laws mean for open-source operating systems that have no central account system, no app store gatekeeper and often no company behind them at all.
Here’s what the laws require, what System76 said, and how the wider Linux world is reacting.
The laws in question
California AB 1043
California’s Digital Age Assurance Act takes effect on 1 January 2027. As The Register summarised it, it requires operating system providers to offer “an accessible interface at account setup” where the account holder indicates the user’s birth date, age, or both. The OS then provides an age-bracket signal to app stores and developers who ask for it.
Importantly, this is self-declaration, not ID checks. The adult setting up the device says how old the user is.
Colorado SB 26-051
Colorado’s law follows a similar model: OS makers collect and store an age bracket and pass it on, with developers expected to act on the signal. The Register reports penalties of $2,500 per negligent violation and $7,500 per intentional one.
New York S8102A
New York’s proposal goes much further. According to System76’s summary, it would require adults to actually prove their age to use internet-connected devices, forbid self-reporting, and leave the verification methods to the state Attorney General. That means third-party age checks, which in practice usually means ID documents or facial age estimation.
What System76 said
Carl Richell’s post, “System76 on Age Verification Laws”, published on 5 March 2026, makes a few points worth separating out.
It will comply with California and Colorado. This part surprised some readers. System76 isn’t refusing to follow the law. Richell compares it to other requirements the company already meets, such as accessibility and energy efficiency rules. The company says it will implement the age signal while still hoping the laws will be “recognized for the folly they are.”
It thinks the laws won’t work. The post argues that children can easily get around OS-level age settings, by lying at setup, creating a virtual machine or simply reinstalling the operating system. Anyone who has watched a determined teenager with a computer will find that hard to dispute.
It sees New York’s approach as a privacy problem. Requiring adults to hand identity information to third parties just to use a device is, in System76’s view, a much bigger step than self-declared age brackets.
It worries about the incentives. The post argues these rules teach kids to lie and distrust authority, and that pushing everything through centralised platforms concentrates control. Richell’s conclusion: “The challenges we face are neither technical nor legal. The only solution is to educate our children about life with digital abundance.”
Why operating systems, and why now?
There’s a reason lawmakers have landed on the OS. Checking age site by site is a mess: every website builds its own system, and users repeatedly hand over sensitive data. Doing it once at the device level, and sharing only an age bracket rather than a birth date or ID, is arguably more private than the alternatives. Some large tech companies have supported this model, partly because it moves responsibility away from individual apps.
Critics point out that this suits large platform owners with centralised accounts, such as Apple, Google and Microsoft, far better than open systems. A Windows or iOS device already asks who you are during setup. A Linux distribution you install from a USB stick doesn’t, and shouldn’t have to.
The Linux problem in detail
The laws were clearly written with a small number of commercial platforms in mind. Linux and BSD distributions raise awkward questions:
- Who is the “operating system provider”? For Pop!_OS, it’s System76. For Debian or Arch, it’s a volunteer community with no company to hold liable.
- Where does the signal come from? There’s no single account service across Linux desktops, and apps come from distribution repositories, Flathub, Snap, AppImages or source code.
- What about modifications? Open-source users can change or remove any component, including an age-signal service.
- What counts as a device? Servers, containers, embedded systems and virtual machines all run operating systems too.
Other projects have responded in different ways. According to The Register, MidnightBSD added licence terms excluding California residents from desktop use from 2027, and the developer of the DB48X calculator app restricted users in California and later Colorado. 9to5Linux reported that Ubuntu, Fedora and Linux Mint communities opened discussions, with Canonical’s legal team reviewing what compliance would involve.
What this means if you build software
If you ship apps or websites, a few practical points are worth planning for:
- Expect an age-signal API on major platforms. Apple and Google have already been moving toward age-range APIs for apps. Design your onboarding so you can use such a signal when it exists, instead of building your own birth-date collection.
- Collect as little as possible. If a bracket like “under 13 / 13–15 / 16–17 / adult” is enough, don’t ask for a birth date, and certainly not an ID.
- Handle “unknown” gracefully. Many users, especially on Linux, won’t send any signal. Decide in advance what your app does in that case, and document it.
- Watch New York closely. A proof-of-age requirement for device use would be a very different world from self-declared brackets, and would affect more than just app stores.
Where the debate goes from here
There are genuine concerns on both sides. Parents and lawmakers are responding to real problems with children’s exposure to harmful content. Privacy advocates and open-source developers are responding to real risks of building identity checks into general-purpose computers. The Electronic Frontier Foundation has long argued against mandatory age verification on privacy grounds.
System76’s position lands somewhere uncommon. It will comply with the laws while openly arguing they won’t work. That may turn out to be the most realistic stance for the wider Linux ecosystem too: implement the least invasive version of what’s required, and keep making the case for something better before California’s 2027 deadline arrives.
Related reading
- Can Terms of Service Be Updated by Email?
- Android’s “Advanced Flow” for Sideloading Explained
- Who Sees Your Smart Glasses Footage?
Sources: System76 blog, The Register, 9to5Linux, Phoronix.
