Technology

Many people here are going off on wild tangents over this. You should just read the law, it's only a couple thousand words of quite plain English.

Many here have taken completely incorrect assumptions from the title. This law is for developers, not users.

Summary:

1. Requires OS devs ask for DOB, age, or both at account creation time.
2. Requires an API that allows app store devs to request this age data for the account. At minimum this API must signal that the account is a member of one of these categories: 'user under 13, user over 13 and under 16, user is over 16 and under 18, user is over 18'.
3. Explicitly bars OS devs from sending more data than explicitly necessary to meet 1 (hint: photo ID, facial recognition).
4. Explicitly bars app devs recieving the data from requesting more data from the OS nor the App store.
5. Bars app stores from using the data for any other reason and specifically calls out anticompetitive practices.
6. Bars app store and OS devs from sharing this data with any third party for any other reason than to comply with this law.
7. Has injunctions and civil penalties of $2500 (max per user) affected by negligent violations (eg a child account is served adult content), and $7500 (max per user) affected by intentional violations.

The only problem I have with this is that it should only apply to commercial software (app stores and OS). Libre/FOS software should not have to police ages on their app stores, due to their far reduced budgets (often zero), developer time, and the nature of the software being generally anti-centralized and anti-surveillance-capitalism. Though I'd be fine with it for FOSS software distributed via commercial app stores, as long as they gave a longer lead time to implement (EG a couple of years).

So now when I spin up a VM at my sysadmin job I have to tell the server I'm an adult? Does anyone actually know what the fuck we are doing here? What an absolute clown show.

For everyone trying to figure out how this would be enforced, it's not about being proactively enforced. (and data collection is 99% of it)

It's about adding a double-tap "Well, these people also violated our age verification law, so they have to pay a fine," added to any incident where it's convenient to add this in. If a minor sends another minor a snap that would trigger CP laws, and one of the phones isn't age verified correctly, fine to the parents and hands up in the air "We tried!" A minor is involved in torrenting movies? "Look, kids using illegal OS! Fine to the parents!"

This is how laws work across a lot of corrupt developing countries. There's laws for everything, but they only get applied selectively as authorities find they fit the situation. It's hard to actually be 100% above board and do everything legally because of a few little things meant to be impossible to actually do bureaucratically. So in every situation, any set of authorities start in with the endemic leverage of "Well, we have suspicion of you selling ketamine out of your apartment. Did you do age verification on your laptop? No? Then we can seize that as a crime and see what's on there. OR you can give up your supplier."

How will this affect embedded os like freertos or vxworks? There are lightbulbs that have operating systems these days, am I going to have to show ID to turn on my light?

uhhh. So would I need to get everyone who uses the household pc to verify age? Whats stopping a child from using the family pc that was age verified by an adult?

This will not matter to most of linux, it’s non enforceable and easily circumvented.

But the issue is what they used for thumbnail. Steam deck.

Steam is bringing linux to the the masses but they won’t be able to sell any without complying to the part that all apps that can be installed must be able to ask the os to give this data.

Simple solution. From now on Linux distros should ship with a big message "NOT FOR USE IN CALIFORNIA".

You want to force age verification? No server in all of California will run. Period.

I've always input my age as 1900-01-01 and I can't change that now because that'll show an inconsistency and we can't have that now can we.

The law does not require photo ID uploadsor facial recognition, with users instead simply self-reporting their age, setting AB 1043 apart from similar laws passed in Texas and Utah that require "commercially reasonable" verification methods, such as government-issued ID checks.

Seems toothless. Good.

Enforcement against Linux distributions, however, is likely to be problematic. Distros like Arch, Ubuntu, Debian, and Gentoo have no centralized account infrastructure, with users downloading ISOs from mirrors worldwide, and can modify source code freely. These small distros lack legal teams or resources to implement the required API, so a more realistic outcome for non-compliant distros is a disclaimer that the software is not intended for use in California.

Wow California leading the way to fascism, who woulda thunk?

What if no internet? How set up?

Technically, Linux is not an operating system, just a kernel, so I'm not sure how this would be implemented.

How old is my tomcat user? How about my various docker containers, are those separate OSes?

Sometimes newsom does some epic shit, but then we get shit like this, and I wonder whether I want to live on this planet any longer :/

Linux from Scratch is a refuge. It would be greatly improved with a package manager.