https://github.com/systemd/systemd/pull/40954

Much of this goes over my head, so I'm hoping to hear some good explanations from people who know what they're talking about.

But I do know that I want nothing to do with this. If I am ever asked to prove my age or identity to access a website or application, my answer will ALWAYS be "actually, I don't really need your site, so you can fuck right off". Sending any kind of signal with personal information that could be used to make user tracking easier is completely out of the question.

So short of the nuclear option of removing systemd entirely, what are practical steps that can be taken to disable/block/bypass this? Is it as simple as disabling/masking a unit? Is there a use case for userdb I should know about before attempting this? Do I need to install a fork instead? Or maybe I'd be better off with a script that poisons age data by randomizing the stored age periodically?

[edit] I wasn't going to comment on this but it looks like some people with a lot of followers are using this post as an example of censorship on Reddit. While I do think that's a legitimate concern on Reddit as a whole, I don't think censorship is what happened here. Yes, this post went down for a while. But as far as I can tell that was because it was automoderated due to a large number of reports, and was later restored (and pinned) by human moderators.

[edit again] Related concerning PR, this one did not go through yet: https://github.com/flatpak/xdg-desktop-portal/pull/1922

"These laws could force every Linux distribution and privacy-focused Android fork to implement identity verification or face legal liability. The choice between surveillance-free computing and regulatory compliance is coming faster than you think.".

Calculator firmwares had to geoblock California.

MidnightBSD had to geoblock California.

It is legally mandated to broadcast age signals to apps. When I mean apps, I mean every app on your Linux desktop. Yes, EVERY FOSS APP. (Edit: changed the language)

I think we are not protesting enough. Californian people, seriously speak up. People are even trying to ban VPNs.

The consequences felt so draconian that the old joke among cybersecurity individuals dawned on me. I literally wanted to get out of civilization and use solar-powered stuff to run my PC there. The law is simply draconian.

Here's the video where I heard it all: https://m.youtube.com/watch?v=hI9oy0t4JUU

This is the first message in a thread from debian-devel that's been cross-posted to the ubuntu and fedora development lists. I recomended reading the whole thing before you panic. It sucks but it could be a whole lot worse.

Ragebait youtubers are the worst possible source on this.

(Rant portion) There will undoubtably be someone who responds in this thread saying, “but the biggest contributors are our large companies like Microsoft, Google, etc.”. I understand this and I’m appreciative, but Linux wasn’t started for them, it was started in spite of them, and because of them.

I work in cyber security, I watch companies destroy everything, leak our data, remove choice, while forcing marketing down our throats at every turn. All while acting like they are the good guys.

Linux is a break from this, it represents the ability to raise our heads out of the ocean of filth and take a vital breath. That’s why recent decisions by entities supposedly on our open source team, and buy outs of major Linux brands, have me rethinking my distro of choice (Rant over)

Most distros boil down to Arch, Debian, or Fedora. I like to use root distros. I feel like my options for Linux without corporate interests muddying my future and making things annoying for me are pretty much Arch or Debian (with the possibility of Mint LMDE). I love tinkering but don’t have time for a lot anymore. But this feels like I’m cornering myself with Debian which will quickly become stale after a new release, or I risk breaking it with amendments. Or, I use arch and do my best to stabilize it but it will inevitably bork itself sometime in the near future.

Please, I know this sounds opinionated and blunt, but I’m asking for support and honest help / feedback. What are your thoughts??

As the original author of the mailing list thread 'On the unfortunate need for an "age verification" API for legal compliance reasons in some U.S. states', I'm very glad to see this. Obviously, nothing is set in stone yet, but still, hopeful!

For the record, Artix and Devuan have both long been among the most privacy-respecting distros, and they've both already announced they will remove any age verification stuff.

https://www.devuan.org

https://artixlinux.org

Article 12 of Law 15.211/25, also known as the Child and Adolescent Digital Statute, requires Operating Systems and Application Stores to:

1. Implement means to assess the age or age group of its user
2. Allow parents or legal guardians to configure parental controls and to supervise, in an active manner, a child's access to applications and content
3. Allow, by the means of a secure and private Application Programming Interface (API), the provisioning of age verification signals to internet application providers

This is a broader law that regulates a lot of things related to the protection of children and adolescents in digital environments. Including social networks, loot boxes, data privacy, age verification, gambling, advertising, etc...

Here is more info about the other effects of this law:
https://insightplus.bakermckenzie.com/bm/data-technology/brazil-digital-eca-brazils-child-and-adolescent-statute-a-new-framework-for-online-protection-of-children-and-adolescents_2

Edit: The Law stipulates a fine of 10% of last year's revenue or, absent revenue, between R$10 (~$2) and R$1000 (~$200) per registered user, with a limit of R$50.000.000 (~ 10 Million dollars) per infraction