There are two things very very wrong with the California law, which you call "age indication".

1) The parental responsibility is given to the wrong people. You're basically being forced by law to give all apps and websites your child's age on request, and then trusting those online platforms to serve the right content (lol). It should be the other way around. The apps and websites should broadcast the age rating of their content, and the OS fetches that age rating, and decides whether the content is appropriate by comparing the age rating to the user's age. The user's age, or age bracket, or any information about the user at all, should not leave the user's computer.

2) The age API is not "completely private". It's a legally-mandated data point that can be used to track a user across apps and websites. We must reject all legally-mandated tracking data points because it sets the precedent for even more mandatory tracking to be added in the future. We should not be providing an API that makes it easier for web platforms to get their hands on user data!

For many years, certain tech companies, SIGs, and governments have fought against technologies that could enable real digital parenting, all while claiming to do the opposite and "protecting children". They craft a narrative to convince you that top-down digital surveillance and access-control is for your own good, but it's time we reject that and flip their narrative upside down: https://news.ycombinator.com/item?id=47472805

It's a distinction that hinges on one law from one state that doesn't reflect the reality of the dozens of laws in dozens of states, nor proposed federal legislation, that all require age verification via AI face scans and ID uploads.

That's to say, this distinction is meaningless unless you're planning on blocking every jurisdiction outside of California so you can just adhere to its age verification laws and no one else's.

A pointless slippery slope to attempt to stand on that points directly at the Overton Window being drawn around this.

That's just setting things up for a smoother slippery slope...

As appealing as the private part sounds I genuinely think it may make the situation worse here by facilitating the transition & muddying the waters

The issue though with "age indication" is that it creates an additional flag that can be used to fingerprint users. But it is infinitely preferable to any sort of age verification or age assurance.

I like the term "age indication". Thank you.

If I may nitpick, the conventional term for systems which attempt to determine the user's age is "age assurance". This covers a variety of techniques, which are typically broken down into:

* Age estimation, which is based on statistical models of some physical characteristic (e.g., facial age estimation).

* Age verification, which uses identity documents such as driver's licenses.

* Age inference, which tries to determine the user's age range from some identifier, e.g., by using your email address to see how old your account is.

These distinctions aren't perfect by any means, and it's not uncommon to see "age verification" used for all three of these together but more typically people are using "age assurance".

I think this legislation is as dumb as everyone else does, but it also seems like the cheapest way for everyone to agree that we did something about the moral panic without actually giving up anything. It doesn’t do anything with ID or privacy or even actual verification. There’s no complicated auth dance to do with government services to verify our age tokens or whatever the latest Rube Goldberg machine “zero knowledge” age check proposal is.

I’ve been shocked at how many HN comments always come out in favor of age related legislation and heavy government regulation when the topic comes up. The pro-regulation commenters always seem to assume the age checks would never apply to them because they don’t have use TikTok or Facebook or other services, yet few realize that there aren’t going to be laws written in a way that only apply to a couple named companies you don’t use anyway. If we age verification laws then they’re going to be everywhere.

I personally hope this legislation dies and we can be done with this silly exercise, but if we’re stuck with age verification moral panic than a simple OS-level switch that we set once and then forget about seems like the least intrusive form of “age verification” we can get away with.

> Systems are required to ask the user for their age and just trust whatever they say

If you're going to do anything like this, this is the thing they actually get right. It removes the inconvenience, privacy invasion, forced use of corporate verifiers with perverse incentives, etc. Meanwhile if the user is actually a child then their age is set by their parent.

> Applications are required to query the system for the user's age range.

This is classic legislative stupidity. Applications are required to query the user's age range even if they contain no age-restricted content? Brilliant.

For me, the big issue is going to be mobile devices (phones, and tablets to a lesser degree)

I've already had it up to my back teeth with Google arbitrarily updating things such that the on/off button was hijacked, preventing me from switch the device off, instead triggering an interaction with freaking Gemini (what sort of IDIOT thought doing that to a device was a good idea)

I'm seriously trying to find a way to no longer run Apple or Google OS based phones - which puts me in the "Linux" or "Graphene" market

Why would it be more spooky if Apple in particular did this vs all the other hardware vendors that ship a pre-installed OS?

Open source is driven by contributions. Most of the time, if someone wants a feature, implements the feature, and submits a reasonable PR to a project, that project will have the feature. In this case, the PR appears to have been written by someone who is not a regular SystemD contributor, and (through a bit of Googling) works for a FinTech company with no obvious interest. I can't comment on why that individual wanted to add support. However, once someone added support, the question for SystemD is not if it is worth implementing, but if it is worth merging. At this point, it becomes a simple case of "the most intolerant wins". For people who care about complying with CA style laws, this feature is critical. For people who don't care, this feature is fine. I doubt it will even make it on mosts lists of SystemD feature bloat that most people don't care about.

This is the same reason a bunch of the food in your pantry is certified kosher. No one is going to not buy something because it is kosher. But if paying a thousand dollars a year to put a small circle-u symbol on the back of your box can increase sales by 1% among observant Jews, most companies are going to do it.

> systemd is not run by one corporation

Two corporations, e.g. Canonical and Red Hat, might suffice.

I hope everybody remembers how systemd was thrust upon the community by having Gnome largely depend on it. This was mostly done by efforts of Red Hat, and that sufficed.

California has both vendors and clients that are big enough to warrant immediate compliance. A very measurable chunk of Linux is from corporations, most major advancements are corporate backed in some way.

IIRC all that's been done is a field has been added to store the user date of birth and a protocol that can be used to retrieve said date.

That's it.

>It seems incredibly silly to me that this is being rushed into systemd [...]

Making user-hostile changes seems exactly on-brand for systemd, to my mind.

Why does it exist?

>This systemd change is absurdly overdiscussed. It's a field for a number, no verification, no enforcement for anything.

> And no, I do not accept the slippery slope fallacy.

aka:

$OBVIOUSLY_DUMB_OVERREACHING_EASILY_ABUSED_POLICY is absurdly overdiscussed. It's $ABSURDLY_REDUCTIONIST_VIEW. And no, I do not accept $HISTORICALY_VERY_LIKELY_OUTCOME fallacy.

[flagged]

Setting aside the ridiculous nature of this move towards OS-level verification, NixOS (and Guix) is the last distro to worry about when it comes to age verification.

Why? Given the nature of how NixOS works (config-driven), the maintainers have plausible deniability: if push comes to shove, they can shift the burden to users and have them enable the age verification service as part of their NixOS config.

Artix (Arch) and MX Linux (Debian) are very nice

My gaming machines that I do not browse the web with have systemd (CachyOS) but my daily drivers do not. Should a website lock me out because I don't have some age API then in my view the problem has solved itself. The website has effectively blocked itself without me having to given the one and only correct way to age gate a site in my view is with the RTA header [1] that would trigger parental controls if optionally enabled on ones device. Every other path that involves exchanging data whether verified or not, anonymized or not can only lead to future evil shenanigans.

[1] - https://news.ycombinator.com/item?id=46152074

>But my main concern with this is applications like Firefox will eventually require this systemd age specific field and a standard systemd function to call. That means this age field will need to be populated and this locking out the *BSDs and non-systemd Linux.

The risk is real, and the solution is to move away from systemd now, not wait until it's too late. Whatever conveniences it brings over other init systems are certainly not enough to justify giving up online anonymity forever.

If these laws come in in their current form, it might be worth archiving ISOs like 9front because I'm sure at least one project will just close its doors

It actually is more like a flag in most cases. Specifically, in the case of AB1043, you enter your age or your DOB but then the OS provides an age range (<13, 13-15, 16-17, 18+).

Also, while some bills do seem to require browsers to promulgate age data to websites (e.g., NY SB102A [0]), AB1043 does not. Rather, it requires the browser to read the age range just like any other app, but does't say anything about providing it to sites.

[0] https://www.nysenate.gov/legislation/bills/2025/S8102/amendm...

Richard Stallman's "Right to Read" is worth reading again, because it portrays a very similar scenario.

Never forget what they did to encryption

1. The UK and EU are rather large markets that they don’t want to miss out on.

2. There are software engineers in the UK and EU.

3. This specific implementation by Apple is not actually required by any UK or EU law, to my knowledge.

4. This specifically is or will be required by the laws of some US states and other countries.

Maybe carefully read TFA - the age verification came from a Californian law