223 points by iamnothere 3 days ago | 99 comments on HN
| Mild positive
Contested
Mission · v3.7· 2026-02-28 08:41:47 0
Summary Privacy & Autonomy Advocates
A GitHub commit announces a legal notice from the DB48x software project, declaring that the software will not implement age verification and therefore will become unavailable to California residents after January 1, 2027, and Colorado residents after January 1, 2028. The content strongly advocates for privacy rights and freedom of expression by refusing to comply with state age verification mandates, but the resulting geographic access restriction undermines principles of non-discrimination and freedom of movement.
Does it run applications? The point of the law is to collect (and device setup) the age of the (I guess primary?) user, and communicate that (as a range?) to any applications it runs.
So, if you don't run applications, does this matter? Also, enforcement is by the CA attorney general, so random people can't go after you.
(e) (1) “Covered application store” means a publicly available internet website, software application, online service, or platform that distributes and facilitates the download of applications from third-party developers to users of a computer, a mobile device, or any other general purpose computing that can access a covered application store or can download an application.
Also, where does anything in the CA bill mandate age verification? It's saying the OS needs to prompt for age bracket info and allow the third party apps to query that. That is far different from verification.
IANAL, but the whole thing feels quite problematic. Should we interpret the prohibition as a licensing condition "a resident using our IP is violating the contract" or as an informative note "we are not compliant and we are not ever going to be compliant so a resident using the IP is violating local laws"? I'd expect the intent to be the latter, but would it hold in front of a judge? If the notice is a licensing condition, the whole thing is problematic as hell:
- Does such prohibition has any legal force at all? Does it do anything to prevent responsibility according to the bill? Wouldn't just saying "CA/CO have zero jurisdiction over us, get screwed" be a saner choice (of course it would be better if the project wouldn't host on M$'s servers).
- The main project license is GPLv3. GPLv3 clearly has no provisions to introduce arbitrary prohibitions into the license without losing compatibility. But they still keep GPLv3 LICENSE.txt, which is problematic in itself - if LICENSE.txt says one thing and LEGAL-NOTICE.txt another, the conclusion might be that no license applies so no one may use the software at all!
- If they are reusing any GPL software that they don't hold copyright on, they might be or might not be in violation (would need a real lawyer to say if that's the case or not).
And on the actual matter of things, it's really sad to see California to be on the front line of this crap (this screams ageism). And, dear "adults", screw your parental authority so much. Whatever skills I've gained before the university I've done against an explicit parental prohibition. This is what I live off now. Screw you all.
I think the winning move is just to ignore the legislation, and drag the government into an EFF or ACLU-funded First Amendment lawsuit if they try to enforce anything.
Ignoring the calculator side of things (fair enough if they don't wanna implement it) is this just requiring an age value for the user of the operating system?
Because if so, that seems a lot more sensible than the online crap where you need to give ID or something. I remember someone suggesting requiring an `X-User-Age` header, and having adults responsible for having their children's account setup with their age, which this proposal seems to be more in line with.
From some of the other responses people seem against this proposal, am I missing something? (I only briefly skimmed the links) Is there some kind of attestation/ID required when the age is input?
What's with the recent push for age verification? This has been around forever but it seems like just recently a bunch of governments are pushing for this.
There is no carve out in the law for open source. I don’t think it matters for this calculator’s firmware, because there’s no covered App Store, but it certainly would for most Linux distributions.
> Also, where does anything in the CA bill mandate age verification? It's saying the OS needs to prompt for age bracket info and allow the third party apps to query that. That is far different from verification.
Regardless of the technical details of the law(s), the devs are sensibly refusing to prompt for age on a fricking calculator.
Hopefully Linux distros get on board with this and announce non-CA/CO compliance as policy.
> And on the actual matter of things, it's really sad to see California to be on the front line of this crap (this screams ageism). And, dear "adults", screw your parental authority so much. Whatever skills I've gained before the university I've done against an explicit parental prohibition. This is what I live off now. Screw you all.
It's yet another surface that totalitarian parental control has crept into, and it's a serious problem. Young people kept strictly within the iron grip of their guardians generally aren't the ones who become happy actualized all-star adults.
Obviously there should be some limits on what teenagers and children can access, it shouldn't be entirely free reign, but robbing them of space to bend the rules severely limits their potential for growth and incurs a strong risk of extinguishing their spark.
the winning move is to publicly post every bit of data that anyone has or ever had about the politicians who wrote this law, VERY publicly, and see how fast they change their mind on privacy. I suggest starting with SMSs and photos in "private" folders.
The California bill basically says any OS with an app store needs to collect an age signal and provide age bucketing to an app store (presumably even third-party ones, but notably NOT extension stores) so it can forward that information onto developers in that store.
There's no further elaboration on what age signals are preferred, so my assumption is that a DoB field in the user profile and a system service to request the age bucket is good enough. It's absolutely silly, but DB48X could implement that.
There's a related question of who is actually liable under this law - it seems written to target just Apple, Google, and Microsoft; and it only makes sense in the context of consumer electronics. Like, how does this work with enterprise systems? Servers? Is IBM going to have to rush out a patch for z/VM to ask the system administrator what their date of birth is?
It's also still bound only to companies in CA. I'm in GA, I don't have to comply, for example, if I were making operating systems. People REALLY need to push back when governments try to extend their reach beyond their borders, like EU regulations. The more we let them the more enshrined in law it will become. We have the right and duty to say no, that only applies in your jurisdiction.
It’s the camels nose into the tent of regulating how an OS should behave. This is anathema for FOSS operating systems. It will cause complete madness if different jurisdictions start regulating operating systems in their own way and could honestly kill FOSS OSes.
“can download” could refer either to transfers initiated by the user, or to transfers initiated from the device. The language “from [device] developers to users of [that device]” clarifies that this applies if users can access a third-party directory and/or repository of applications.
I strongly encourage the EFF to sue the FSF over not shipping age verification in Emacs, since in every respect Emacs fits these criteria; it is a computer environment that avid users can reside fully within to operate their system, and its publisher operates a directory+repository system at https://elpa.gnu.org. I think that both organizations would be excited to pursue that lawsuit pro bono, since it would evidence such significant flaws in the law that it might be struck by the court.
Incidentally, this likely also implicates Tesla and BMW as not requiring age verification before allowing users to download updates containing new pay-to-unlock applications from their vehicles’ in-app purchase marketplaces. I’m sure they would both be happy to help overturn this law once implicated in violating it.
Developers are not lawyers, so they cannot be expected to know every subtle detail of the law, and not how these laws are then interpreted (in a often non-logical way) by courts.
Strong advocacy against age verification mandates as invasive privacy violations. Explicit refusal to implement age verification is a clear privacy protection measure aligned with Article 10.
FW Ratio: 60%
Observable Facts
The author explicitly states: 'it does not, cannot and will not implement age verification.'
The legal notice links to specific state bills mandating age verification (California AB1043, Colorado bill).
The notice frames the access restriction as a consequence of refusing to implement invasive age verification.
Inferences
The refusal to implement age verification is framed as protecting user privacy from invasive state mandates.
The author prioritizes privacy protection over market access in regulated states, demonstrating advocacy for Article 10.
Refusal of age verification protects against arbitrary interference with personal autonomy and privacy, aligned with Article 12's prohibition on arbitrary interference.
FW Ratio: 50%
Observable Facts
Age verification mechanisms require personal data collection and verification, representing potential interference with privacy.
The author's refusal prevents such interference.
Inferences
Rejecting age verification prevents state-mandated arbitrary interference with users' personal data and autonomy.
The notice demonstrates active protection of Article 12 rights by refusing to participate in privacy-invasive mechanisms.
The author freely expresses their position on age verification mandates and their refusal to comply. The public commit and legal notice are clear exercises of freedom of expression.
FW Ratio: 60%
Observable Facts
The author publicly announces their refusal to implement age verification in a legal notice committed to the repository.
The notice is visible to all users of the public repository on GitHub.
The author identifies themselves by name (Christophe de Dinechin) and signs the notice.
Inferences
The public announcement is a clear exercise of freedom of expression regarding technology policy.
The author uses GitHub's open source platform to express their views on privacy and state regulation.
The author exercises freedom of conscience and thought by taking a principled refusal to implement age verification, based on their values regarding privacy and freedom.
FW Ratio: 33%
Observable Facts
The author explicitly refuses to implement age verification technology as a matter of principle.
Inferences
The refusal is presented as a moral/conscientious position rather than a technical limitation, demonstrating exercise of freedom of conscience.
The author is asserting the right to maintain ethical positions regarding user privacy.
Access restriction based on state of residence undermines equal treatment, despite refusal of age verification being rooted in protecting equal dignity.
FW Ratio: 50%
Observable Facts
The legal notice states California residents may no longer use DB48x after January 1, 2027, and Colorado residents after January 1, 2028.
This restriction applies based on geographic location/state of residence.
Inferences
The geographic-based access restriction treats residents of different US states unequally regarding software access.
The inequality is a consequence of the author's refusal to comply with state mandates, not discriminatory intent, but the effect remains discriminatory.
The access restriction effectively limits freedom of movement by preventing residents of certain states from choosing to use the software.
FW Ratio: 50%
Observable Facts
DB48x will be unavailable to California residents after January 1, 2027, and Colorado residents after January 1, 2028.
The restriction is based on state of residence, creating a geographic barrier to software access.
Inferences
While not explicitly restricting physical movement, the access restriction limits the freedom of residents to use a technology resource based on geography.
The restriction indirectly penalizes residents of regulated states for their location.