Senate Bill 26-051 reflects that pattern. The bill does not directly regulate individual websites that publish adult or otherwise restricted content. Instead, it shifts responsibility to operating system providers and app distribution infrastructure.
Under the bill, an operating system provider would be required to collect a user’s date of birth or age information when an account is established. The provider would then generate an age bracket signal and make that signal available to developers through an application programming interface when an app is downloaded or accessed through a covered application store.
App developers, in turn, would be required to request and use that age bracket signal.
Rather than mandating that every website perform its own age verification check, the bill attempts to embed age attestation within the operating system account layer and have that classification flow through app store ecosystems.
The measure represents the latest iteration in a series of Colorado efforts that have struggled to balance child safety, privacy, feasibility and constitutional limits.
Hey Colorado. GFY and get your damn politicians under control.
First I’ve heard of it, dude. Don’t get your knickers in a twist.
This goes in a better direction than web sites doing it themselves, I think. The government put out an open source tool that runs locally and the browser just gets a yay/nay return code from it.
On paper, I like this solution better than every app/site developer having to hack together (or outsource) their own age verification system. But I’m sure it opens up a ton of potential problems. And if it’s open source, someone could just fork it and make a version that always says “yes” so unfortunately it’ll never be FOSS.
Some kind of cryptographic signing of the executable could probably help with that.
Ultimately I don’t believe there can ever be a foolproof solution and the emphasis should be on client-side parental controls.
It wouldn’t even work on paper. All it would take to twist this into something dystopian is requiring cryptogtaphic attestation for the age range, and knowing lawmakers, they would justify it as a countermeasure for kids lying about their age. Expand the feature as a web API so websites can use the “easier” and “more secure” system-level age verification process and—oh look, now we can’t use important websites without a commercial operating system.
It would be like Secure Boot but worse. At least with that you can turn it off or enroll your own keys.
-
How do they secure age data? Age is most likely two characters, with a max of three characters. If there are penalties for sharing the age data when they aren’t supposed to, how do they secure this? Even with cryptography a two character number with only 70-ish reasonable and expected variations is going to be difficult to secure.
-
How do they ensure no one who is a different age ever uses the device? “Use mom’s iPad” is univseral. Does mom get in trouble for letting her child use her device, does the parent end up with the fine?
However, if a developer has clear and convincing information that a user’s age is different than the age indicated by an age signal, the developer shall use that information as the primary indicator of the user’s age range.
- How do they determine age other than self-reporting with anything other than wholesale spying on user habits? What other way could they possibly glean “clear and convincing information that a user’s age is different than the age indicated by an age signal” other than spying on a user’s device use? This also implies remote-control of the OS if the operating system vendor can change the age-gate remotely based on user habits.
I feel like #1 and #2 are problems whether its client side or server side. As for #3 I would lean in the direction of there being a one-time check with no persistent knowledge. Like when you flash your ID to the bartender to order a drink. A client app that scans the ID and returns the answer to the requestor.
But I don’t think there is any way to reliably implement this sort of thing. I think it should really just be left to parental control and monitoring.
I think part of the problem is there shouldn’t be a server-side to this. Because that’s opening the door to all kinds of intrusive data-collection to determine age, even if they claim it should be done “minimally.” Define “minimal.” That seems to fly in the face of “clear and convincing information that a user’s age is different than the age indicated by an age signal” which is a direct quote from the Bill.
And as for number 3, I don’t see how no persistent knowledge could work. If the client app has read the data (“scanned the ID”) that means the client-app can now store that data anywhere the client-app has write access.
Further, it’s not like in real life when the bartender can scan the person up and down, look at the ID and make the assessment that McLovin is clearly underage.
If it’s open source it can be verified that it’s not storing the data.
And I 100% agree that software scanning an ID is an overall bad way to verify. With a CC# validation at least that shows up on my statement, but if my kid is sneaky enough to get mine out of my wallet I have no way of knowing.
- You don’t.
- Easy. The device constantly captures images of the user and checks them against the user image on file
- By scanning a government issued ID and checking against an online database with poor security.
-
The only thing this bill seems to affect are apps. It has no provision for websites, meaning kids would still have unlimited access to adult content. If a kid wants to get around browser checks, all they have to do is either install an older browser that doesn’t use the OS verification, or find a plug-in that fakes it (and of course those will immediately come out).
Even worse, if the OS requires ALL software to acknowledge the age verification checks, what do you think that means? Everyone in Colorado is required to immediately spend thousands to buy all new versions of every program they use? And what happens to the software that is no longer updated? If you’re lucky, you can buy something completely different and spend months rebuilding all your old information into the new system? Sounds wonderful.
I think it’s pretty clear that this was written by people who are used to getting everything from the iOS store/macOS store/Microsoft store/Google Play store and have no fucking clue what using a computer that isn’t “app-based” is like.
Fucking idiots don’t know how operating systems work or what they’re for.
If I could trust that the people in government know how computers work I’d be down but well I can’t
I fully expect this to become a move to hamper linux, or any non-windows desktop usage, because “we can’t trust a user who has full access to their OS” or some other bullshit.
Under the bill, an operating system provider would be required to collect a user’s date of birth or age information when an account is established.
It’s so fucking obvious the people who wrote this have no idea other operating systems than iOS, Windows and Android exist.
I think it is notable that it never makes assumptions about the verification method, so it could just be a simple parental control system. Granted I have no doubts that the corpos will take this as requiring Id, but the bill itself makes no such requirements.
What are you on about? If they get 95% of the population with this it’s still a huge win for them.
They keep trying to make Linux more appealing.
I’ve been a longtime mobile and web developer, have a teenage kid with a phone, and am a big privacy advocate (card-carrying member of ACLU and EFF). As a parent, I don’t want my kid exposed to cyber-bullying, toxic social media, or algorithmic bullshit.
And I will tell you this: the operating system is 100% where you want to do age verification.
I don’t want individual social media sites, dodgy third-party orgs, or government agencies scanning our faces or IDs. Under a family sharing plan, the OS already knows how old the kid is. Any site wanting to gate access can privately ask the OS if age > X without spilling their PII. Same concept as OAuth. An opaque, encrypted token indicating GO or NO-GO.
Raging that they shouldn’t do any of this is just idiotic. Unfettered access got us CSAM, kids getting radicalized, or bullied to the point of self-harm. Fuck that.
From a technical point of view, having OS-level verification is the least worst, and in my technical opinion, the best option.
As a software engineer that works on virtualization and is interested in software freedom, this law terrifies me because it’s a trojan horse for something much much worse than the already shitty status quo: remote attestation.
And I will tell you this: the operating system is 100% where you want to do age verification
No, it’s the last place you want to do this check. Let me explain: because users control the PCs they buy right now, meaning they can install any OS and programa the so wish to install; governments at some point will decide that they cannot trust the results given by any OS.
The only way for governments will be to actually trust third parties (again) that will check properties in your computer through a module that controls the whole computer and users don’t have access to.
This is called remote attestation: https://www.eff.org/deeplinks/2023/08/your-computer-should-say-what-you-tell-it-say-1
With this technology, users don’t decide what programa they can install and run, they can’t even decide what websites can they visit.
It’s a brutal encroachment on the computer freedom you have enjoyed up to now, and the perfect tool for an authoritarian government to enforce what can you watch and in general, can do with your computer.
If this law is approved, I guarantee you it will spread and will have expanded versions requiring remote attestation. (Don’t worry, lobbyists will find a way to sell remote attestation preserves privacy to make it go down easier)
The end result is a nightmare-fueling scenario where someone like Peter Thiel through Persona not only has your information because it needed to verify to create the account in your computer, but Microsoft also has it, and governments through Microsoft may decide to limit which platforms you can access (X or something worse), if also if you’ve been a bad citizen, if you can run programs in any computer that can be legally sold.
All in all, this law is incredibly dangerous in the current political climate where even supposedly democratic governments are pushing for more authoritarian controls to digital life. And I’m surprised organisations like EFF haven’t seen this yet
I’ll caveat this by saying IANAL. But the way I read Bill 26-051 is that it’s looking to implement “user age attestation” not “device or application” (WEI). Two separate things.
Age Attestation requires the OS (or really, the cloud service that implements account-level authorization) and come up with an “age signal.” It prohibits using third-party non-public data, and puts the burden on the OS for managing the Go/No Go process. No PII leaves the device.
The alternative is dystopian, poorly managed KYC/AML over-reaches. Under the guise of anti-fraud/anti-gambling, these will reach deep into our communal shorts. They could well soon require individual biometric verification (iris scans, face contour maps, fingerprints, etc). No, thanks.
WEI is a separate story. It’s trying to cut down on malicious apps and maybe stop individual sites doing browser fingerprinting. It can only work on systems with single-points of app installation (without side-loading) and devices already locked down with hardware TPMs. So far, that only covers iOS. All the other systems (Linux, Mac, Windows, and Android) let you install your own system-level code without having to go through the One Official appstore. And with WASM, the browser makes it all moot.
Personally, I think WEI is a total waste of time. Trying to squeeze the toothpaste back into the tube. But it’s solving a different problem than age verification.
Not to say the Colorado bill is perfect. There is a truck-sized app vs. website loophole in it, so kids can still access social media sites from the browser vs their phones. But the OS can offer an API that browsers can vend to websites without every site rolling their own crappy system. It also doesn’t account for a clever kid figuring out how to create a separate adult-appearing user account. Because of course, they will.
Saying it’s parental responsibility is unrealistic. I’ve helped folks set up Screentime, router-level filters, and even Circle (in-home ARP spoofing box, and mobile VPN + fine-grain URL filtering). There are ways around all of it. Besides, the kids can still get exposed to utter bilge via school-approved sites like Zoom, YouTube, or Google Drive. Let’s not even bother with messaging apps or in-game chat. This is all assuming parents have the time or knowledge to set things up and manage the filters.
We’re not trying to be over-controlling, stop the kids from dancing too close at the prom, or yuck their yum. But as parents, we do want to have some sort of say in what they’re exposed to online before their brains have the capacity to process them. The risk to their mental health is real, and just YOLOing it hasn’t worked out too well.
I’m sure there’s a lot of subtle behind-the-scenes stuff in the Colorado bill. I’ll wait to hear what EFF or Mike Masnick have to say about it. But as a techie, app developer, and parent, it reads like the least-worst way to keep a minor away from nasty crap without requiring every one of us to scan our faces and provide IDs to every rando website.
And I will tell you this: the operating system is 100% where you want to do age verification.
Oh, what’s that you’re using? It’s Linux? Sure that’s fine, just make sure the age verification check works on it.
Wait, what do you mean you have “root access”? Why do you keep repeating “it’s my hardware and I own it”? You removed the age check system? You can do that! Hey, he’s not supposed to be able to do that!
Colorado proposes bill to ban open source operating systems
As a parent, systems and web developer of both open source and proprietary software. This would single-handedly be one of the most damaging things to ever happen to the world of personal computing.
From a technical point of view, having OS-level verification is the least worst, and in my technical opinion, the best option.
It’s a horribly bad opinion. It’s the same old problem with client-side anti-chest. You can’t trust the hardware. If the user has full access to the computer, then they can do whatever they want with it. This is a core issue in security modelling. So what’s the answer? Try to lock down the system. This is why anti-cheat software, to play a video game, has more access to your computer’s hardware than you do as a user. Full access to every single file, data in memory, webcams, things on screen, etc.
What’s going to happen if it becomes mandated that age checks must happen in the OS? We’re going to get computers so locked down that you won’t be able to open a .txt file without some kind of authentication check.
No thanks. I’m happy to avoid every single age-check required service.
I won’t repeat what I said in the sibling thread.
But I don’t see anywhere in this specific Colorado bill trying to restrict OS level features or go anywhere near open-source. As a parent, if I put little Timmy on Arch and give him root access, I don’t get to bitch about what they do online.
This is about a single signal (kid/no kid) at the user-auth level, without slurping up PII and shipping it off into the ether.
These are all the Least Worst solutions. I humbly disagree.
Apple already has iCloud age settings
Account is created? Who said were making accounts for our operating systems
Sounds good. Might even encourage more people to move to a privacy respecting OSs.
AFAIK, only adults can sign up for internet access, so a minor watching porn on the internet is the same as said minor watching their parents’ adult DVDs or drinking alcohol their parents purchased. It’s already illegal for adults to give minors access to these things, so what’s next? Alcohol bottles that only open and DVDs / Bluerays that only play if you can provide an ID and prove your age every time?
its not about limiting children’s access to porn and other stuff, it never was.
DON’T give them ideas!
Year of the Linux desktop inbound.
Why can’t we just have better parental controls? I’m a parent and I do want to protect my kids but I will not upload a photo or anything else.
