License:
Creative Commons Attribution Share-Alike

by Blender Dumbass

Aka: J.Y. Amihud. A Jewish by blood, multifaceted artist with experience in film-making, visual effects, programming, game development, music and more. A philosopher at heart. An activist for freedom and privacy. Anti-Paternalist. A user of Libre Software. Speaking at least 3 human languages. The writer and director of the 2023 film "Moria's Race" and the lead developer of it's game sequel "Dani's Race".

Assembly Bill No. 1043 of the State of California forces every operating system vendor to implement an age verification system on "account setup". I guess it's time to break the text of it down and rant a pissed-off rant about how stupid it is. Shall we?

Just a disclaimer. I'm not a lawyer. I'm an internet user. All I say is pretty much bullshit. With that said. Let's go...

Preamble

The document in question starts with a preamble of sorts trying to explain its reasoning. I suppose if the reasoning is bullshit, then the whole law is absolutely insane. Let's start with breaking down said reasoning.



This sounds like a good thing. They are talking about "dark patterns" and how bad companies are trying to get data from the kids using those. And that there are already laws that try to limit that sort of thing.

In my opinion this is a genius red-herring. They start the whole thing, framing it as a pro-privacy thing. As if saying: we need better tools to know who is a child, so we could protect those children online better. c:1

But here is the problem at its very core: how about adults? What? Adults do not deserve privacy? Adults are not being targeted by dark patterns?

As I explained multiple times adults are not smarter than kids. There is practically no real difference. Every person on this planet is an utter moron. If those "dark patterns" work on kids. They sure work on adults too. You probably can point to at least a dozen of adults in your surrounding that would fall for this sort of shit. If anything, separating the level of legal protection against corporate surveillance based on age, in the first place, is utterly ageist. Which already makes the whole premise of the damn law in the first place, utterly idiotic. And that is if we forget that the whole paragraph is a red-herring to begin with. c:2

So the bill wants to:



And also:



So we have a requirement for the user to record their age into the operating system. And will require the apps to use this data to decide upon things.

I've shortened the descriptions a bit because they are written in a very legal way, which requires them to be way too descriptive.

Now let's look at the actual legal text of the law in question.

Definitions

First the definitions.



Okay, this is interesting. The law seem to not forget about the existence of emancipated minors. As in kids that asked the judge to make them adults, now, instead of waiting to be 18. This is a real thing that exists in law of multiple countries. And that thing complicates the whole age thing tremendously. Technically speaking this "minor" is not a minor anymore. So how would age-verification ( or age-restriction as a whole ) deal with such cases? The fact that they put this into the text means that they are at least aware of the issue. Let's see if anywhere in the text this issue is actually properly addressed. ( It isn't ) c:3



The fact that they are trying to make this be a "nonpersonally identifiable data" at least seems in "good faith". But there is a problem with this. Anonymized data, even if low resolution, such as how they want to have it here, is still personal data that could be correlated with other data. c:4

Say an app of some device has access to GPS location. Say it is some kind of a map or a game such as "Pokemon Go". It needs GPS to work. The bill, as we saw earlier, requires the developer to gather the age data anyway. So the developer knows that (a) the user is in this location and (b) the user is in this age group.

We know that developers sometimes cannot be trusted. Look at Meta, or Google, or any other big tech. Say that this app that uses GPS is developed by somebody related to Elon Musk or another billionaire on the Epstein files. So we have a powerful billionaire pedophile with real-time data of where users under 13 are, in real time. Or where users between 13 and 16 are. This doesn't sound like a good idea. c:5

But then even if the app is developed by a good person, security could be not well implemented. And bad actors could have access to it. And if web-sites could have access to this via the API that they are talking about here. Oh boy... Malicious websites will now be able to gather this sort of data themselves based on the IP ( which is an encoding of the location of the device, roughly speaking ).

Think about it. A kid wanders around on the inter-webs to find some web-browser games to play. Gets to a shady website with bad security or something. This website already knows the IP because the server needs the IP to send the webpage to the client. But because there is this age-bracket thing, now the server operator ( of this shady website ) also knows which IPs belong to people under 13. Or between 13 and 16. Yeah... not good at all.



Okay, so "general purpose computing device" only with connection to the internet presumably? Am I getting it right? If this "device" is not connected to the internet, or is not a "general purpose" device, it is exempted from this bullshit? I really wish you could just claim a purpose for your computer and be exempt from this. c:6

c:7

Oh come on.

c:9

This seem to ( at least from reading it out loud ) confirm that the device should be connected to the internet. In all of those cases "internet website", "online service" and "download of application" it seems like the internet is implied pretty much everywhere. But maybe if one has a flash-drive or a disk with an application on it. Installing it from said disk, would be considered "downloading". I kind of hate how vague it is.

On the other hand section number 2 creates a cool loophole, "does not mean an online service or platform that distributes extensions, plug-ins, add-ons," which could be used already for certain operating systems such as "GNU Emacs".



Okay this is interesting in the context of Free Software where the user is technically a "person that owns, maintains, or controls and application". But also, does that mean that every single maintainer is automatically a "developer"? Could be important to clarify.

Imagine you contribute 1 line of code somewhere. Then, years later, you travel to California just to find a you have to pay a huge penalty, for violating this law. c:11



Same thing? Wait a second. Does that mean that a user of a GNU / Linux operating system is technically an "Operating system provider" in this case? c:12



The word "secure" here could be a problem. There was no definition of "secure" anywhere. So that is probably too vague and will result in legal shenanigans.



Wait a second. Does that automatically exempts all people that are over 18 from this bullshit? But there is a catch 22 in this. How would a system or an application know that the user if over 18 to know to not ask the age from the user if it didn't ask the age of the user? Laws which create catch 22 situations in my opinion are too buggy to be implemented into the law. This pull-request should have been rejected by the congress based solely on this blunder. c:13

Also what about sharing? You know there are families that have one computer in the living room. And all the people in that family are equally the "primary users" of said computer. This law breaks apart if you think about it even for a second longer than 2 minutes.

Rules

Okay... so we are done with the definitions. Now come the the rules themselves.

So based on the terms of 1798.501. (a) An operating system provider shall do all of the following:



Wait a second. There is a definition of "account holder" in the definitions, but not of the "account" itself. Do the lawmakers think that all operating systems require an "online account"? Or is it more like a username account on the host machine? Like there could be operating system without an account. Or is in this case the "admin" account is the "account" in question? Not defining "account" will make for some rather stupid court cases. What the fuck is this shit?



The whole idea that the operating system will need to "provide" something to the "developer" on "request" is ridiculously insecure. The operating system should not do anything that the user doesn't want it to do. This is security 101. Yet it seems like the law it trying to establish holes in this simple premise. And I presume, they will punish the "Operating system provider" for non-compliance.

If we think that "Operating system provider" is the user in the case of GNU / Linux. Does it mean that California could punish people for changing their own operating system? This sounds like a step towards making Free Software illegal.

On the other hand if "Operating system provider" is not a user, but a distributor of a distro, does that mean that if user changes ( or can change ) their operating system the distributor of the distro is punished?

In this case it sounds even worse. It almost sounds like distributing GNU / Linux in California would either violate the law of California or violate the GNU GPL ( under which the system is licensed ) because it explicitly prohibits such restrictions. Which mean GNU / Linux is not just forced to invade people's privacy, but is potentially totally illegal in California from now on.

Think about it. They are making Free Software illegal!!!

But here is the funny thing. If this makes GNU / Linux ( or other systems under GPL ) illegal in the state in this way, this would probably fuck up the state in very severe ways. Pretty much the entire infrastructure of the modern internet is built on Free Software operating systems and other Free Software tools. If they make GNU / Linux illegal ( even if they didn't really want to do that ), they make most internet servers in California illegal. They make their digital infrastructure illegal. They will be forced to either drill holes into the law, or face returning to the 1980s. This is so fucking stupid! c:14



Aha... an attempt at sounding "pro-privacy" again, despite just stating "Provide a developer who has requested a signal" with the god-damned signal. I know the lawmakers that wrote this shit are idiots ( for the reasons already stated above ) but do they think we are idiots too? I mean, don't get me wrong, we are idiots. But this is beyond ridiculous.



Wait. That just got darker, quick. Because here is the thing. Until now I thought that the software itself will be basically using the data to decide upon the user's age. But that seems to me like anybody who want to develop any software and distribute it in California will need to actually receive the age of the user themselves. Not the program would store it, but the developer.

It basically forces every app developer to have a personal web-server. That is "secure" ( without actually knowing what it means ). That is not a third party system, because (3) states "shall not share the digital signal information with a third party", unless "for a purpose not required by this title" means that third parties can actually get this data, in which case most developers will just use some bullshit, shady, organization for this that puts everybody's privacy at risk.

That could still mean that "developer" in the case of Free Software refers to the user. At least if the user touched some code and compiled the program. Does that mean that pre-compiled Free Software and or small programs that do not need internet access are illegal in California now? Is ls now illegal? You know the terminal program that lists folders. Or does that mean that the developer of ls will need to make it send the age of the user over the internet to the developer, to comply with this bullshit? Imagine how much additional bloat there will be in every small piece of software, just to make it legal in California. c:15



Obviously the first thought that comes with this kind of system, to avoid this effecting you or your children is simply to default all accounts to be "18+". If the user can simply lie about the age, it seems like a slightly lesser problem. This lie would eliminate any ageism and would make the data pretty much useless to the attackers. But it seems like the law is trying to address this loophole. And based on the language "A developer shall not willfully disregard" it suggests that the lawmakers have no clue how software ( at least Free Software ) is developed. Or, as could be theorized, it might be that who-ever wrote this law is specifically trying to attack the development of Free Software. c:16 c:17

This sounds almost like a conspiracy theory, but remember Silicon Valley is in California. And those people would benefit if everybody was forced to use their enshitiffied shit instead of moving over to software that respects the user. Drafting a law that seems to "protect the kids" with a red-herring about "privacy" to get the congress to vote on it, is exactly the kind of thing those people know very well how to do. This seems like these people have designed multiple legal viruses. Little Trojan-Horses of legality. And the government has no security against it what so ever. Where is the damn legal anti-virus when it is needed? Where are the people pointing out the damn flaws? Where is the resistance? Oh... right... people are too busy yelling at each other about ICE, Iran and Epstein. Well timed, lawmakers, well timed!

c:18

Yeah... classic legal bullshit. They create a security vulnerability ( aka every developer now knows the age of every user ) and they patch it with: Don't use it for evil things, please. Really?



I'm reading it and all I can think about is "forced updates". Like... how else you would comply with it if you don't force updates on your users? They are basically trying to make non-Windows-11 operating systems enshitify themselves to be as atrocious as Windows 11, or else, punishment.

Speaking of punishment:



First of all, what the hell is "per affected child"? You are asking there to be a way for people to say how old they are, to the software. Where the hell is a victim here? If the victim is a "child" that is affected by bad privacy, then this law makes all software simply illegal. This whole concept is bad for privacy to begin with. If "bad privacy" is any other bad privacy, but not one described in this law, because the device sent a wrong age to the application, than if the child lies about their age, the developer is liable for a penalty of $2500? c:19

Wait, $2500 is for "negligent violation". $7500 if for "intentional violation". So if the child "intentionally" lied, the developer pays $7500? Or wait... "A person that violates" need to pay $7500... The child needs to pay $7500? Who is that person? What are you talking about? This makes no sense what so ever? How was this excepted? What is going on? Did the voters even read the damn text? c:20

To be frank, there is a possible loophole which is good actually. It says "taking into consideration available technology" which probably means that Free Software ( who's whole point is to be user-editable ) could be considered a limitation, which exempts the developer from liability. Obviously this is a very vague interpretation. But maybe it means that this is not going to make Free Software illegal after all. The only problem is, I think, is that these law-makers probably don't understand how Free Software works. And that would lead them into not understanding this particular technological limitation of it: The fact that the user actually has control over per device, fully. c:21

Conclusion

This is dumb! Really, really dumb.

Instead of adequately protecting privacy of all people, this legal framework separates adults as those not needing much protection. This is ageist towards adults. And this one discrimination leads to the rest of thing pretty much making zero sense.

Obviously, this could be an attempt to limit access to things, by children. Limit their access to pornography or information about things that they might need to or want to know. In which case it is censorship, coming from ageism against kids. Either-way you look at it, the whole premise is bad to begin with.

The privacy argument doesn't work because adults are not smarter than kids. The "dark patterns" and various other forms of manipulation still effect a lot of adults worldwide, despite the claims that they must have more experience, or something. And they have way less experience than what the law-makers think they have because of the argument number 2. If we successfully limit what information is accessible to our kids, we limit how much they can learn. And those that don't learn nothing, end up being the dumb adults in the argument number 1. ( Making it the second catch 22 in this law ) c:22

The foundational principle behind this law make zero sense. And if anything, only probably will make things worse. And I'm not even talking about the blatant security nightmare that are the implementation details listed in the legal-text. This legal text requires bloat and requires so much bullshit to be present on the operating system ( and various software ) that it would make GNU / Linux pretty much ( potentially ) illegal in the state of California.

The dumbness of the text and the utterly illogicality of it all makes me think that the text was generated with a large language model. And then the red-herring in the beginning makes me see here nothing but a Trojan-Horse.

Who are those stupid motherfuckers that voted for this shit? This law sounds dumber than the End User License Agreement of Microsoft Windows and that shit is outright evil. Are you kidding me?

I have no words. We are fucked.

We have to all just become anonymous. If you ever touched even a single line of code, do not ever travel to California. This is fucked up. This is fucked up! Fuck!

Happy Hacking!!! c:23 c:23

4

Find this post on Mastodon

Find

  Mr. Funk E. Dude c:0


@blenderdumbass This is beyond stupid. Can't wait to verify my ago on my refrigerator. 🙄

  Troler c:1 March 03, 2026




What if... knowing who is the child causes more problems than it resolves?

  Troler c:2 March 03, 2026




I believe there are more cases of adults doing stupid things than children, because they have trained themselves to not reason or act with caution. There is this self-preservation instinct in children, though, it can be overwritten by ignoring it.

  Troler c:3 March 03, 2026





It's basically when a person is asked a question and they nod and derail the entire conversation, so you'd forget that they haven't answered.

  Troler c:4 March 03, 2026





Remember, CIA kills using metadata.

  Troler c:5 March 04, 2026





It's amazing, now the billionaires won't have to look hard to find minors. I highly approve this law as a convicted pedophile.

  Troler c:6 March 04, 2026




Wait, are the Raspberry PIs, which are mini computers running Linux, used by vape detectors going to have to report the age of the kids to the app store?

  Troler c:7 March 04, 2026




So are emancipated adults in this list?

... replies ( 1 )

  Troler c:8 March 04, 2026



@Troler Basically emancipated kids are now outlawed from using computers, WTF

  Troler c:8 March 04, 2026

... c:7

  Troler c:7 March 04, 2026

(d) “Child” means a natural person who is under 18 years of age.

So are emancipated adults in this list?

@Troler Basically emancipated kids are now outlawed from using computers, WTF

  Troler c:9 March 04, 2026




This includes git. Welp, say goodbye to Free software distribution. Now you need to prove to be adult to be able to look at the source code of applications. How convenient for Big Tech...

But wait! AI scrapers are exempt from this law.

  Troler c:10 March 04, 2026


If an application is installed by a robot, say a script that clicks "continue", then the law is bypassed!

  Troler c:11 March 04, 2026




2027 a new type of crime is created, contributing to Free software, because anyone can fork your code and invalidate the law. Since you are the developer, you must pay for what they did.

  Troler c:12 March 04, 2026




With the amount of effort I have to put to keep Linux floating, makes me feel like a developer.

  Troler c:13 March 04, 2026




Sorry friend, git now requires age verification and you are under the age of 18 by default, because you didn't share data with the app store.

  Troler c:14 March 04, 2026




Don't worry, your beloved AI is going to run on Windows Server.

  Troler c:15 March 04, 2026




That's why following laws that are impossible to follow is so common. There are more laws being written then removed, which naturally means they are going to contradict each other. This is basically... the Talmud.

  Troler c:16 March 04, 2026




10 years ago I was using my moms account. I set the age of the account to my birthday and Google locked me out, requiring for the parent approve the usage of the account. There was no parent account. I was 10 years old. My mom lost access to her account because of ageism.

  Troler c:17 March 04, 2026




Bill Gates famously said GPL is a virus...
Bill Gates lives in California...
Bill Gates is in the Epstein files...

I see a Vienn diagram.

  Troler c:18 March 04, 2026




This is basically a loophole for a hacked, terrible, data-leaking API to be created. You know, like captcha.

  Troler c:19 March 04, 2026




It's like with CSAM. To protect children against 0.001%, their privacy is stripped and to make it worse fed to an AI.

And CSAM is still applicable!

  Troler c:20 March 04, 2026




Of course, it's all to protect the children from the danger of money. You see, when children are well fed and their parents are able to keep food on the table, they have no need to work. With this law, California shall once again bring back child labor, so children could pay of the debt of lying about their age on Facebook. All hail coal mines operated by children! Vivat Child Labor!

  Troler c:21 March 04, 2026




I don't think they even know how software and computing works, using the entire law as the proof.

  Troler c:22 March 04, 2026




I sneezed when reading this part. This must be my bullshit senses acting up.

  Troler c:23 March 04, 2026




According to the Assembly Bill No. 1043 of the State of California that is illegal, since a user engaging in the activity of hacking, alters and modifies the source code of the given program, be it running or compiled. Which means they become the developer and are thus responsible for all people under 18, including and excluding emancipated minors at the same time, inputting the wrong age.

Happy Hacking!!!

Post