Enforcement against Linux distributions, however, is likely to be problematic. Distros like Arch, Ubuntu, Debian, and Gentoo have no centralized account infrastructure, with users downloading ISOs from mirrors worldwide, and can modify source code freely. These small distros lack legal teams or resources to implement the required API, so a more realistic outcome for non-compliant distros is a disclaimer that the software is not intended for use in California.
this post was submitted on 02 Mar 2026
562 points (97.1% liked)
Technology
82131 readers
4575 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related news or articles.
- Be excellent to each other!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
- Check for duplicates before posting, duplicates may be removed
- Accounts 7 days and younger will have their posts automatically removed.
Approved Bots
founded 2 years ago
MODERATORS
That's what MidnightBSD did.
California residents are not authorized to use MidnightBSD for desktop use in the state of California effective January 1, 2027. California law CA AB1043 requires a complex age verification system implemented for operating systems with no exceptions for small open source projects. At this time, we don't have development time or a plan in place for this.
load more comments
(1 replies)
load more comments
(1 replies)
Time for US-based linux distros to move their servers elsewhere (if they haven't already).
The law does not require photo ID uploadsor facial recognition, with users instead simply self-reporting their age, setting AB 1043 apart from similar laws passed in Texas and Utah that require "commercially reasonable" verification methods, such as government-issued ID checks.
Seems toothless. Good.
load more comments
(5 replies)
This is stupid and a waste of my time.
Everyone not in California: mutes California
Many people here are going off on wild tangents over this. You should just read the law, it's only a couple thousand words of quite plain English.
Many here have taken completely incorrect assumptions from the title. This law is for developers, not users.
Summary:
- Requires OS devs ask for DOB, age, or both at account creation time.
- Requires an API that allows app store devs to request this age data for the account. At minimum this API must signal that the account is a member of one of these categories: 'user under 13, user over 13 and under 16, user is over 16 and under 18, user is over 18'.
- Explicitly bars OS devs from sending more data than explicitly necessary to meet 1 (hint: photo ID, facial recognition).
- Explicitly bars app devs recieving the data from requesting more data from the OS nor the App store.
- Bars app stores from using the data for any other reason and specifically calls out anticompetitive practices.
- Bars app store and OS devs from sharing this data with any third party for any other reason than to comply with this law.
- Has injunctions and civil penalties of $2500 (max per user) affected by negligent violations (eg a child account is served adult content), and $7500 (max per user) affected by intentional violations.
The only problem I have with this is that it should only apply to commercial software (app stores and OS). Libre/FOS software should not have to police ages on their app stores, due to their far reduced budgets (often zero), developer time, and the nature of the software being generally anti-centralized and anti-surveillance-capitalism. Though I'd be fine with it for FOSS software distributed via commercial app stores, as long as they gave a longer lead time to implement (EG a couple of years).
Im not sure I understand your point about this law being for developers not users.
The fines may only be applied to operating system developers for failing to implement these systems… but having those systems at all still drastically impacts end users in a negative way.
load more comments
(2 replies)
It says that OS developers must track users or be fined, so they will track users.
Explicitly bars OS devs from sending more data than explicitly necessary to meet 1
The statute does not define:
What counts as "minimum"
How necessity is measured
Whether "minimum" refers to data fields, granularity, frequency, or retention
Whether metadata (e.g., device ID, timestamp, API call logs) is included or excluded
This legislature calls App Providers and developers to track people and barely even gives lipservice to what is allowed.
We don't want our OS's tied to our identities. This does not explicitly forbid that
load more comments
(3 replies)
load more comments
(8 replies)
What if no internet? How set up?
Technically, Linux is not an operating system, just a kernel, so I'm not sure how this would be implemented.
See, here's the big open secret. All these politicians, who make all these rules? They don't have a clue what they're talking about. They think a kernel is something that gets stuck in your teeth whrn you eat corn.
load more comments
(4 replies)
load more comments
(2 replies)
I've always input my age as 1900-01-01 and I can't change that now because that'll show an inconsistency and we can't have that now can we.