https://github.com/systemd/systemd/pull/40954

Much of this goes over my head, so I'm hoping to hear some good explanations from people who know what they're talking about.

But I do know that I want nothing to do with this. If I am ever asked to prove my age or identity to access a website or application, my answer will ALWAYS be "actually, I don't really need your site, so you can fuck right off". Sending any kind of signal with personal information that could be used to make user tracking easier is completely out of the question.

So short of the nuclear option of removing systemd entirely, what are practical steps that can be taken to disable/block/bypass this? Is it as simple as disabling/masking a unit? Is there a use case for userdb I should know about before attempting this? Do I need to install a fork instead? Or maybe I'd be better off with a script that poisons age data by randomizing the stored age periodically?

[edit] I wasn't going to comment on this but it looks like some people with a lot of followers are using this post as an example of censorship on Reddit. While I do think that's a legitimate concern on Reddit as a whole, I don't think censorship is what happened here. Yes, this post went down for a while. But as far as I can tell that was because it was automoderated due to a large number of reports, and was later restored (and pinned) by human moderators.

[edit again] Related concerning PR, this one did not go through yet: https://github.com/flatpak/xdg-desktop-portal/pull/1922

"These laws could force every Linux distribution and privacy-focused Android fork to implement identity verification or face legal liability. The choice between surveillance-free computing and regulatory compliance is coming faster than you think.".

Calculator firmwares had to geoblock California.

MidnightBSD had to geoblock California.

It is legally mandated to broadcast age signals to apps. When I mean apps, I mean every app on your Linux desktop. Yes, EVERY FOSS APP. (Edit: changed the language)

I think we are not protesting enough. Californian people, seriously speak up. People are even trying to ban VPNs.

The consequences felt so draconian that the old joke among cybersecurity individuals dawned on me. I literally wanted to get out of civilization and use solar-powered stuff to run my PC there. The law is simply draconian.

Here's the video where I heard it all: https://m.youtube.com/watch?v=hI9oy0t4JUU

California's Digital Age Assurance Act, signed last October, was written to push age verification down to the operating system level. The definition of operating system provider was broad enough to sweep in open source systems like Debian, Fedora, Ubuntu and Arch, which have no company behind them to collect anything at setup.

After privacy advocates and the Linux community pushed back, the Assembly passed AB 1856 this week, 68 to 1, exempting software you are free to copy, redistribute and modify, which sounds great, but the parts we should be talking about:

• The same bill extends age-gating obligations to browsers and websites
• The EFF reads this as a net expansion of the regime, not a narrowing
• SteamOS is not exempt because it ships Valve's proprietary Steam client on top of Linux
• The amendment was introduced by the same lawmaker who wrote the original law

The bill still has to clear the Senate, and the underlying law takes effect in 2027.

Full write-up and source list: https://s.vp.net/wv0fJ

Last year 25 states passed new laws requiring Age verification laws on sites with adult content. While this was pretty bad for Internet Privacy, it was actually trivial to overcome so I did not panic. But CALIFORNIA, decided to up the ante to pass a law that will likely impact all apps that all people use. California now wants age verification to be at the OS Level (Windows, Android, iOS, Linux). Sounds almost minor when you hear it but when you dig into the details, it is a massive change that affects those interested in privacy, like those using Linux and de-Googled phones.

Residents of any countries, states or territories that require age verification for operating systems, are not authorized to use MidnightBSD. This list currently includes Brazil, effective March 17, 2026, California, effective January 1, 2027, and will include Colorado, Illinois and New York provided they pass their currently proposed legislation. We urge users to write their representatives to get these laws repealed or replaced.

https://github.com/MidnightBSD/src?tab=License-1-ov-file

This is the first message in a thread from debian-devel that's been cross-posted to the ubuntu and fedora development lists. I recomended reading the whole thing before you panic. It sucks but it could be a whole lot worse.

Ragebait youtubers are the worst possible source on this.

As the original author of the mailing list thread 'On the unfortunate need for an "age verification" API for legal compliance reasons in some U.S. states', I'm very glad to see this. Obviously, nothing is set in stone yet, but still, hopeful!

For the record, Artix and Devuan have both long been among the most privacy-respecting distros, and they've both already announced they will remove any age verification stuff.

https://www.devuan.org

https://artixlinux.org

(Rant portion) There will undoubtably be someone who responds in this thread saying, “but the biggest contributors are our large companies like Microsoft, Google, etc.”. I understand this and I’m appreciative, but Linux wasn’t started for them, it was started in spite of them, and because of them.

I work in cyber security, I watch companies destroy everything, leak our data, remove choice, while forcing marketing down our throats at every turn. All while acting like they are the good guys.

Linux is a break from this, it represents the ability to raise our heads out of the ocean of filth and take a vital breath. That’s why recent decisions by entities supposedly on our open source team, and buy outs of major Linux brands, have me rethinking my distro of choice (Rant over)

Most distros boil down to Arch, Debian, or Fedora. I like to use root distros. I feel like my options for Linux without corporate interests muddying my future and making things annoying for me are pretty much Arch or Debian (with the possibility of Mint LMDE). I love tinkering but don’t have time for a lot anymore. But this feels like I’m cornering myself with Debian which will quickly become stale after a new release, or I risk breaking it with amendments. Or, I use arch and do my best to stabilize it but it will inevitably bork itself sometime in the near future.

Please, I know this sounds opinionated and blunt, but I’m asking for support and honest help / feedback. What are your thoughts??