We have no plans to introduce mandatory age or ID verification into Zorin OS.
As privacy and security are core values of Zorin OS, we're closely monitoring the unfortunate trend of new OS-level age verification laws and evaluating how we could avoid them infringing on our users' rights.
California age attestation law
We're aware of the elephant in the room that's been making headlines over the past few weeks, namely the California age attestation bill, which has already been signed into law.
As we're based in Ireland (both our company and ourselves personally) and don't have any physical presence or nexus in California, there's a possibility that this law may not be realistically enforceable on Zorin OS. However, I'm not a lawyer, so I can't give a concrete appraisal of how this law would work or its real level of enforceability.
Nevertheless, we've read the law ourselves to try to understand it. From our interpretation, the California age attestation law appears to require operating systems to do the following 2 things:
- Allow the user to input their age or date of birth when creating a local user account. This age only needs to be self-declared (like when you visit an alcohol brand's website), so the user could conceivably lie about it.
- Provide the user's rough age bracket to any apps that request it through an API. These age brackets would be one of the following:
- Under 13
- 13 to 15
- 16 to 17
- 18 or older
The law does not appear to do any of the following:
- Ask users to upload a photo ID, face scan, or any other personal information to verify their real age.
- Require users to honestly input their real age.
- Share the user's age/date of birth with any external entity. In fact, when an app queries the age signal API, the OS can only expose the user's rough age bracket (see above) and is prohibited from exposing their raw age/date of birth data to protect their privacy.
- Allow app developers to share the user's age signal their app received from the OS with a third-party for a purpose not explicitly required by the law.
- Require the OS to report any data to the government.
In summary, this seems to function like a parental control feature that the user could easily circumvent by lying about their age.
The fact that California is trying to force operating systems to implement this feature isn't ideal, but this isn't the heavy-handed privacy invasion it could have been. However, it's a slippery slope, and the proposed laws in some other jurisdictions aren't as promising.
Proposed laws in other jurisdictions
We're aware that other jurisdictions are also trying to put OS-level age attestation into law. For example, Colorado's proposed law appears to be identical to the one in California. There’s even a possibility that Open Source software (like Zorin OS) may be exempted from this law entirely.
However, the biggest threat to privacy comes from some other proposed bills that would require full age verification – instead of attestation – like the ones in Texas and New York. It appears that they would force users to upload personal information (like an actual ID or face scan) proving their real age before allowing full use of their own devices. This would be a significant invasion of privacy.
If these invasive laws are allowed to pass unchallenged, more jurisdictions may choose to adopt them. And if these laws will be actively enforced, we may have no choice but to formally pull out of the affected jurisdictions.
All is not lost
We're currently at a pivotal inflection point for this trend of age verification laws. The issue is now prominent enough for the public to recognise the risk to human rights, but it's too early to accept this as an inevitability around the world.
If you live in a democracy, it is possible to fight against overreaching laws and win. For instance, Louisiana's proposed online age verification law was successfully overturned in December:
While our team isn't able to single-handedly challenge every government under the sun about these laws, the broader Linux community still has a chance to turn the tide if we act collectively.
If you're concerned about these laws, I would encourage you to take a few minutes out of your day to contact your local representatives and ask them to oppose invasive operating system-level age verification.
This is vital to do now, even if your jurisdiction hasn't yet proposed an age verification law. By voicing these privacy concerns en masse, your lawmakers can be better informed about the public's opinion of these laws before they vote on them.
The more of us who make our voices heard now, the less likely we all will have to live with the consequences.
