The privacy implications for this bill for adults seem to be about the same as the privacy implications for the "Click if you are 18+" button on many websites.

If you are under 18 there is no checking to stop you from saying you are are 18+

The only people it seems might have their privacy slightly reduced are people under 18 who are using a computer or smartphone/tablet that had parental controls set up by presumably a parent or guardian before giving the minor access.

The bill requires that the parent be able to enter the minor's birthday or age in one place, and then provide a way that the age range (under 5, 5-10, 10-13, 13-16, 16-18, 18+) can be given to apps/sites if they ask for it.

Thus, if you are a minor using a device that was set up with parental controls and you try to use an app or site that is restricted, that app or site will find out your age range.

Is there irony in the fact that Americans will pass privacy invading laws to protect kids from porn, but not gun laws to protect them from being shot at in school? How many kids die from porn exposure every year?

Porn sites have been there almost 20 years. Why it is problem right now? Is there extensive recent research about it? Or now we just have the capability?

My favorite is Montana where you have to provide more identification to view a naughty jpeg then buy a firearm.

In practice, 100%. In theory we could likely design "good enough" anonymous systems that work like buying alcohol or tobacco in most countries (buy a scratch token in cash at a corner store after showing ID, picked at random from a box of them - contains a number, possession of which is theoretical proof that you had your ID verified at purchase)...but of course, the real purpose of age-gating is exerting a chilling effect, so we'll never hear about privacy-preserving methods.

(NB: I am firmly opposed to any of this. The solution for parents concerned about their kids is parenting and parental controls, not giving authoritarians of all stripes the means to snoop and ban whatever they decide is obscene or troubling.)

Big tech has generally not loved this because they know that adding friction like id checks massively reduces attach rates. This is watered down enough that it's likely seen as a lesser evil.

No one ever explains why it's so important that everyone always conceal their identity on the web, as though it were some global red light district. The most successful tech platforms all succeeded by getting people to be trusting enough to say who they are, like Twitter, Facebook, etc. It's worth billions of dollars to create any online space that isn't anonymous.

I think they love it to because it will be another barrier for a little small start up from entering the market. You'll need to spend so much on regulatory issues and compliance that only the biggest, established companies can have a business.

Google doesn’t need to identify you… you use Gmail.

And anyway, they created a library (https://blog.google/technology/safety-security/opening-up-ze...) to make age verification not useful for identification but still real.

So… I’m sure you meant fingerprinting but presumably porn sites already do that?

The text of this bill would be satisfied by a website simply having a "Yes, I'm over 18" button on the front.

There are legitimate arguments that can be made against this bill...that is not one of them.

> If age gating is inevitable

What could possibly make it inevitable? We are either okay with those with authority forcing us to ID ourselves in some form or we aren't.

and it seems as though it is

Only with that attitude will it be.

It would easily mean that you're required to have an unmodified device, running a locked down system, to be able to access any service that uses age verification.

Although, a much more sensible alternative, would be to have parents (that do want the control) give their sons devices that send the "minor alert" signal, and have the services detect that.

The language suggests to me that GitHub would be a covered app store and a FOSS Linux distribution without an age gate API would be illegal in California (along with all programs that don't check the age API, e.g. `grep`), so it seems quite a bit worse in terms of killing free speech and culture than requiring adult sites to check id to me.

Notably, a "covered app store" doesn't seem to need to be... a store. Any website or application that allows users to download software is covered. There's no exemption for non-commercial activity. So every FOSS repo and programs like apt are covered? The requirement is also that developers will request the signal. No scoping to developers that have a reason to care? So vim is covered? Sort? Uniq?

Honestly I can't believe big tech would go along with it. Most of their infrastructure seems like it would clearly be illegal under this bill. Either there's something extremely obvious I'm missing or every lawyer looking at this bill is completely asleep at the wheel.

>to provide a developer, as defined, who has requested a signal with respect to a particular user with a digital signal via a reasonably consistent real-time application programming interface regarding whether a user is in any of several age brackets, as prescribed.

Summary reads to me as this bill requiring calls to an API to verify the user's age.

Relevant Cory Doctorow https://pluralistic.net/2025/08/14/bellovin/#wont-someone-th...

It’s also regulatory capture. Harder for competitors to meet regulatory barriers

This is almost an amazing thing. Some common top-level way to set parental controls across systems would be a godsend. That’s all a giant pile of time-wasting shit right now.

However, any system that just uses age is useless. They’re always excessively cautious, so you may as well just not provide access at all for kids between the ages of 6 and 12 or so, if that’s all you have.

No, block all + allow lists are still where it’s at. Please make those work better.

(If anyone knows the magic to make Minecraft [java] work with macOS allowlist-only network access, I’d love to know what it is. The fucking launcher wants to talk to a half-dozen bare IP addresses to work, and the addresses change seemingly every single launch, from a pool of what must be many hundreds, at least, it’s completely unusable)

How does the government mandating the way an operating system works seem reasonable?

How to verify that device is not faking the age? I bet here comes the remote attestation…