It has never been about protecting children. It's about surveillance and control.
George Orwell would be inspired.
this post was submitted on 09 Mar 2026
45 points (100.0% liked)
Privacy
9170 readers
268 users here now
A community for Lemmy users interested in privacy
Rules:
- Be civil
- No spam posting
- Keep posts on-topic
- No trolling
founded 2 years ago
MODERATORS
If you fail to do this negligently, there's a $2,500 fine; if you do so intentionally, it's $7,500. That'll intimidate all those dotcom billionaires.
It's also about driving the players they can't control (e.g. volunteer open-source developers) out of the tech world. Only corporations will be allowed to develop software.
Combine this with Google locking down Android development, the moves to make it unaffordable to own hardware, and the attempts to prevent the use of E2EE and VPNs, and it's a multi-front global push to take computing out of the hands of the people. We are supposed to rent our tech from corporations with thorough surveillance in place, and use it only in the ways they permit. Anything else is considered subversive and a threat.
In the OS is where it belongs. But not like this.
Parental controls is the answer. The OS should be required to support robust APIs that allow parents to set the age of their child and prevent children from accessing apps or sites (via browser APIs that hook into the OS APIs) that are out of the age range. The only actual "verification" should be parents choosing to type in the number.
For sure. If we wanted to protect kids with no intrusion we'd just make an HTTP header that was "user age" and then let the sites decide what to show and what to block. Porn sites don't want to show dicks to 6 year olds, it'd be 10 seconds to make an nginx rule that says "if user age < 18, show static error page".
And that's it, easy peasy. If we wanted to, at that point we could start suing individual sites that choose not to use that information in order to get compliance, but probably we don't need to, since it's pretty easy to support and like I said, there's no money in showing these things to kids anyway.
But that's not what it's about.
There should be no mechanism broadcasting age information. Flip it, make websites contain content tags, browsers/OS would then block based on opted out content. Parents get controls, we get to keep our privacy.
That's effectively all the Californian law requires, and it doesn't even expose the age details to apps that ask for it.
The California law requires everyone to show their age, not just kids.
Forcing companies to respect voluntary parental controls is not even close to demanding everyone to prove their age.
The California law requires everyone to show their age, not just kids.
No it doesn't, at all. In fact it specifically says it only applies in the case where it's a parent setting up a device for a child.
You can read the actual law, it's short.
(a) (1) “Account holder” means an individual who is at least 18 years of age or a parent or legal guardian of a user who is under 18 years of age in the state.
(2) “Account holder” does not include a parent of an emancipated minor or a parent or legal guardian who is not associated with a user’s device.
(d) “Child” means a natural person who is under 18 years of age.
(i) “User” means a child that is the primary user of the device.
(1) Provide an accessible interface at account setup that requires an account holder to indicate the birth date, age, or both, of the user of that device for the purpose of providing a signal regarding the user’s age bracket to applications available in a covered application store.
(b) “Age bracket data” means nonpersonally identifiable data derived from a user’s birth date or age for the purpose of sharing with developers of applications that indicates the user’s age range, including, at a minimum, the following:
(1) Whether a user is under 13 years of age.
(2) Whether the user is at least 13 years of age and under 16 years of age.
(3) Whether the user is at least 16 years of age and under 18 years of age.
(4) Whether the user is at least 18 years of age.
Number 4 wouldn't be a thing if it didn't apply to everyone.
If the API can't respond with "is an adult", how should it respond when an adult is using it?
The API should work like parental controls: Is a kid and age bracket/meets minimum age. Anything else is a NULL or no age value.
If you have to say you are 18 then it applies to everyone.
Then that is the 18+ age signal. "This user is not covered by age restrictions" implies they're older than 18.
And as the law says...
(4) A developer that receives a signal pursuant to this title shall use that signal to comply with applicable law but shall not do either of the following:
(A) Request more information from an operating system provider or a covered application store than the minimum amount of information necessary to comply with this title.
(B) Share the signal with a third party for a purpose not required by this title.
Parental controls don't apply to anyone not using parental controls.
This applies to everyone.
Do you get how those are two very different things?
Yes. And why, dear journalists, are you reporting on this only now instead of last year before it passed the legislature?