GrapheneOS Won’t Implement Age Verification

The security and privacy-focused GrapheneOS stated in an X post that they will “remain usable by anyone around the world without requiring personal information, identification or an account.”

With the passing of California’s Digital Age Assurance Act, set to take effect on January 1, 2027, all operating systems in California to collect age information from users and provide a real-time API that developers can access to see the age range of their users.

California joins Texas and Utah, both of which had lawsuits over potentially violating the first amendment. Supposedly, the California law avoids such issues by “focusing strictly on age assurance, not content moderation,” according to Buffy Wicks, author of the bill.

Concerns abound over how operating systems like most Linux distros which don’t typically have any online account system that could be used to keep track of a user’s age.

Some distros like Canonical’s Ubuntu are “reviewing it internally with legal counsel” but they have “no concrete plans on how, or even whether, Ubuntu will change in response.”

Fedora are exploring possible implementations that wouldn’t require any telemetry and just uses a local API.

Ageless Linux is a distro that’s “flagrantly noncompliant” with age verification laws. Their homepage lists how different distros have responded to the laws.

Apple has provided the Declared Range API to comply with laws in several countries and states for iOS and macOS and provided an FAQ to help developers navigate the complicated legal landscape that’s resulted from all of these disparate laws.

Android’s Play Age Signals API serves the same purpose. Both are currently in beta.

With varying and contradictory laws across so many different regions, not only do these laws pose a privacy concern, they’re also going to be difficult to enforce and cause chaos as developers and operating systems scramble to find ways to comply.

It’s unclear what the future holds for age verification, wherever the laws pass, there seems to be a trail of destruction in its wake.

GrapheneOS takes a bold stance against age verification that I wish more operating systems would take.

Age verification laws have been used by governments to attack websites that aren’t even hosted in their country, so it’s not far fetched to say that even if these laws aren’t in your region, they will still affect you.