Comply with California Age Verification law

[danirabbit]

Problem

New age verification regulation has passed in California and will go into effect January 1st 2027.

https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260AB1043

Proposal

A high level summary of the requirements is that:

• during account setup we will be required to indicate the user’s age and
• use that information to somehow gate content. It sounds like app developers need to be able to access this info.

So my guess is that we’ll need to add a property to the account portal to satisfy the requirement

Prior Art (Optional)

Information I’ve seen so far indicates Apple and Google are sorting users into 4 age brackets, so exact age doesn’t seem to be a requirement.

Apple has details of its plan here but I don’t think all of this exact implementation is required by the law: https://developer.apple.com/support/downloads/Helping-Protect-Kids-Online-2025.pdf

[danirabbit]

I'm digging into this a bit more this morning and I found something really interesting in Apple's implementation. It seems that what they do is that apps will send an array containing 3 age gates and their API responds with two ints, a lower bound and upper bound. The values of the lower and upper bounds will be either -1 or the value of one of the gates you sent. Lower is the lowest age gate they exceed and upper is the highest age gate they are below. For example:

I send the api an array of [9, 13, 16].

If the API responds [9, 16], the child is older than 9 but under 16.
If the API responds [-1, 16], the child is under 9
If the API responds [16, -1], the child is over 16.

Apps can also send -1 for the last two ints, which seems to help with sending only the minimum information. For example: I send the api an array of [16, -1, -1], the api responds with [-1, 16] to let me know the child is under 16 or [16, -1] to let me know the child is over 16.

Their docs also say the system might respond with different values based on regulations in the region. So for example I send the api an array of [15, 16, 17] because I'm doing something nefarious, the api responds with either [13, 16] or [16, 18] to make sure it's returning a range and not an age.

It seems pretty clever. They also have provisions for declining to share based on region etc. Full documentation here: https://developer.apple.com/documentation/declaredagerange/

[danirabbit]

See also flatpak/xdg-desktop-portal#1922

[JeepConcierge]

instead of blindly complying with laws, better way is to oppose them. This way both sides win: you, because there is nothing to comply with and privacy respected community, again, because no such laws exists.
at the end, it is just some paper that was created by some random people - you wouldn't follow rules that i write, for example, so why do you want so bad to comply with something that was created by different random people?

[danirabbit]

@JeepConcierge elementary is a US company headquartered in California. We are required to follow the law. This law is enforced with heavy fines by the California Secretary of State which we are registered with. I don't have any room in my budget to mount any kind of opposition to this law. Following laws is not optional.

I'd encourage you to write your representatives and protest there. My hands are tied

[danirabbit]

Running iOS 26 here and there’s an age range sharing setting now with the default set to “Ask” and an option for “Never”. So that makes me feel more confident that we can do the same in portals and be in compliance:

But the way this is set up makes me think we do still have to store birthday on device even for adult accounts