Reading List
The Case Against Age Verification
The arguments against mandatory age verification are not new, and they are not ours alone. Cryptographers, legal scholars, civil liberties organizations, and journalists have been making them for years. This page collects the sources we rely on, organized by the argument they support.
Primary Sources
California AB 1856 — The Open-Source Exemption
On August 27, 2026 the California Legislature passed AB 1856, which adds § 1798.500(g)(2) to the Digital Age Assurance Act and excludes free-software distributors from the definition of "operating system provider." Coverage of the bill has been inconsistent about what it actually says, so these are the documents themselves. Read them instead of us.
California Legislative Information
The operative language: "'Operating system provider' does not mean a person or
entity that distributes an operating system or application under license terms that
permit a recipient to copy, redistribute, and modify the software."
The bill also adds § 1798.500(c)(2), excluding
software components not offered as stand-alone executables, and
§ 1798.500(e)(2), excluding stores that
distribute only extensions and plug-ins that run inside a host application.
The words "GPL," "MIT," "BSD," "Apache," "open source," and "free software" appear
nowhere in this bill. Neither do "repository," "container," "GitHub," "GitLab," or
"Docker" — that language belongs to Colorado's SB 26-051 and has been
repeatedly misattributed to California's. The test here is functional and has three
prongs: copy, redistribute, modify.
California Legislative Information
The carve-out first appears in the version read second time and amended on
May 18, 2026. Assembly passage 68-1 on May 26. Senate third reading and
amendment August 21; Senate passage August 26 with zero no votes; Assembly
concurrence 69-0 on August 27, then to Engrossing and Enrolling.
Two official records disagree slightly on the Senate vote — the daily history
reads "(Ayes 39. Noes 0.)" and the roll call reads 40-0. We cite both rather than
pick one. Nothing turns on it: no senator voted against.
Electronic Frontier Foundation
"One Step Forward, Two Steps Back: CA's AB 1856 Exempts Open Source But Expands Age-Gating"
·
"California Steps Back From Dangerous Expansion of its Age-Gating Law"
Read in sequence, these two posts are the honest account of the bill. In May, EFF
opposed it: the exemption was "a meaningful improvement and a welcome relief for
open-source developers," but the bill simultaneously added browser providers and
website operators to the list of entities bound by the age-bracketing regime. In July,
after that expansion was stripped, EFF withdrew its opposition — while stating
plainly that the underlying framework still "threatens online anonymity, privacy, and
security."
EFF withdrew its opposition to the amendment. It did not withdraw its
objection to AB 1043, which takes effect January 1, 2027 unchanged for
everyone the exemption does not reach. We take the same position.
Illinois General Assembly
The counterexample, and the reason the California result should not be read as a
trend. Illinois enacted the same OS-level architecture — account-setup interface,
birth date or age, four brackets, real-time signal to any requesting operator,
minimum-necessary transmission — with no open-source exemption of any kind.
House 82-27, Senate 57-0, House concurrence 113-0.
EFF urged a veto
in June 2026. So did NetChoice. The Governor signed it.
National coverage treated this as a social media bill about algorithmic feeds and
overnight notification curfews. The operating system provisions are in the enacted
text. This is the second time the same thing has happened, and it is the argument
for reading statutes rather than headlines.
Privacy & Surveillance
Age Verification Is Surveillance Infrastructure
These sources establish that no age verification system can operate without creating a surveillance mechanism. The technical constraints are not engineering problems. They are fundamental.
Electronic Frontier Foundation
The most comprehensive single resource opposing age verification mandates. Covers
terminology
(the critical distinction between age verification, estimation, and assurance),
technology analysis
(including device-level age attestation as a distinct category from mandatory verification),
who is harmed
(with hard exclusion statistics across nine affected populations), and
why it doesn't protect children.
The hub's primary focus is website and platform age gates. The gap between web-focused
age gating and OS-level mandates like AB 1043 is precisely
where Ageless Linux operates.
The EFF built the definitive counter-resource for the web. We built the counter-resource for
the operating system. Start at eff.org/Age.
Georgetown Law / Columbia University
Analysis demonstrating that all proposed "privacy-preserving" age verification schemes either leak
identity data or can be trivially circumvented. The technical limitations are fundamental, not
engineering problems. Even zero-knowledge proofs cannot solve this cleanly.
If the best cryptographers in the field say it cannot be done privately, then AB 1043's implicit
assumption that a non-invasive compliance path exists is false.
Medium
If a system can determine someone's age, it can determine who they are. There is no technical
architecture that separates age from identity. The phrase "privacy-preserving age verification"
is a contradiction in terms.
Ageless Linux is a physical instantiation of this argument. We built what honest compliance
looks like: a system that does not ask.
Communications of the ACM
Age verification systems create centralized stores of personally identifiable information that
become high-value targets for data breach. The "protection" infrastructure creates more risk
than the harms it claims to prevent.
The Ageless Device collects a name and refuses an age. It is more protective of user data than
any compliant system can be.
International Association of Privacy Professionals
The privacy compliance industry's own professional body examines the gap between age verification
theory and practice. Device-level solutions provide consistent controls but cannot account for
developmental context. App-based systems offer tailored experiences but face interoperability
challenges and rely on accurate self-reporting. Enforcement has been "inconsistent or easy to bypass."
When the people whose job is to implement privacy compliance publish skepticism about age verification's
viability, that is a different flavor of credibility than advocacy organizations saying the same thing.
The IAPP is not an activist organization. It is the professional body for privacy officers. Its
assessment confirms that the technical problems are not a matter of opinion.
Constitutional & Legal
The Right to Be Unknown
Stanford Technology Law Review
Published in the Stanford Technology Law Review — one of the top-tier legal journals in technology law.
Age-gating laws inevitably segregate children into a separate, inferior internet experience and suppress
their access to lawful speech. The "segregate-and-suppress" framework maps directly onto AB 1043's
architecture: identify children (segregate), then restrict what they can access (suppress).
The REFUSAL notice and the peepee app are concrete demonstrations that the segregation step is the
law's actual function, not the suppression step.
The Verge
Age verification laws eliminate online anonymity — not just for children, but for everyone. You cannot
verify a child's age without requiring adults to prove they are not children. The right to anonymity is a
prerequisite for free expression.
The Ageless Device's core design decision — collects a name, refuses an age — is an anonymity argument
made physical.
U.S. Supreme Court / Electronic Frontier Foundation
The Court upheld Texas's age verification law for sexually explicit content under intermediate scrutiny,
but the ruling was narrow: it applies only to age restrictions on sexual materials that minors have no
legal right to access. The dissent (Kagan, Sotomayor, Jackson) argued the law should have faced strict
scrutiny and that it burdens adults' access to lawful speech. The decision does not authorize broader
age-verification mandates on social media, general-audience websites, or app stores. AB 1043 was
designed to survive Paxton by avoiding content regulation entirely—it mandates age
collection at the OS level regardless of content. But the enforcement paradox Ageless Linux has
identified (fines assessed "per affected child" requiring the very data collection the law mandates)
may reopen the constitutional question.
Even the courts that upheld age verification acknowledged it creates constitutional tension. AB 1043's
drafters tried to thread that needle. We are the proof that the needle has no eye.
For our analysis of AB 1043's legislative history, industry endorsements, and the model-bill pipeline, see The Lobby: Who Wrote These Laws.
Industry Capture
Who Benefits From Compliance Moats
Electronic Frontier Foundation
Age verification mandates entrench dominant platforms that already collect age data and impose impossible
burdens on smaller platforms and open-source projects. The compliance cost is zero for Apple and Google
and existential for everyone else.
AB 1043 passed 76-0 in the Assembly and 38-0 in the Senate with the explicit support of Apple and Google.
The EFF explains why.
Electronic Frontier Foundation
A comprehensive alternative framework. Rather than requiring identity verification to access content,
regulate the harms themselves: ban behavioral advertising, require real data minimization, prohibit
deceptive design patterns.
The alternative to AB 1043 is not "nothing." It is regulating the business model that created the problem
instead of building surveillance infrastructure to manage its symptoms.
ICMEC
The actual model bill text drafted by ICMEC and presented to state legislatures. Not a policy
recommendation — a ready-to-introduce statutory draft, published with a technical whitepaper,
constitutional analysis, and FAQ.
AB 1043 is not an original piece of California legislation. It is a copy of this template.
Virginia General Assembly
Documents ICMEC’s November 6, 2024 presentation of the DAAA model bill to Virginia’s
Joint Commission on Technology and Science and the resulting request for draft legislation by
Senator Craig.
Primary source showing the model bill pipeline in action — presentation to legislature,
draft bill request, same session.
U.S. Supreme Court
Thirty-four companies that sell age verification tools filed in support of mandating age
verification. The vendors asking the court to create their market.
The age verification industry has organized to lobby for the laws that generate its revenue.
Effectiveness & Harm
These Laws Do Not Protect Children
Electronic Frontier Foundation
Hard numbers on who age verification excludes. 15 million U.S. citizens lack driver’s
licenses. 34.5 million lack current ID matching their name and address. 100 million people
worldwide have facial differences that defeat biometric estimation. 43% of transgender
Americans lack identity documents reflecting their actual identity. 18% of Black adults lack
licenses compared to 5% of white adults. Foster youth without legal guardians, domestic abuse
survivors relying on anonymity, LGBTQ+ youth whose internet access is a lifeline — nine
populations documented, each harmed differently, all harmed first.
AB 1043’s self-declaration model avoids some of these exclusion mechanisms. But the
infrastructure it builds — exact birth dates stored in OS user records — will be
used by the next law that requires verification, not just declaration. The exclusion pipeline
starts with collection.
Center for Democracy & Technology
Primary research showing that teenagers and parents view age verification as both ineffective and
privacy-invasive. Teens bypass it trivially. Parents prefer education and conversation to technical
controls.
Every child will lie to a dropdown menu. The CDT's research confirms what every parent already knows.
UNICEF
The international child welfare organization concludes that age restrictions are not a substitute for
platform investment in child safety. Many children will access platforms through workarounds or less
regulated alternatives, making them harder — not easier — to protect.
When UNICEF — whose entire mission is child welfare — says age restrictions alone are insufficient,
the "but think of the children" argument loses its last institutional defender.
New America / Open Technology Institute
Policy analysis cataloging the practical failures of age verification: false positives locking out
legitimate users, false negatives letting children through, and the impossibility of a system that
does both well.
The statute assumes a technical solution exists. The policy research says it does not.
Tech Policy Press
Age verification systems that require government ID disproportionately exclude trans people whose
documents do not match their identity. The harms are not hypothetical — they are documented and ongoing.
The people these laws claim to protect are among the first people they harm.
Further Reading
Trackers, Advocacy, International Context
These resources provide broader context on the age verification debate. They are not all directly cited in our arguments, but they inform the landscape we operate in.
Age Verification and Age Gating: Resource Hub
Electronic Frontier Foundation
The EFF’s comprehensive resource hub. Terminology guide, technology analysis (including device-level age attestation), harm documentation with exclusion statistics, legal analysis, and advocacy tools. Start here for the web-focused case; see above for our OS-level citations.
"Does the Tech Even Work?"
Electronic Frontier Foundation
Technical analysis of age verification methods: attestation, estimation, and ID-bound proof. Discusses device-level age settings on operating systems as a distinct (and voluntary) category, facial recognition accuracy failures across demographics, data broker partnerships for age inference, and the AU10TIX breach. Concludes no method is “entirely privacy-protective, fully accurate, and guarantees complete coverage.”
"Behind the One-Way Mirror: A Deep Dive Into the Technology of Corporate Surveillance"
Electronic Frontier Foundation
Foundational report on corporate third-party tracking infrastructure. The surveillance systems age verification builds on.
"Stop Online ID Checks"
Fight for the Future
Grassroots campaign and coalition letter signed by 90+ reproductive rights, LGBTQ+, and civil liberties organizations.
"Fighting Age Verification"
Woodhull Freedom Foundation
Fact-checked resources on constitutional and privacy concerns with age verification mandates.
"Statement on Age Gating"
Manushya Foundation
International human rights perspective: age gating as mass surveillance and identity-based discipline.
"Regulating Age Verification"
Open Rights Group
UK perspective on age verification under the Online Safety Act. The same problems, a different statute.
"Project 2025 Co-Author Caught Admitting the Secret Conservative Plan to Ban Porn"
The Intercept
Hidden-camera recording of Project 2025 architect describing age verification laws as a "back door" to a national pornography ban. Ageless Linux is not about adult content — but the legal infrastructure AB 1043 builds at the OS level is the same infrastructure these actors intend to repurpose. Age collection interfaces built for "child safety" do not come with a promise about what they will be used for next.
"SCOTUS Won't Hear the Real Reason Porn Age-Verification Laws Are Spreading"
The Intercept
Analysis of the political strategy behind age verification legislation and the gap between stated and actual legislative intent.
"Is Jonathan Haidt's Book Right About Smartphones?"
TES Magazine
Critical examination of whether the "phones are destroying children" narrative holds up under scrutiny. Spoiler: the evidence is weaker than the headlines.
"I Pulled the Actual Bill Text from 5 State Age Verification Laws"
Reddit / r/linux (/u/aaronsb)
Side-by-side comparison of bill texts across five states showing two distinct templates — one covering app stores (Template 1) and one covering operating systems (Template 2).
"Who Wrote Template 2? Following the Money Behind OS-Level Age Verification Bills"
Reddit / r/linux (/u/aaronsb)
Traced the DAAA model bill to ICMEC, documented Common Sense Media’s funding flows, identified AVPA as the vendor trade group, and mapped the revolving door between CSM and the California legislature.
Ageless Linux does not claim to have invented these arguments. We are standing on the scholarship of cryptographers, legal scholars, and civil liberties advocates who have been saying these things for years. Our contribution is a bash script and a $12 computer. The argument was already won. The legislature passed the law anyway.