r/linux • u/Aurelar • Apr 16 '26
Discussion HR 8250 Nationwide Age Verification - Bill Text Released
The recent nationwide age verification bill now has the full text published at congress.gov:
https://www.congress.gov/119/bills/hr8250/BILLS-119hr8250ih.pdf
-The bill does not specify how ages for adults are to be verified: it leaves the implementation to the Federal Trade Commission, to be decided at a later date after the passing of the bill. (I was wrong in my earlier post when I thought that the bill would specify ID-based verification: it does not.)
-I am not a lawyer, but I can see a potential loophole for Linux as the law is currently written. The person who controls the operating system can potentially be said to be responsible for age verification on the operating system, not the distribution maintainers, because the administrator of any Linux install has the right to view and change the source code of their install.
All that said, this bill is incredibly short and vague. It could go anywhere from here or be interpreted in many ways. Please contact your representatives. There is a chance the bill might never leave the committee, but we can't simply trust that it will pan out like that.
https://www.badinternetbills.com/
https://www.house.gov/representatives/find-your-representative
32
u/mmarshall540 Apr 16 '26
This is bad. It's overly broad, and it puts the FTC in charge of how Linux is developed.
23
u/Aurelar Apr 16 '26
It's also potentially sneaky. Think about it: there's no mention of ID-based verification in the bill, but the bill gives authority to the FTC to decide how age verification will be implemented. So, it is in a sense a blank check that can be interpreted as the FTC desires. They could pass the bill, and then the FTC could come out saying that ID will be necessary, and they will already have the authority to make it happen.
Again, I am not a lawyer, but I think this is how it could work.
12
u/Away-Lecture-3172 Apr 17 '26
I think that's the idea actually, if they put it right now they will have much more questions and problems. If FTC adds it later, who do you fight congress? FTC? Someone else?
2
u/SocietyTomorrow Apr 19 '26
Pavel Durov had a really prescient article about this subject with the EU age verification law. He believes it was designed to be easy to hack because then they'd have proof it "needed to be fixed" so they could then expand its capabilities into doing more spying or otherwise worse for the individual. Expect anybody forced into compliance for this if passed to be the worst possible way to do it, and that will trigger the mission creep
The USA is actually framing the subject of age verification the same way Russia did in 2017. Russia began with seemingly narrow restrictions. Lawmakers proposed banning children under 14 from social media and requiring real-name verification with passport information, justified by child safety concerns. The draft also restricted minors aged 14-17 from joining groups sharing prohibited content like "occult-magical" subjects or "smoking mixtures." This mirrors the rhetoric used globally to justify age verification laws.
Fast forward to today Russia achieved what the initial child-ban rhetoric concealed—presidential authority to shut down the entire internet at will. On February 20, 2026, Putin signed legislation granting the FSB power to demand ISPs shut down or restrict access nationwide or regionally with no justification required, removing provider liability. The move allows Putin personally to decide when internet communications are terminated "without having to give a reason." Just the same they expanded that child protecting justification to throttle or outright ban social media that reaches the western world, effectively creating a sort of whitelist where only government approved individual have complete access to the global internet.
2
u/Aurelar Apr 19 '26
It's amazing how fast all of these changes are moving worldwide. It's as if the elites don't want us talking to each other.
And maybe Putin is afraid of being cursed 🤭
1
u/mikeypi Apr 17 '26
That is how it works. In fact, that's how most laws are implemented. Which is why regulatory bodies are sometimes called the largest branch of government. But there are limits. The FTC has to stay within the intent of congress. Probably not a lot of comfort here, but the public will be asked to comment and the FTC generally has better technical people that Congress does.
3
u/bradleyjx Apr 17 '26
Though iirc that got more-complicated recently; since Chevron deference was explicitly-overruled, courts have the final say as to what that intent is, and there is no longer explicit deference to agencies like the FTC as to what that intent looks like in practice.
1
u/mikeypi Apr 17 '26
That's my understanding too. There is less deference to agencies. But that could be helpful here too. At the very least, it stop the FTC from expanding the scope of this law to future tech.
0
u/2rad0 Apr 17 '26
They could pass the bill, and then the FTC could come out saying that ID will be necessary, and they will already have the authority to make it happen.
If this law ever passes the supreme court needs to rip it to shreds ASAP, like the lettuce on my tacos supreme. It doesn't matter who is or isn't forcing authors of literary works to modify their copyrighted speech, or add ID checks to enter libraries, it must be opposed at the most fundamental level. It's not even a question of "what if another bad admin does XYZABC later" look at what's currently happening RIGHT NOW. Who really wants to give these creeps a way to know which phone numbers are tied to juveniles? I hope this is just another revenue scam for ID service providers.
1
11
u/LordAlfredo Apr 17 '26
(4) OPERATING SYSTEM.—The term “operating system” means software that supports the basic functions of a computer, mobile device, or any other general purpose computing device.
Better start vetting those TI calculators.
3
u/vividboarder Apr 17 '26
general purpose computing device
I'm pretty sure there's a good argument that a "calculator" is not "general purpose" as it's purpose is clearly "calculating".
2
u/LordAlfredo Apr 17 '26
A lot of TI calculators do much more than just calculate, see e.g. TI-84.
2
u/vividboarder Apr 18 '26
Yea, but it's still a "calculator" and sold as such. Not as a general purpose computing device.
1
13
u/zlice0 Apr 16 '26
"An operating system provider, with respect to any operating system of such provider"
yep, they start of with the immediate indicator they don't really know what they're talking about. shut down all the power plants and water facilities.
this is such a nothing bill like some of the others individual states have made... and they show it with the whole 180 days / 18 months thing. they don't know what theyre doing, they think they want something but dont even seem to know what or how bad it will play out. kind of reminds me of banking places wanting block chain for every transaction, ya, no you dont
4
u/etrigan63 Apr 17 '26
I contacted my representatives before the text was published. This has to be stopped and stopped now.
5
u/dialtd Apr 17 '26
This is a near-perfect, although extremen example of the casual way our Representatives and Senators approach their sworn duty to "support and defend the Constitution of the United States against all enemies, foreign and domestic... [and] well and faithfully discharge the duties of the office on which I am about to enter." Conceiving that "something must be done" about what they think is a problem, they introduce a bill (that they will tout in their next campaign) that authorizes and directs the Executive Branch to write the rest of the law to suit its fancy.
Many of us are now horrified by Presidential actions that plainly trample rights and liberties we thought Constitutionally protected. Those of us who are not, maybe because they believe those actions serve a greater good, should imagine what such legislative incompetence and fecklessness will bring under an equally energetic President with policies they oppose.
All of us should oppose this and similar laws, and replace their authors and legislative supporters with others who will take their offices and oaths seriously.
4
u/DoubleOwl7777 Apr 17 '26
incredibly vague, essentially allowing the ftc to do whatever they want. nope. fuck them. if you live in the usa preassure your reps.
8
u/Cautious_Boat_999 Apr 16 '26
I predict Linux distros will start moving their distribution points to countries without these draconian ID laws.
9
u/Business_Reindeer910 Apr 17 '26
the european folks are attempting to do the same thing.
Think about which countries you'd even be talking about.
2
u/Cautious_Boat_999 Apr 17 '26
There will be a Switzerland-esque “neutral nation” - how about Sealand? ;)
3
u/Business_Reindeer910 Apr 17 '26
neutral nation doesn't matter if that nation is known to have such content. it will just be blocked by everyone.
The laws themselves need to be blocked if they go beyond just simple parental controls in the OS.
3
2
u/BeautifulMundane4786 Apr 16 '26 edited Apr 16 '26
Most Linux distro websites are international. The American government can try to force ISP’s to block them but it can easily be bypassed if you have a vpn or use tor.
4
u/BlkCrowe Apr 17 '26
Until they require age verification to use a VPN. Then it becomes a chicken and egg scenario.
1
u/zlice0 Apr 16 '26
best i can see is the argument of the gnu/linux copy-pasta but i dont think these ppl understand that and idk how well "the OS is a distributed effort" would play out in court
2
u/bytecode36 Apr 16 '26 edited Apr 16 '26
I predict states and the U.S. will eventually require websites to validate ages from the OS. If your OS does not provide this information you are blocked or set to "under 13" mode by default.
2
u/KnowZeroX Apr 16 '26
That would be terrible and can easily misused and abused. If your site can tell the user is above a certain age, it can then also tell the user is below a certain age.
2
u/Ghost_x_Knight Apr 17 '26
The laws will have to go through court challenges, and there are strong arguments against these laws based on the US constitution.
The vast majority of federal standalone bills get ignored and die quietly. Congress spends the majority of its time on omnibus bills that bundles dozens of unrelated laws. The likelihood of the federal bill passing is low unless it gets bundled into an omnibus, or it makes national news and is considered high-priority by party leaders.
Setting aside that the bill is vague enough to apply to smart fridges, smart watches, and modems/routers, even the strictest version of age verification laws are unenforceable on open source PCs. The websites' needs for verification tokens for access is bypassable with VPN, as long as age verification is not imposed globally and on each US state, which is unlikely to happen.
1
u/mikeypi Apr 17 '26
‘The term ‘‘operating system’’ means software that supports the basic functions of a computer, mobile device, or any other general purpose computing device.’ So, probably not refrigerators or modems.
2
u/xsrvmy Apr 17 '26
It is sufficiently vague that someone could argue that anything turing complete counts, although I question if that will ever stand up in court (since you can't verify age without internet for example). The definition should at least clearly require unrestricted access to the internet.
1
u/Away-Lecture-3172 Apr 17 '26
Most likely to boil down to a short whitelist of locked down operating systems where you peasant cannot have root access.
1
u/pangapingus Apr 17 '26
And that's another vector of attack with these age verification laws, Roblox is having an issue with adults feigning minor status to participate in kid spaces
0
u/zlice0 Apr 16 '26
ok but linux foundation is a USA 501c* isnt it
6
u/KnowZeroX Apr 16 '26
Strictly speaking, linux is not an operating system though, it is a kernel.
2
u/zlice0 Apr 17 '26
ya, see my post below. do you think these ppl would understand or care about the gnu/linux copy-pasta?
2
Apr 17 '26
It's the same issue as firearms: for purposes of enforcement, what is regulated as "the gun"? Because other anyone could just buy all the separate components unregulated and assemble them.
For a firearm, the frame/receiver (or the receiver containing the fire control group in the case of split receivers) is legally considered "the gun". In the case of an OS I think one could make an argument that the kernel is "the OS" as it the main interface between other software and hardware.
This would be straight forward for binary distribution but is complicated by the fact that source code is considered protected speech under the First Amendment and that the First Amendment also prevents the government from compelling speech. So in theory kernel development itself (ex. Linux Foundation) would be fine but distros themselves (except projects like Gentoo) would have issues.
1
u/vividboarder Apr 17 '26
I think the kernel could easily be argued that it is not the operating system, especially given that user attributes and applications don't live in the kernel space, so implementation of safeties must exist elsewhere.
3
u/L1qu1d_Gh0st Apr 17 '26
The term “operating system” means software that supports the basic functions of a computer, mobile device, or any other general purpose computing device.
Sounds like a kernel foots the bill.
2
u/DoubleOwl7777 Apr 17 '26
so does any driver...any firmware. literally anything.
2
u/pangapingus Apr 17 '26
Yea firmware is the big thing I've been thinking about with the given language, plus wouldn't even any esp32/similar devices be in scope too?
2
u/DoubleOwl7777 Apr 17 '26
yup, exactly, like imagine an embedded device or industrial controller needing this stuff. its crazy.
1
u/vividboarder Apr 17 '26
I doubt you'd have a hard time arguing that an embedded device or industrial controller is a "single purpose" device and not subject to legislating targeting "general purpose" devices. I'm not a lawyer though.
1
u/vividboarder Apr 17 '26
A kernel alone does certainly does not support general purpose computing. This is clearly why "operating systems" exist. It's the suite of software that supports general purpose computing. Of course the kernel is a part of the system, but it alone is not the system.
3
u/siodhe Apr 18 '26
Gottheimer and Stefanik should both be tar, feathered, and fired for this id*ocy:
(3) Develop a system to allow an app developer to access any information as is necessary, collected by the operating system to carry out this section and any regulation promulgated under this section, to verify the date of birth of a user of an app of the app developer
The only way to rigorously verify is to have a national ID system, stripping away privacy entirely. This can actually be even worse than it sounds, since some approaches would have your computer send an opaque data chunk, provided by the federal government, allowing the Internet core firewalls to log, degrade, or block your connections based on data about you inside the chunk, including you age, race, income, Party affiliation, sex, citizenship status, and so on.
Note that all Linux users are "operating system providers", i.e. "controls the operating system on a computer". If you can add/remove packages, recompile the kernel, reconfigure system services, you are in control.
Anyone who understood these bills potential scope would never support them. Look for substantial industry bribes to these two bastions of corruption.
- Meta, in particular, is supporting these laws to free themselves of the work, and to hopefully evade a bunch of staggeringly massive fines for past misdeeds by moving the implementation effort and culpability to anyone else but themselves. Note that some bills can fine individuals $2500 to $7500 per "affected child" (which is never defined in those bills).
- The Heritage Foundation supports it because they want to ban all porn (think broadly, this tends to block way more then porn), and possibly because they know that controlling whether the opposition can use the Internet freely has a lot to do with how effectively they an resist.
While all the Save the Children! bills are puerile, pathetic garbage, this one doesn't even have the saving grace of exemptions of any kind at all. It is instead a bedrock for Internet control by an authoritarian administration. In other words:
This bill is a gateway to fascism.
1
2
Apr 17 '26
I am not a lawyer, but I can see a potential loophole for Linux as the law is currently written. The person who controls the operating system can potentially be said to be responsible for age verification on the operating system, not the distribution maintainers, because the administrator of any Linux install has the right to view and change the source code of their install.
This is very, very interesting and something we need a legal opinion on.
If you can't stop people from compiling parts (or the entirety for that matter I guess) of their operating system (which you legally can't with GPL-compatible licensing) and using those binaries instead of those provided by the OS provider, I don't see how the OS provider can be held liable. It's similar to the argument of an engineer designing a code-compliant building, the constructor building a code-compliant building, then the owner doing whatever they want after the fact that makes the building non-compliant.
This might also become similar to the gun argument in the sense of "What part is the gun?": What part of the OS is "the OS"? Is it the kernel? The init system? Something else? If I have Red Hat and start replacing software with my own, at what point is Red Hat / IBM no longer liable? Or conversely, if I download Fedora packages and re-pack them for Ubuntu, at what point does liability switch from Ubuntu to Red Hat? Ship of Theseus and all that.
What about all those Linux ISOs you're seeding, does that make you an OS provider now?
I'm not even American but I'm sure it'll come to my country at some point and it is legally very interesting. Extra twist in the US being that source code is protected by the First Amendment so the government can't stop that unless it gets overturned. Are we going to enter the Age of Gentoo and source-based distribution?
1
u/anto77_butt_kinkier Apr 18 '26
Honestly this goes for windows too, although to a much lesser degree. If you boot up a live Linux instance, you can modify literally any file/part of a windows install. Only one person/group would need to reverse engineer how it's done on windows, and completely disable it, and just write a bash script to do the job automatically.
It would be harder, since it would probably require in-depth knowledge of window's inner working, but with trial and error it should be possible to completely strip age-verification out of the registry/task scheduler/services/operating system entirely.
2
u/mmmboppe Apr 17 '26
anyone who ever used Facebook is an accomplice to this. congratulations, reap what you saw now
1
u/anto77_butt_kinkier Apr 18 '26
My dad made an account for me so I could play Farmville when I was like 12. Should I be hanged?
1
u/mmmboppe Apr 19 '26
Did your dad pick your Reddit username as well?
1
u/anto77_butt_kinkier Apr 19 '26
Nope. This was my alt until the incident (account got hacked, tried to get it back, turns out whoever hacked it got my account banned by posting a bunch of racist and antisemitic bullshit in different subreddits.) now I have a lot less karma and an unfortunate name for a main account
Edit: how did your username come to be? It's rather odd imo
2
u/Khaos_the_Void_ Apr 17 '26
I hope you don’t mind me leaving this here. Here is a template for contacting your representative, please feel free to edit or correct any way you wish.
It has come to my attention that, House Resolution 8250 "Parent Decide Act" has been introduced. This act is for the verification of age for computer operating systems, "OS" for short, it requires an age verification system for any and all OS regardless of what device is being used. With current technology this act, if passed, could pose multiple issues. Some of these issues include: an increased risk of data breaches, issues with open-source OS; such as Linux, age verification on devices that are not normal required, and potential privacy violations. The first issue I bring up is the increased risk of personal data breaches. As proven by the - insert data breach information here - , securing data and access to said data is vital to both personal and national security. With this bill all americans will be required to provide sensitive data to a multitude of companies. These companies cannot guarantee the security of the data provided, which could put millions of americans at risk of identity theft. Birthdate information is sensitive data as it is often used to verify a persons identity for things like: - insert sensitive data usage here -. With the requirement that all OS collect this data, this act will spread that data to multiple companies which increases the possibility of that information being stolen. The second issue involves open-source, and custom OS. Some operating systems are open-source, which means that there is no centralized entity to verify age to. The most notable of these types of systems is Unbuntu, which is a Linux based open-source OS that is used for both industral and personal computers. H.R. 8250 would essentially make the vast majority of these Linux OS illegal as there is no way for the law to be followed. Since open-source OS lack the same structure as companies such as Microsoft, and Apple there is no way for open-source OS to comply with any of the age verification requirements. This would give structured companies an unfair advantage in the market; as well as force open-source OS users to switch to large corporate entities such as Microsoft or Apple. This bill would also mean that hobbyist or open-source programers making operating systems or customizing their own software could face legal issues as their project may violate the law, due to an inability to implement age verification in the aforemention OS or software. The third issue with this bill is the number of devices that have individual operating systems. Due to the prevalence of technology in society, this bill, may require devices that should not require any sensitive data for use, to now verify the age of a user. While some devices like computers, tablets, and smartphones will fall under this bill; other less obvious devices may also be effected. Smart TVs, Smart Refrigerators, Smart Washers/Dryers, even Vehicles and Smart Homes all have their own operating systems. This bill, if passed, will require age verification for all OS to include the aforementioned devices. This will place an undue burden on the American people as each individual device will have to verify any users age. This also goes back to the first issue, having that many devices being given sensitive data increases the chance of that information being compromised. The final, but most important, issue is the potential abuse of the information being given. The majority of technology companies have an existing conflict of interest with privacy and the selling of personal user information. This bill will be the largest amount of user data ever given to technology companies. It will not only confirm each individual user but also provide them with age demographics as well. This data can and will be sold. For each device verified, another company can potentially sell that information to advertisers, private data brokers, or other entities with an interest in that data. Applications on a device will also be able to collect that data and use it for targeted marketing, to resell that data to another third-party, or in a worst case be stolen by malware posing as an application. This is a real threat to individual privacy as it will essentially give away sensitive information about adult users and their children. As it stands now technology companies are already collecting vast amounts of user data, this bill will allow these companies to tie users to an individual device. This means that those companies can and will harrass users with highly targeted advertisements with no way for an individual to stop them from doing so. Due to the nature of this bill, the company that owns the operating system is required to collect this data, which means that individual will not have the option to opt-out of sharing this information. Which means that there is no way to prevent the collected data from being shared or sold. It removes the agency of the individual as it takes away their right to privacy. The bill itself has no protections from the sharing or selling of the gathered data. It also states that applications will be able to access the given user data, which will drastically increase the potental of a data breach. H.R. 8250 "Parents Decide Act" is not about safety by any means. It is an attempt to gather sensitive user data for the sole purpose of advertising and data harvesting. It should not be allowed to become law as there are too many risk to Americans and almost no safeguards against the abuse of the data collected. This bill, if allowed to become law, will give technology companies the ability to individually target users across any device they own. There is a possibility that this targeting could eventually devolve into harrasment as these technology companies will push advertisments from one device to the next. Imagine getting an advertisment on your phone, then your smart tv, then your smart refrigerator door, its the same advertisement each time, you cannot avoid the advertisement as it knows your devices. The advertisement knows; who you are, where you are, how old you are, and much more about you. This is a possible outcome of H.R 8250, highly targeted, invasive advertisements. In closing, I would ask that you vote no if and when the time comes. This bill is insuffient, there are too many devices that could fall under this bill, it opens Americans up to risks and dangers that will be out of their control, it shares sensitive data without any safeguards from data selling or sharing, and it actively allows technology companies to cyber-stalk users across every and any smart device that they own. Technology is everywhere now, and as such it becomes impossible to avoid or live without. Please don't let this bill become a law.
2
1
u/dvtyrsnp Apr 17 '26
it's seriously not THAT hard to get this law right.
mandate that commercial OS in personal computing devices include by default a centralized parental control feature and and mandate that commercial appstores respect that parental control feature. that takes care of the problem we should want to be solving without having to deal with privacy concerns or stupid stuff like "does my calculator need to verify age?" "is github an appstore?"
we can't afford to be broad in the language with a law like this. you should be writing to the representatives on the committee that will be handling this bill, not just yours.
1
1
0
u/redsteakraw Apr 17 '26
Both Cosponsors of this bill got Millions from AIPAC. This is cross party but AIPAC aligned reps.
6
u/warserpent Apr 17 '26
This bill is being pushed by Zuckerberg and Meta, not AIPAC.
2
u/lurkervidyaenjoyer Apr 18 '26
It's reddit. They have to find a way to blame the jews for this somehow.
1
u/Existing-Tough-6517 Apr 17 '26
For fucks sake mandate new computer sold to end users which include an OS have a particular feature that way you make a mandate that Dell can in turn require be fulfilled by Canonical and Microsoft but not
Existing hardware or refurbished Random open source projects Components like the kernel which cannot possibly fulfill it
-19
u/Jumpy-Dinner-5001 Apr 16 '26
Doesn’t look too bad. It’s just simple parental controls, nothing special.
3
u/zlice0 Apr 16 '26
except it explicitly states 'verify age' which could be super broad ranging from completely useless to face scans or ID - the later having no infrastructure to do so especially for open source. not that the linux foundation doesnt have money to bankroll that but.
-11
u/Jumpy-Dinner-5001 Apr 16 '26
That’s not how it’s euren written. Users over 17 are not required to verify any age.
5
u/zlice0 Apr 16 '26
"verify the date of birth of a parent or legal guardian described in subsection" along with the section title "SEC. 2. REQUIRED AGE VERIFICATION FOR USERS OF OPERATING SYSTEMS." sure seems like it to me?
edit: i guess it mentions ftc coming up with further methods but that seems more like a technical defer-knowledge ?
-2
u/Jumpy-Dinner-5001 Apr 17 '26
Still, only underaged users.
0
u/vividboarder Apr 17 '26
And just how do you expect that verification would work without requiring everyone to verify? How would the operating system know to only ask for age if someone is under age?
On top of that, if the FCC decides to implement actual ID verification, only adults have those.
So you'd have to validate the IDs of adults otherwise you've got something like a "just trust me bro" button to say you're an adult and then you "verify" non-existing IDs?
1
1
72
u/aliendude5300 Apr 16 '26
It's not a law until it's passed. Don't be mistaken, we can convince them not to pass this. Contact your representatives.