Age Verification Laws Are Coming for Your OS. Here's What You Need to Know

Age Verification Laws Are Coming for Your OS. Here's What You Need to Know | PCMag

Skip to Main Content

PCMag editors select and review products independently. If you buy through affiliate links, we may earn commissions, which help support our testing.

(Credit: Zain bin Awais/PCMag/Getty Images)

Age verification laws have permanently changed the internet and are only gaining momentum. Twenty-five US states have passed age verification laws targeting adult websites like PornHub, and a new Utah law targets VPN use. Now, age checks are coming to your operating system. California’s Digital Age Assurance Act, which takes effect in 2027, requires operating systems, including Linux, macOS, and Windows, to ask for your age and share your age range with the apps you use.Aaron Mackey, the Electronic Frontier Foundation’s deputy legal director, tells me that California’s law will affect everyone. He says age checks “will be implemented for everyone who uses [operating systems], including the billions of folks outside of California.” California's laws often serve as a model for other states, so companies are likely to make sure their products follow these regulations, regardless of their users' jurisdictions. Other states are discussing similar bills, and the federal Parents Decide Act, introduced in the House in April, would extend age-verification requirements for operating systems nationwide if it passes.Age verification laws impact everyone. Depending on a law's specific language, you might one day have to provide a credit card or government ID to set up your device. As these laws are in active development, you have an obligation to stay informed. Here's what you need to know so far. You May Also Like

Which States Have OS Age Verification Laws in the US?As of this writing, California’s Digital Age Assurance Act (AB 1043) is the only US state or federal law that requires operating systems to collect their users’ ages. It takes effect on Jan. 1, 2027.California’s law requires that operating systems ask for your age when you set them up. Your OS must then share an age bracket signal with the applications running on your computer. Applications will see one of the following age ranges: under 13, 13-16, 16-18, or over 18.Application developers are then “deemed to have actual knowledge of the age range of the user.” They would have a legal duty to comply with any laws requiring different treatment of minors and could not plead ignorance of the device user's age. An application might need to restrict access or features for users under 18 under other laws, including the federal Children's Online Privacy Protection Act of 1998 (COPPA), which requires online services to handle the personal information of users under the age of 13 differently. This could affect dating, gaming, and social media apps, for example. California’s law doesn’t affect websites. However, a proposed California law would extend the age signal to the web.How Will Your OS Verify Your Age?Under California’s law, as written, your operating system must ask for your age during the device setup process. Your operating system will accept that age without requiring identification. Attestation—in other words, simply declaring your age—is sufficient proof.Nichole Rocha, a data privacy attorney who represents Children Now, a California-based organization that backs the law, tells me that California’s bill was designed to protect privacy. “There’s no requirement for the uploading of a government ID, and that was intentional on the part of the author, [California state assembly member] Buffy Wicks,” she says.“I think the bill strikes an appropriate balance. You see other states requiring the uploading of government IDs, and that’s incredibly invasive,” says Rocha. She argues that research shows parents set up devices for minors and will enter a child's age accurately at that time. “While the law on paper doesn’t require strict age verification, I think in practice compliance will look a lot more like age verification." However, the EFF believes operating system providers like Apple, Google, and Microsoft will require more personal information. “While the law on paper doesn’t require strict age verification, I think in practice compliance will look a lot more like age verification,” Mackey says.He points out that there are fines and legal consequences if minors bypass age checks, and that companies will want to prevent minors from lying. “That involves more invasive forms of age verification that adult websites implement,” he says. That could mean providing a credit card, a facial scan, or a government ID during OS setup to verify that an adult was involved in the process.

Windows 11’s setup already asks for your age when you create a Microsoft account (Credit: Microsoft/PCMag)

What Similar Laws Are Advancing in the US?On the federal level, the Parents Decide Act, introduced in Congress in April, would require OS-level age checks in all states if it passes. Specifically, the proposed law says operating system providers must "require any user of the operating system to provide the date of birth of the user" to set up an account or use the OS. Adults would also have to provide their date of birth. The Federal Trade Commission (FTC) would also need to “issue regulations on how operating system providers can… verify the date of birth of a parent or legal guardian” if a minor is setting up a device. This could potentially include government identification checks upon device setup; the implementation details would be up to the FTC. "I hope that by doing privacy-protective and nuanced legislation in California, we’re serving as a model for the rest of the states.” Rocha doesn’t expect the federal government to take action. “Every year, things pop up in Congress that never get signed, right?” she says. “We just haven’t seen anything meaningful happen at the federal level in this space since the mid-1990s.” The EFF is concerned about the current legislative environment, however. "This is a trend we're seeing," says Mackey. "Lawmakers don't understand the technology, and they don't understand that these proposals are unpopular."Other states are discussing laws similar to California’s. Colorado has bill SB26-051, while Illinois has the Children’s Social Media Safety Act, SB3977. Neither has yet passed, but both require the person setting up a device to declare only an age, without requiring proof of identity.“I hope that by doing privacy-protective and nuanced legislation in California, we’re serving as a model for the rest of the states,” says Rocha.Some states might require more personal identification. New York’s senate, for example, is discussing Bill 8102, which will require operating systems to determine user ages via “commercially reasonable age assurance methods.”How Will Apps Get Your Age From Your OS?Apps will get your age range from your operating system using an application programming interface (API). In other words, they’ll ask the operating system for your age range and get a response.Major operating system vendors are already implementing compliant APIs. Google has the Play Age Signals API for Android apps from Google Play, while Apple has the Declared Age Range API in iOS and macOS. A Microsoft spokesperson tells me that Windows will also offer an age range API and that the company will have more to share in the future. The system software that many Linux distributions use now has an age field for user accounts, too.How Is This Different From App or Website Age Checks?The legislation discussed above moves age verification from the application or website layer to the device or operating system level. PornHub has urged Apple, Google, and Microsoft to implement OS-level age verification. With OS-level age verification, adult online services like PornHub would not need to confirm visitors' ages by collecting documentation themselves. Instead, the operating system would have that obligation. PornHub is already using signals in Apple's iOS to check the age of visitors in the UK.However, as mentioned, California’s law does not require that the operating system pass age signals from the web browser to a website. That’s surprising, given that age-verification laws in many states have targeted adult websites. Rocha says California’s lawmakers were trying to address the web in the original law, but “ran out of time.” California's Bill AB 1856, which hasn’t passed yet, would extend the age verification requirement to web browsers and websites.Web browser developers are already working on age-verification standards. Google’s Chromium and Apple’s Safari both support the Digital Credentials API to share government identification information with websites. If you save a driver's license or other government ID to Apple Wallet or Google Wallet on your phone, you can securely share your credentials with websites. Theoretically, you could use the same process to share an age you provided to your desktop operating system with a website, too.What About Linux and Other Open-Source Sof