Colorado and California Exempt Open Source Software from Age Attestation Requirements

In a significant victory for the open source community, Colorado and California have both passed legislation exempting open source software from mandatory age attestation requirements. This development acknowledges a fundamental distinction between open source projects and commercial platforms that collect personal data and target advertising.

Age attestation laws, designed to protect children online, have been sweeping across jurisdictions worldwide. These regulations typically require software platforms to verify users' ages, often collecting personal information in the process. For open source software that doesn't engage in data collection or user profiling, these requirements create unnecessary privacy burdens without corresponding safety benefits.

"Open source values are just different," explains Carl Richell, CEO of System76, a company that develops Pop!_OS and the COSMIC Desktop Environment. "Our operating systems and apps don't collect personal information, profile children, inject targeted ads, or create addictive design patterns. The kinds of behaviors these children's safety laws regulate are antithetical to open source values."

System76 took a proactive approach to addressing these concerns. In Colorado, company representatives met with state legislators alongside other members of the local open source community. Through collaborative discussions, they developed language that would protect privacy while exempting open source software, code repositories, and container registries from age attestation requirements.

"We found holes in proposed language and explored issues that could arise," Richell recounts. "We drafted and exchanged numerous changes and played devil's advocate, understanding that we will have to defend language we propose to our representatives and perhaps in committee hearings."

This Colorado success then informed efforts in California. System76 coordinated with community members and lobbyists in the state, sharing the language that had proven effective in Colorado. The strategy worked, with similar exemption language ultimately making it into the California legislation.

"Our strategy was to establish an example in Colorado that could influence amendments in California," Richell notes. "The goal was to set an open source exemption standard in Colorado and California that other legislatures could adopt. But for that to succeed, California had to be on board."

The exemption acknowledges that open source software operates on different principles than the commercial platforms these laws were designed to regulate. Unlike proprietary software that may collect user data for advertising or profiling, open source projects typically prioritize user privacy and autonomy.

For instance, when systemd (a common init system recently added a birthdate field to user accounts), System76 simply ignored the field. "We don't want to know the user's birthday because a username and birthday could identify an individual," Richell explains. "Personal privacy is central to our philosophy."

The legislative victories in Colorado and California represent important recognition of open source values. However, age attestation requirements continue to spread globally, with similar laws emerging in Australia, Brazil, and Europe.

"I'm sharing this story because I see the cynicism," Richell acknowledges. "If we can move beyond cynicism and talk about the merit of open source, we can make a difference for the open source community."

The success in these two states demonstrates that constructive engagement with policymakers can yield positive results for the open source community. By articulating how open source differs from commercial platforms and advocating for sensible exemptions, System76 has helped establish a precedent that other states and countries may follow.

As computing increasingly becomes associated with app consumption rather than creation, it's crucial to highlight the values that distinguish open source software. "iOS and Android have distorted the view of computing into platforms for consuming apps," Richell observes. "We must illustrate the contrast with the world we live in: a world of computing centered on creation, where people build and share free software, collaborate openly, and drive innovation that ultimately benefits everyone."

For those interested in supporting similar efforts, Richell encourages direct engagement with legislators. "Write your legislatures with constructive, educational feedback. Engage as deeply as you can. The altruism inherent in open source, its privacy-oriented values, and importance for education and innovation are not widely understood. Let's change that."

System76 has made clear its position: "Pop!_OS and the COSMIC Desktop Environment will not include Age Verification or Age Attestation." This stance reflects the company's commitment to user privacy and the principles of open source software.

This legislative success highlights how thoughtful advocacy can help protect the open source ecosystem from well-intentioned but potentially misguided regulations. By establishing clear distinctions between open source and commercial software, policymakers can craft laws that achieve their goals without undermining the values that make open source software valuable.