New U.S. Bill May Require All Operating Systems to Mandatorily Verify User Age
A new bill submitted to the U.S. House of Representatives would require operating systems such as Windows, Linux, and MacOS to verify user age during system installation and daily use. The proposal, called the "Parents’ Bill of Rights Act," has been referred to the House Energy and Commerce Committee and was jointly initiated by Democratic Representative Josh Gottheimer of New Jersey and Republican Representative Elise Stefanik of New York.
The bill stipulates that “all users of an operating system,” whether “registering an operating system account” or “using the operating system,” must provide their date of birth.
Operating system providers must also “build a corresponding system that allows application developers to obtain all necessary information collected by the operating system to implement this bill and all regulations issued under this bill to verify the date of birth of their application users.” In other words, any program on your computer can access the date of birth information you provide – something I find completely unacceptable.
From the perspective of privacy and data security, the implementation of age verification is undoubtedly the most core aspect of this bill, but this crucial detail will not be finalized by the Energy and Commerce Committee until after the bill is passed.
It is currently unclear whether this bill will simply require users to fill in their date of birth (like when we want to view M-rated content and casually report that we were born on January 1, 1900), or whether it will require users to complete substantial identity verification steps. Some of the wording in the bill strongly suggests the latter. Worryingly, even if the bill is ultimately passed, this key detail is just one of many that will only be clarified after the bill is passed.
After the "Parents’ Bill of Rights Act" is formally enacted, the committee must finalize the following details within 180 days:
- The specific methods by which operating system providers verify the dates of birth of parents or legal guardians – although not explicitly mentioned here, subsequent content also implies verification requirements for adult users who use devices independently.
- Relevant data protection standards, clarifying how operating system providers should ensure that the date of birth information collected from users, or their parents/legal guardians, is collected securely, protects the privacy of relevant personnel, and prevents information theft or data breaches.
- Ensuring that application developers can obtain the information collected by operating system providers to implement this bill to verify the date of birth of their application users.
No matter how you look at it, this bill is a vague and privacy-disastrous proposal. It not only requires operating systems to store users’ sensitive personal information, but also to share this information with any third party. Such mechanisms have always been fraught with loopholes. Examples abound, such as the recent leak of user identity information shortly after Discord’s own age verification system went online, and the loss of all users’ social security numbers by a subpar missing persons service provider in Florida.
Furthermore, this bill seems to assume that all operating systems come from commercial enterprises – so how can an open-source branch of Linux safely handle users’ personal information during system installation, startup, and even every interaction with third-party applications?
The answer is obviously no. This bill, in order to create the appearance that the U.S. Congress cares about the physical and mental health of minors, would recklessly destroy an entire ecosystem of personal computing. Others have also pointed out another tricky problem: will this bill lead to users needing to connect to the internet even to use their computers?
Today, in the face of the reality that parents allow their children to waste their minds on the internet, developed countries are experiencing a wave of panic-driven regulation, attempting to erase the last vestiges of digital privacy. Age verification at the operating system level is the latest trend in this wave. California has already passed a similar bill, which has already driven open-source software developers to the brink.