How Child Safety Laws Are Building an Internet ID System

Opening

Dear reader, there was a small commotion in the Linux community last week. A field called birthDate was added to systemd, the core system manager used by most Linux distributions — a field that stores a user’s date of birth at the operating system level.

Lennart Poettering, the creator of systemd, explained that “it’s just an optional field — not a policy engine, not an API for apps.” But if you trace why this small field was added, a much bigger picture emerges. It exists to respond to age verification laws¹ passed in California, Colorado, Brazil, and elsewhere.

But look closely at these laws, and they’re not simply child protection policy. They’re laws that mandate infrastructure for the operating system to broadcast a user’s age to every app in real time. And behind them, there’s an unexpected beneficiary.

A World Where the OS Checks Your Age

In October 2025, California Governor Gavin Newsom signed AB-1043 (the Digital Age Assurance Act), which takes effect on January 1, 2027. Here’s the core of what the law does.

Every operating system provider must collect the user’s date of birth or age during account setup. Based on this information, when an app developer requests it, the provider must relay the user’s age bracket (under 13, 13-15, 16-17, or 18 and over) through a real-time API.

This is where the definition of “operating system provider” matters. According to the law’s text, it means “any person that develops, licenses, or controls operating system software for a computer, mobile device, or other general-purpose computing device.” This covers not just Windows, macOS, iOS, and Android, but also Linux distributions and Valve’s SteamOS.

This is a different order of magnitude from verifying age when accessing a specific adult site. From the moment you power on a device, your age information gets embedded in the operating system, becoming a permanent identity-verification infrastructure that every installed app can query.

This isn’t just a California story. Similar laws are already in effect in Utah (SB-142) and Louisiana (HB-570), and Colorado’s version (SB26-051) passed the Senate 28-7 and is now under House review. New York (S8102A) goes even further, banning self-reporting and requiring biometric or government ID verification. Similar bills are pending in Illinois, Ohio, Georgia, and South Carolina, and at the federal level, KOSA and ASAA are moving forward.

The common template behind these laws is the “Digital Age Assurance Act” drafted by ICMEC (the International Centre for Missing & Exploited Children). But there’s a striking pattern here: these laws impose obligations on app stores and operating systems, while imposing no new obligations on the social media platforms that actually expose children to content directly.

Lobbying: The Hand That Wrote the Law, the Hand That Paid for It

According to a Bloomberg report from July 2025, Meta was funding the Digital Childhood Alliance (DCA), a coalition of conservative-leaning child protection organizations. DCA claimed to represent a coalition of over 50 conservative groups, but only 6 organizations were actually publicly identified by name.

This past March, an OSINT (open-source intelligence)² researcher published an investigation tracking public records — IRS tax filings, Senate lobbying disclosures, and state ethics commission databases. Here’s what they found.

DCA’s legal entity problem: DCA’s EIN (tax ID number) was only recently confirmed, and its total revenue for tax year 2024 was under $25,000 (filed via simplified 990-N). An organization running legislative campaigns in over 20 states reporting official revenue under $25,000 means the real money isn’t flowing through this entity.

The Louisiana case: State Representative Kim Carver, who introduced HB-570, publicly acknowledged that a Meta lobbyist brought her the bill’s language directly. For this single bill, Meta deployed 12 lobbyists across 9 lobbying firms and spent at least $325,000. The bill passed unanimously at every stage — meaning the 12 lobbyists weren’t needed to win votes, but to control the wording.

Meta’s lobbying position: analysis of 117 lobbying records obtained through the Colorado Secretary of State’s SODA API shows Meta took an “Amending” position on social media bills that would regulate itself, while taking a “Monitoring” position on bills that would burden OS providers. It fights the laws that regulate itself, and simply watches the ones that regulate its competitors.

There’s precedent for this: in March 2022, The Washington Post reported that Meta had hired the Republican consulting firm Targeted Victory to run a nationwide smear campaign against TikTok. The campaign planted op-eds in local media, blaming TikTok for dangerous trends that had actually originated on Facebook. The campaign’s core frame? “TikTok is dangerous for kids.” The playbook then and now is strikingly similar.

In the end, a company that profits from collecting user data wrote the language of a law that mandates every operating system collect age data and broadcast it to every app — while designing it so its own platform falls outside the law’s reach.

Same Problem, Completely Different Design

At this point, the EU’s approach makes the contrast clear.

The EU’s Digital Services Act (DSA) places age verification obligations on Very Large Online Platforms (VLOPs) with 45 million or more monthly users — not on operating systems. And it includes 5 separate exemption clauses for open-source projects.

The technical approach differs too. Under the eIDAS 2.0 regulation, the EU is developing the European Digital Identity Wallet (EUDI Wallet), built around zero-knowledge proofs (ZKP)³. Users can prove the single fact “I am 18 or older” without exposing their date of birth or any other identifying information. It’s like walking into a bar and showing a card stamped “this person is an adult” instead of handing over your entire ID.

The EU’s reference implementation is open-sourced under Apache 2.0/EUPL licenses, and it’s free for non-commercial projects. A second version was released in October 2025, and pilots are running in 5 member states (Denmark, Greece, Spain, France, and Italy).

Of course, the EU approach has its limits too. Because the wallet app depends on Google Play Services or iOS, it doesn’t work on privacy-focused distributions like GrapheneOS. And ZKP is a cryptographic mechanism, not a trust architecture — if the credential issuer and verifier collude, activity tracking is still possible.

Even so, the structural difference is clear.

Same goal of “protecting children” — but one builds a proof architecture, and the other builds a surveillance infrastructure.

Oz’s Lens

Honestly, when I look at this issue, what worries me more than the technology itself is a flaw in abstraction.

The author of the original blog post nailed it. The core mistake in this debate is conflating content moderation with guardianship. Content moderation is a classification problem: “should this content be blocked?” Guardianship is a contextual judgment: “is this appropriate for my child, and when should I make an exception?” The former can be solved, to some degree, with technology. The latter is inherently relational and situational.

There’s a pattern I’ve seen countless times while building GTM strategies: packaging a complex social problem into a single technical solution and selling it. Age verification laws are exactly this pattern. “Kids are at risk” → “verify identity” → “build an API into the OS.” What’s missing from this chain of logic is any analysis of where the actual harm happens. This is, in fact, how Korea’s own game shutdown law got its start too.

What harms children isn’t the mere existence of content. It’s recommendation algorithms, dark patterns⁴, addictive metrics, and business models that reward amplification. Yet these laws don’t regulate recommendation algorithms. They don’t ban dark patterns. Instead, they tell operating systems to build an age-verification API.

And infrastructure, once built, is never used only for its original purpose. Infrastructure built for age can expand to location, citizenship, legal status, platform policy — whatever the next moral panic demands. This is how a limited check turns into a general-purpose gate. I agree with the original author, who is also a parent: children need protection. But the internet doesn’t need a permission system.

Closing

First, America’s age verification laws are framed as child protection, but their technical substance is the construction of permanent, OS-level identity-verification infrastructure. Once built, it’s unlikely to stay limited to age alone.

Second, behind many of these bills is Meta’s organized lobbying, and by design, social media platforms are left out of the regulation. A child protection law that doesn’t regulate the point where harm to children actually occurs struggles to live up to its name.

Third, the EU chose a privacy-preserving approach to the same problem (ZKP + open source + platform-focused regulation). It’s not perfect, but it’s a fundamentally different design from the approach of “let’s inscribe everyone’s age into the operating system.”

If you’re curious to learn more about this topic, I recommend checking out the GitHub OSINT investigation repository among the references below — every claim is linked to the original public record. In the next newsletter, I’ll talk about another side of this structure — the design choices between privacy and convenience in the age of AI.

References & Further Reading

• Jaromil, “Do Not Turn Child Protection Into Internet Access Control”, 2025: This is the piece that forms the theoretical backbone of today’s newsletter. The distinction between “content moderation vs. guardianship” is the core.
• upper-up, “Meta Lobbying and Other Findings”, GitHub, 2026.: The full OSINT investigation tracking public records — IRS 990 filings, Senate LD-2 lobbying disclosures, state ethics databases, and more. It compiles 50 verified findings.
• California Legislature, “AB-1043: Age verification signals: software applications and online services”, 2025: The original text of California’s Digital Age Assurance Act. You can directly verify the definition of “operating system provider” and the real-time API obligation.
• European Commission, “The Age Verification Manual”, EUDI Wallet, 2025.: The technical specification for the EU’s privacy-preserving age verification approach. Comparing it with the US approach makes the difference in design philosophy clear.
• Washington Post, “Facebook paid Republican strategy firm to malign TikTok”, 2022.: The article exposing how Meta hired Targeted Victory to run a smear campaign against TikTok using a “child safety” frame. Essential for understanding the pattern’s similarity to the current DCA campaign.
• It’s FOSS, “Systemd’s New Feature Brings Age Verification Option to Linux”, 2026.: Covers the technical context behind systemd’s new birthDate field and Lennart Poettering’s explanation.

The author, Kwangseob Ahn, is a professor of business administration at Sejong University and lead consultant at OBF (Oswarld Boutique Consulting Firm). He teaches statistics and data analysis — business data management and business analytics — while leading GTM and AI strategy consulting in the field, designing the seam between technology and business. He has published academic research on a memory architecture for AI dialogue systems (HEMA) and runs Daily Arxiv, a daily curation of global AI papers. He holds a master’s from Korea University’s Graduate School of Technology Management and a KMBA. He is the author of Homo Brainless: The People Who Outsource Their Thinking.

Footnotes

1. Age Verification Law: A law that mandates verifying a user’s age when using online services. It used to be limited to adult content sites, but recently its scope has expanded to operating systems and app stores. ↩

2. OSINT (Open Source Intelligence): A research method that systematically collects and analyzes publicly accessible information (news, public records, social media, corporate registrations, etc.). It’s widely used not just by intelligence agencies but also in investigative journalism. ↩

3. ZKP (Zero-Knowledge Proof): A cryptographic technique that proves you know a piece of information without revealing the information itself. For example, proving “I am 18 or older” without disclosing your date of birth. It’s the core technology behind the EU Digital Identity Wallet. ↩

4. Dark Pattern: A UI/UX design technique that manipulates users into taking unintended actions (like keeping a subscription active or agreeing to share personal data). In simple terms, it’s when an app or website makes the “No” button tiny and the “Agree” button big and flashy. ↩