Episode 55 - My issues with Ubuntu - The Architecture of an Identity-Gated Internet

The developers or publishers of these open source Operating Systems have decided to not implement Age Verification, or are currently restricting access in regions with Age Verification laws.

	Operating System	Notes
⛔	Omarchy Linux	Developer statement
⛔	Devuan Linux	Developer statement
⛔	Slackware Linux	Developer statement
⛔	Vendefoul Wolf Linux	Developer statement 1, 2
⛔	GrapheneOS	Android-based mobile OS, Developer statement
⛔	FreeDOS	Developer statement
⛔	Artix Linux	Developer statement
⛔	DB48X	Calculator firmware, Developer statement
⛔	Arch Linux 32	Developer forbids usage in Brazil, California
⛔	Ageless Linux	Debian fork created to protest Age Verification
⛔	Garuda Linux	Developer statement
⛔	Void Linux	Developer statement
⛔	EndeavorOS Linux	Developer statement

Operating Systems Planning to Implement Age Verification

The developers or publishers of these Open Source Operating Systems have made plans and/or statements that they intend to comply with new Age Verification laws. But, as yet, that Age Verfication functionality is not fully implemented.

	Operating System	Notes
🏗️	Ubuntu	Planning Discussion, Ubuntu VP Statement
🏗️	Pop!_OS	System76 Statement opposing, but planning to implement
🏗️	elementary OS	Founder Statement planning to implement
🏗️	Midnight BSD	License temporarily forbids usage in Brazil, California, until implementation finished
🏗️	Fedora	Planning Discussion

Operating Systems Which Have Already Implemented Age Verification

As of the most recent update to this document, no known Open Source Operating Systems have fully complied with legal Age Verification requirements for Brazil or California.

1. Brazil's Digital ECA Went Live March 17 — and Nobody Was Ready

This week's biggest story. Brazil's mandatory age verification law went live on March 17, 2026, and Proton VPN reported a staggering 250% increase in Brazilian sign-ups between Monday and Tuesday, as users scrambled to avoid submitting biometric scans and identity documents just to access social media. Th Yahoo!e law — the Digital ECA — bans self-declaration as a verification method, and fines run up to 10% of a company's Brazilian revenue or R$50 million (~$9.5M USD) per infraction. It Adafruit gets stranger: the law contains its own internal contradiction — Article 37 says regulations cannot impose "mass, generic, or indiscriminate surveillance mechanisms," but Article 9 bans self-reported age and Article 12 demands "auditable" verification. An Adafruitd it's pulling in Linux distros — Ubuntu Linux landed on Brazil's regulatory watchlist, and Rockstar Games simply pulled its storefront from Brazilian customers entirely rather than absorb the compliance burden. St MysteriumVPNrong standalone episode or a tight follow-up segment.

2. Discord: Leaked 70,000 IDs — Then Rolled Out ID Collection to Everyone

A gift of a story for Closed Network. In October 2025, Discord disclosed that hackers breached third-party vendor 5CA and exposed approximately 70,000 government-issued ID images used for age verification. A single compromised account gave attackers access for 58 hours. Stateofsurveillance Discord's response? Beginning in early March, Discord started locking all users into a "teen-appropriate experience" unless they proved they were adults — through a face scan or government ID upload via a third-party vendor. Electronic Frontier Foundation The EFF called it out directly: Discord delayed the global rollout to the "second half of 2026" after backlash, and said one of its initial partners, Persona, "did not meet the bar" for on-device processing. Electronic Frontier Foundation The through-line for Simon: the system that leaked 70,000 IDs isn't fundamentally different from the one being rolled out to 200 million users.

3. Colorado SB26-051: Every OS Must Card You at Setup

Colorado's SB26-051 "Age Attestation on Computing Devices" passed the Senate on March 3, 2026 with a 28–7 vote. LegiScan The bill doesn't regulate websites — it shifts responsibility directly to operating system providers and app distribution infrastructure. OS providers would be required to collect a user's date of birth at account setup, generate an age bracket signal, and make it available to developers via API every time an app is downloaded or launched. Biometric Update The kicker: the bill never specifies how age is actually determined — account holders just "indicate" their birth date. No ID check. No verification mechanism. Any user could lie and the system would accept it. It's FOSS Strong angle: this is California AB 1043's little sibling — but potentially even more technically sweeping because it explicitly covers Linux distros and general-purpose computing devices.

4. Character.AI Rolls Out KYC — AI Companions Now Require Government ID

Character.AI's March 2026 update mandates that users prove their age through KYC protocols. If you cannot verify your identity, you cannot chat with the bots. AGILE LEADERSHIP DAY The angle here is mission creep — age verification has now expanded from social media and adult content to AI chatbots. The EU AI Act's rules for high-risk AI systems take full effect by August 2026, and the Act strictly prohibits AI systems from deploying manipulative techniques or exploiting user vulnerabilities related to age — forcing platforms like Character.AI to definitively prove they are not exploiting minors, which means knowing exactly how old their users are. AGILE LEADERSHIP DAY This is a natural bridge episode connecting age verification to the AI regulation space.

5. Congress: KOSA vs. The App Store Accountability Act — Two Very Different Bills

Two bills now moving through Congress take fundamentally different approaches — KOSA requires companies to conduct risk assessments, restrict default settings on minors' accounts up to age 17, and give parents oversight tools. The App Store Accountability Act attempts to stop the problem before a child ever opens an app: requiring age verification at the account level and parental consent for every minor's download. Fortune Also notable: COPPA 2.0 covers ages 13 to 16, bans targeted advertising to minors entirely, and creates a dedicated FTC enforcement division — closing the loophole that allowed companies to treat teenagers as unprotected users. Fortune

6. The Bypass Problem Is Getting Worse — AI Deepfakes Are Now a Tool

A Brazilian lawyer told Rest of World: "Age-verification technologies are not infallible. Minors are using increasingly sophisticated techniques, including VPNs and AI-generated deepfakes or selfies." Rest of World On Roblox, one user posted a video showing a crude face painted on a thumb passing the age check and being assessed as 13–15 years old. Another user wrote they used a fake ID of Joseph Stalin and it got accepted. Rest of World This is darkly funny and devastating at the same time — and directly undermines the entire premise of facial age estimation as a security measure.

What does Google keep on you?

Austin Evans downloaded his Google Takeout - 527 GB of data:

https://www.youtube.com/watch?v=hcHrqgz30pk