Why AB-1043 is stupid
and why you should feel bad for defending it
First off, go read the law.
Right, you read it, cool.
Lemme break this down for you.
This bill moves to add a “signal” to the operating system that any application developer can request to verify a user's age within a few buckets.
Currently the buckets are as follows: – Whether a user is under 13 years of age. – Whether the user is at least 13 years of age and under 16 years of age. – Whether the user is at least 16 years of age and under 18 years of age. – Whether the user is at least 18 years of age.
Depending on the bucket that the user's age resides in, the application developer can control what is shown or allowed (or even prevent the launching of) in their application.
Pratical example being this:
Karen bought a new computer for her son Timmy.
She sets up his account setting his age to the second bucket (at least 13 and under 16).
Now whenever Timmy attempts to launch an application that respects this “signal”, it'll lock features (say a private chat system) until Timmy reaches the correct age.
Sound perfect right? Karen doesn't need to worry about Timmy talking to people he shouldn't be.
I want you to keep this example in mind while we cover a few more things.
Let's review the existing operating systems out there and how they handle account creation.
Apple
Apple's new computer flow allows for Local users. In laymans terms this is an account that doesn't have iCloud tied to it, unique to that one computer.
In that sense, we can expect Apple to embed this “age value” somewhere within it's local users database (potentally encrypted but I doubt this).
What happens if that computer gets a virus or some IT helpdesk scams the parent and installs some backdoor to the computer? Whoops you just let leak your child's age (and potentally how many childern you have) alongside all the personal data on that computer!
Now someone is gonna have data to sell to the next child stalker (or god forbid some advertiser) that Karen has a young kid!
So wait, what if you link the computer to iCloud?
Well, we can expect Apple to store this age within iCloud, allowing the value to sync across all devices that Timmy owns, like his iPhone or iPad.
Hey, remeber that iCloud photo leak from 2014?
Do you really trust Apple to store your child's age in iCloud when their track record is shit?
This is assuming Karen doesn't get phished into sharing their login details with a malicious third-party.
Speaking of iPhones, what about those apps? This bill applies to more than just computers, it also covers phones!
Imagine Timmy downloading the next cool app™ that everyone at their school is playing. Developers have unfettered access to this age bucket value, and nothing is saying they can't just keep track of that.
Windows
Microsoft removed the builtin ability to use local accounts to install the OS, you can bypass this with custom builds or workarounds requiring custom installers but let's be fair here, Karen isn't going to bother with that or even care.
We know Microsoft is going to store this age in their cloud accounts, hell they already ask for your age for Xbox. Most people wouldn't even see the requirement pop up as they already filled this out years ago.
I don't need to tell you about the history of Microsoft and how little they care about you and your data.
Linux
Well, all distros operate via local accounts. Ubuntu is exploring their options but there is no offical annoucement yet. Chances are it'll look like Apple's solution for local accounts.
That being said most distros do not have the developer bandwidth to implement what this law is asking them to do, so instead they'll be writting in a clause in their end user agreement that states the software is not be used in California.
This doesn't seem like much but from my interpretation of the law, it doesn't differentiate between desktop and server usage.
If distros start writting out usage in California then most every new server starting January 1, 2027 will be violating both the law and the end user agreement of the distro.
So we reviewed how the three operating systems handle account creation.
If we ignore Linux, because let's face it, the Linux desktop userbase is tiny compared to Apple and Windows and most people using Linux will happily violate this law because fuck laws.
We now have a law that forces major companies into collecting a generalized age of all their userbase. These very same companies that have horrid track records of ensuring their customer's data is secure, who are also some of the largest targets for hackers because of this very data.
If you are of the kind that believes you have “Nothing to Hide”, then buddy I'm sorry to tell you this but that's just an excuse to further violate your privacy.
This companies do not care about you or your privacy, all they care about is a bottom line. You don't have anything to hide but that doesn't mean you should be willing to show everything to anyone that asks under the guise of “Child Protection”.
If you have a child then you really need to think about this, regardless of what you believe that child is their own person. Do you really have the right to violate their privacy by sharing this information to faceless corporations who operate with the understanding that all they have to do is say sorry and pay a fine?
Karen willingly entered their child's age into the new computer and that data is forever stored on a server somewhere. Any application running on that computer, be it installed or online, will access that information to do what they believe is correct with that information.
If you don't care about Apple or Microsoft then care about the millions of developers who now have the right to know an aproximate age of your child.
Gavin Newsom signed this law into affect.
He is a Republican maskerating as a Democratic. Using Republican talking points to convince people into allowing this law to pass.
He has signed anti-trans bills into laws and is generally a bad vibe within his own party.
Fuck him and anyone who defends him, this law is one of many he pushed in “for the sake of the kids”.
End
So, how could this be better handled?
Well, for one not storing your kid's age on anything.
If you are a parent, control your kids usage of these devices.
Enable Parental Controls on their devices, most all systems already have some level of parental controls built-in.
If you are thinking about installed one of the many “Child Protection” apps that record and track everything your child does on their phone?
Hey, where do you think that data is stored?
How do they know when to alert you?
That's right, those apps sends all that data to their own servers, potentally storing it for years :)
If you really can't do that, then don't give your child access to these devices.
Or atleast be an adult and talk to your kids, teach them how to identify bad actors and how to protect themselfs from them.
As a parent, you can not depend on the law, or developers, to protect your child, that is your own responsibility.
Step up to the fucking plate and stop making everyone else take care of them for you.