TODO: Figure out how to handle California AB1043

[mszoek]

https://legiscan.com/CA/text/AB1043/2025

[kevincrans]

Without being able to browse sites/communicate, there is 0% risk for people of younger age.
This means age verification can be skipped, until the browser is used, or terminal or alt-appstore to download websites/database that need the whitelist disabled (you could create a homepage with worldwide children-safe domains/sites & whitelist known websites you cannot decline services for, like drivers & vital services, like government sites, medicine, housing/food/digital product sites like Wasmachines, RavynOS & VPNs), disabled which it will be starting the wifi login in non-strict countries.
For verification you could choose to wait for digital ID, maybe provide face recognition (only without internet), and provide camera, NFC, or read PDF/JPG from USB/SD/disc/Bluetooth for ID verification, or from hard-drive after skipping.
This each first time before or after logging into a new user account (local or optional online), after a setup, after you enter your age and current and registered region > state/country (if none ask if the person lives in a list of strict state/countries), there could be optionally asked for auto-location permission on OS level.

U might need to make a password necessary in these states/countries, for kids re-using an unwiped device.

Be aware, they cant force smth like auto-location permission globally, but if they try, you could have 2 downloads where 1 is unavailable in certain places, making it not your concern.
No lawyer either.

[reactive-firewall]

https://legiscan.com/CA/text/AB1043/2025

Obligatory disclaimer: I.A.N.A.L.

My layman interpretation of the cited law is intended to cover things like GitHub's "Releases" (the providing service), Apple's "App Store", etc. and require those services to age verify new users and provide an API to indicate minor versus 18+ (e.g. California's adult age threshold)
So this can be part of handling the apple store API.

Or possibly by leveraging AppleID SSO (apple verifies adults have a valid CC/payment on file during creation to reasonably verify a guardian to give consent before moving past the SLA (e.g., search "O. Compliance with Laws" in the Tahoe SLA found online here for internet usage must comply with local laws, passing the buck to customers. 🤷 I imagine using the app bundle info.plist which has a key about content age rating, and a user supplied birthdate would be reasonable.

To summarize enforce the initial account creation workflow instead of a desktop session for the default user: require name, birthdate, locale (country/province/state for compliance and keyboard/TZ etc.), username, password, before creating a user that can login to the desktop (it is reasonable to use that to indicate should use feature or not in the process launch hooks of the desktop sessions)

Unless you plan to age restrict RavynOS as "not for kids" 🤷

Hope this helps

[lockedcitizen]

stupid US law