Illinois Law Quietly Requires Linux Distros to Add Age Verification by 2028
Illinois Just Passed a Law That Puts Linux on the Hook for Age Verification
Illinois' new Children's Social Media Safety Act (HB5511) targets TikTok and Instagram, but buried in the bill is a mandate for operating system providers—including open-source projects—to build an age-declaration step and hand age-bracket signals to apps via an encrypted API by January 1, 2028. Unlike Colorado and California, Illinois granted no open-source exemption. With penalties up to $7,500 per child, enforcement falls to the state AG, leaving hobbyist distros likely out of reach but putting commercial vendors like Google, Microsoft, and Apple on the hook.
Nothing in the bill requires a passport scan or a face scan at setup. It’s self-declared, the same way most apps ask your birthday today, just centralized once at the OS level instead of repeated app by app.
- lrvick
Linux distro founder here (stagex)
I will never be compelled to implement this, and would never merge it.
Every release requires quorum signatures by an international maintainer team, and the distro is designed to work offline-first, with some variants not even supporting network drivers in the kernel, so Illinois legislators can eat shit.
- kej
I feel like all of these laws are being designed backwards. Content providers, like MPAA films, should have to identify what sort of content they are providing. Then I can give my kids a device configured to allow some or all of that at my discretion.
Requiring my kids' devices to advertise their age (or their age "bucket", as if that was a meaningful difference) to protect them is not doing me or my kids any favors.
- Aurornis
Not that I'm condoning it, but this law requires self-declaration, not verification. It might sound pedantic but the practical difference is huge.
Self-declaration means that the system asks the user to declare if they are a minor. Nothing is verified.
Age verification typically means a system which checks ID or has other enforcement measures to try to verify age.
- mrieck
Not surprised - I live in IL and almost every SaaS I pay an extra "15% Chicago Lease Tax". Politicians hate tech here.
- bnjms
So in red states porn is being used, and in blue states TikTok and Instagram are being used. Is anyone tracking who is behind the concerted efforts here? For example, which organizations, executives, lobbyists and politicians are valid and responsible parties?
- 1vuio0pswjnm7
1773350468 | Illinois introduces OS-level age verification law | https://legiscan.com/IL/bill/SB3977/2025 | https://news.ycombinator.com/item?id=47357294
1773770767 | Illinois Introducing Operating System Account Age Bill | https://www.ilga.gov/Legislation/BillStatus?DocTypeID=HB&Doc... | https://news.ycombinator.com/item?id=47416131
1786248239 | Illinois just told every operating system to start reporting your kid's age | https://itsfoss.com/news/illinois-age-verification-bill/ | https://news.ycombinator.com/item?id=49228350
- LPisGood
What does that mean, practically? The person who installed linux on that particular device is liable?
>no algorithmic feeds for minors by default
Any choice of what content to display is an algorithm. Maybe they want a simple or easily explainable algorithm?
- InitialLastName
Since TFA can't be bothered, here's the text of the actual bill: https://my.ilga.gov/Legislation/BillStatus/FullText?GAID=18&...
- pull_my_finger
I agree with literally everyone who thinks this is pointless and probably malignant. The problem isn't the visibility or the fact that weird stuff "exists" on the internet. The problem is advertisers "showing" it to people who didn't go looking for it. Ads and algorithms that decide what a person to see are 99.8% of this actual problem, and meta lobbying for something like this is just obvious self-interest to absolve them from any liability for showing kids damaging material, and to hit 2 birds with one stone, they get more PII to add to their "anonymized" aggregate data.
No good will come from this for the consumer. Websites are suddenly all going to start accurately reporting their content rating, especially ancient documents that have been "online" since before css and javascript were a thing. The only ones that will be implementing these checks will be adtech people that shouldn't have it in the first place. Letting out of touch geriatrics make tech policy decisions in a time when the bleeding edge is moving faster than ever is going to be disastrous for generations to come.
- xp84
Serious question: This is a out-of-box "ask for age" requirement. No one is "verifying" anything. Why are we using this misleading headline? Face scans, ID cards, all that stuff that makes everyone nervous, are specifically not a part of this. To imply that it is verification is propaganda.
As a parent, I'd be very happy with this "age declaration" method, as I also don't think the 'verification' others push for is at all worth the risks. All parents want is to put the devices permanently into a mode that flags it to third parties as belonging to a minor, so they can't just hold up their hands and say "idk they said they're 18" like they do today.