Linux Just Added a Birthdate Field to User Records

The draft looks accurate and complete—no distortions, omissions, number mismatches, or glossary violations found.

Linux User Records Now Have a Birthdate Field

On March 18, 2026, a birthDate field was added to the development code of systemd, the system management software used by many Linux distributions. It’s an optional field that lets a user record store a birthdate. This change alone doesn’t mean every Linux user now has to enter a birthdate. systemd changelog

Lennart Poettering, the creator of systemd, explained that the field is optional and isn’t itself an API that tells apps a user’s age, nor a mechanism that enforces any usage policy. Meanwhile, the person who proposed the change cited, as additional justification, legislative moves requiring age verification—like California’s law and a Colorado bill.¹ Discussions aimed at responding to what these laws and bills demand have ended up reaching all the way into the data structures of an operating system. Poettering’s explanation

In this debate, we need to look together at who verifies age, what information gets passed to apps, and who bears the cost and liability of doing that work. Even if everyone agrees on the goal of protecting children, the flow of personal information and the burden placed on companies differ depending on how it’s actually implemented.

What California’s law actually requires is age-range disclosure

California Governor Gavin Newsom signed AB-1043 on October 13, 2025. The law’s operational obligations take effect January 1, 2027. It requires operating systems, app stores, and app developers to exchange age information with one another.

Operating system providers must offer account holders an input method, at account setup, to indicate the device user’s birthdate or age. When an app requests it, the OS must pass along the age range — under 13, 13-15, 16-17, or 18 and over — via API. An API is a channel through which programs exchange information with each other. What the law requires apps to receive isn’t a full birthdate or a name — it’s an age range.

The law defines “operating system provider” broadly, as any entity that develops, licenses, or controls the operating system of a general-purpose device such as a computer or mobile phone. That’s sparked debate over what obligations fall not just on commercial products like Windows or Android, but on Linux distributions too. How much responsibility volunteer-run projects should bear is also a live question.

App developers have obligations of their own. They must request an age signal when a user downloads and launches the app, and use the information they receive to comply with relevant law. Both operating systems and apps are required to exchange only the minimum information necessary, and are barred from passing it to third parties for purposes the law doesn’t require. This isn’t a mandate to broadcast real names or birthdates to every app every time a device powers on. Full text of AB-1043

Similar discussions are underway elsewhere. Colorado’s SB26-051 passed the state Senate 28-7 on March 3, 2026, and has moved to the House for deliberation. But states differ on whether the target is the operating system or the app store, and on whether self-reported age is sufficient or separate verification is required. Bills still under deliberation, laws already enacted, and obligations actually in force need to be read separately. Colorado General Assembly record

Assigning the verification step to operating systems or app stores can spare individual apps the burden of repeating the same checks. But that shifts new obligations onto whichever business or development project takes on the role. Because California’s law, like others, also places a duty on app developers to request and use the signal, it would be wrong to conclude that social media companies are exempt from regulation altogether.

Meta Supports Having App Stores Handle Age Verification

Meta has publicly backed a system in which app stores handle age verification and parental consent. Its argument: this spares users from repeating the same verification process across every app, and makes things easier for parents to manage. Adopting this approach would also mean app store operators like Apple and Google take on the verification burden — which happens to align with Meta’s business interests. Meta’s 2025 position

There’s also reporting on Meta’s involvement in the legislative process itself. In an October 2024 investigation, Pluribus News reported that Louisiana state representative Kim Carver said Meta lobbyists had supplied the language for an app store age-verification provision. That provision was reportedly stripped from the final bill after Apple’s opposing lobbying effort. Note that this refers to a legislative process from the year before, not the 2025 HB-570. Pluribus News report

In July 2025, Bloomberg reported that Meta funds the Digital Childhood Alliance (DCA). That’s reason enough to examine the interplay of interests between a group pushing app-store age-verification mandates and the tech companies around it. Bloomberg report

An OSINT investigation² compiling public records also tracks the lobbying activity of Meta and affiliated groups. Material like this can be a useful starting point for tracing registered lobbyists, bills, and disclosed spending. But treating a company’s entire lobbying budget as the cost of a single bill, or assuming that a certain number of lobbyists proves control over a bill’s wording, requires more evidence than that.

The same caution applies to organizations’ tax filings. The IRS’s 990-N e-Postcard is generally a simplified filing for small organizations with annual gross receipts under $50,000. The mere existence of such a filing doesn’t let you calculate that actual revenue was under $25,000, nor does it prove there’s some separate, undisclosed funding channel. Likewise, status labels in lobbying records — “monitoring,” “amended,” and the like — don’t by themselves demonstrate support, opposition, or hidden intent. IRS guidance

Past cases offer useful context here too. The Washington Post reported in 2022 that Meta ran a campaign through the consulting firm Targeted Victory to portray TikTok as dangerous to children. It’s a case that shows how a competitor’s interests can seep into debates over child safety. But that past campaign alone doesn’t mean every current age-verification law serves the same purpose.

I think when a company invokes child safety, we also need to ask where its proposal shifts the costs and responsibilities. To judge whether a policy actually works, you have to read not just the company’s claims, but the statutory text, its real-world implementation, and the lobbying record — together.

The EU is building tech that proves only the age requirement you need

In the EU, platforms’ child-protection obligations and age-verification technology that discloses less personal data are being pursued together.

Article 28 of the EU’s Digital Services Act (DSA) requires appropriate and proportionate protective measures for online platforms accessible to minors. This provision is not a blanket age-verification mandate aimed only at very large platforms with more than 45,000,000 monthly users. There’s a separate exemption for smaller operators, and very large platforms face additional risk-assessment and mitigation duties. Article 28 itself explicitly states that it does not force platforms to process additional personal data just to determine whether a user is a minor. DSA original text

The basic design of the age-verification app the European Commission is developing is to present services with nothing more than proof of whether someone is 18 or older. Identity verification may be required when the proof is issued, but the app is designed so that afterward, when visiting other services, it doesn’t transmit your name or exact date of birth. The goal is also to prevent the issuer from knowing which service the proof was used at, and to make it difficult for services to link multiple uses together.

The reference implementation is open source. A first version was released in July 2025 and a second in October 2025, with Denmark, Greece, Spain, France, and Italy among the countries testing it. This age-verification app is a separate project being developed to eventually be compatible with the European Digital Identity Wallet (EUDI Wallet). The Android implementation released in January 2026 also added zero-knowledge proofs (ZKP)³. EU’s October 2025 announcement, development roadmap

Zero-knowledge proofs are useful for disclosing less information, but they don’t by themselves guarantee privacy across an entire service. You still need to check what records the device and app leave behind, and what information the proof issuer and verifier can see. Whether users outside the range of supported devices end up excluded is also worth examining.

California’s law and the EU’s technical design are, from the start, being compared on different terms. One is a legal obligation imposed on operating systems, apps, and the like; the other is a concrete implementation for proving age.

Both approaches share an element of limiting the information passed to services. California’s law also has apps send an age range instead of a full date of birth. The EU’s implementation adds to this by separating the issuance and use of proofs and by making it difficult to link usage history together. Either way, you can only evaluate the level of privacy protection by checking what information is collected, what’s shared, and what records are left behind, in each case.

Oswarld’s Lens

On this issue, I think it’s just as important to be clear about what harm the technology is supposed to reduce as it is to build good age-verification technology.

The piece by Jaromil that prompted me to write this draws a distinction between classifying and blocking content on one hand, and a guardian’s judgment on the other. Rules that restrict certain content are one thing; an adult who understands a child’s specific situation setting usage hours or exceptions is another. I agree with the point that a single piece of age information can’t stand in for both of these roles.

Having built go-to-market strategies myself, I’ve seen countless times how a complex social problem gets packaged and sold as solvable by a single technical fix. So when age verification is presented as the answer to child protection, I find myself first checking how closely it actually connects to where real harm occurs. We need to separate out which harms are reduced by knowing someone’s age more precisely, and which harms require different measures altogether.

It’s not just harmful content itself — recommendation algorithms, dark patterns⁴ that nudge users toward particular choices, and service designs built to keep people engaged can all affect children too. Age verification may help in applying protective measures, but it can’t substitute for the discussion of how content and recommendation systems themselves should change.

We also need to stay wary of the possibility that features built for age verification end up being repurposed later to check other kinds of identity information. This isn’t to say current law mandates that kind of expansion. Rather, it means that from the initial design stage, the purpose of use, data retention, and limits on third-party sharing need to be narrowly defined — and actually verified in practice. I think we need a direction that strengthens child protection while also reducing unnecessary identity verification.

Closing

When you look at an age-verification law, read the behavior it demands rather than the name it carries. Who collects the information and what gets passed to the app, and how the app is required to use that information — these details determine the law’s actual effect and burden.

The same standard should apply to how companies like Meta engage with legislation. You can weigh what advantages a proposal to hand verification off to another operator offers, and how responsibility gets divided as a result. The fact that lobbying occurred and the claim that a law grants immunity to a specific company are two separate assertions, each requiring its own evidence.

The EU’s age-verification technology demonstrates a method for not handing over identity information that a service doesn’t actually need. Whether this kind of design actually prevents tracking, whether it works across multiple devices, and whether it delivers real protective effects — these are things you can only confirm through implementation and operation.

I don’t want policy judged on the convenience of age verification alone. I think we need to weigh how much it reduces harm children experience alongside what disclosure it demands from every user in the process.

References & Further Reading

• Jaromil, Do Not Turn Child Protection Into Internet Access Control, 2026. A piece on the difference between content restriction and a guardian’s judgment.
• California Legislature, AB-1043, 2025. Covers age-bracket signaling, developer obligations, and restrictions on how the information can be used.
• systemd, proposal to add birthDate, Poettering’s explanation, 2026. Explains the scope of an optional storage field.
• Meta, Working With Parents to Enroll Teens Into Teen Accounts, 2025. The company’s position advocating age verification and guardian approval at the app-store level.
• Pluribus News, Meta lobbies for app store age verification laws, 2024. Details the bill language proposals attributed to Representative Carver and the lobbying process behind them.
• upper-up, Meta Lobbying and Other Findings, 2026. An independent investigation tracing public records — worth reading alongside the individual claims and their primary sources.
• European Union, Digital Services Act, 2022. Articles 19, 28, and 34–35 lay out the scope of application and minor-protection obligations.
• European Commission, The Age Verification Manual, 2026. Describes the EU’s age-verification procedures and implementations under development.
• Washington Post, Facebook paid Republican strategy firm to malign TikTok, 2022. Reporting on the campaign run through Targeted Victory.

The author is Oswarld (Kwangseob Ahn). Current roles: Adjunct Professor at Sejong University, Strategy Consultant at INLEVEL9. Career, research, books, and recent work are kept current on the About page. Latest · July 2026: HEMA-2: A Consolidation-Aware Tri-Memory Architecture with Multi-Channel Scheduling for Lifelong Conversational AI.

Footnotes

1. Age Assurance is an umbrella term covering methods of self-declaring, estimating, or verifying age. The level of verification required and the party responsible for it vary by law. ↩

2. OSINT (Open Source Intelligence) is a research method that gathers and analyzes publicly available information such as news reports and public records. Being based on open information doesn’t mean every finding drawn from it is automatically verified. ↩

3. A Zero-Knowledge Proof is a cryptographic method that lets one verify that a statement is true without revealing the underlying secret information itself. In age verification, it can be used to prove that someone meets a required age threshold without disclosing their exact date of birth. ↩

4. A Dark Pattern refers to interface or process designs meant to deceive users or push them toward unwanted actions — for example, making it difficult to decline consent or cancel a subscription. ↩