Introduction
Governments around the world are crafting new laws that require websites and apps to determine users' ages before granting access. These measures aim to protect children and teenagers from online harms like grooming, bullying, and exposure to violent content. While the intentions are laudable, many proposals risk imposing heavy burdens on the open source software ecosystem and developer infrastructure services—without addressing the actual risks posed by these platforms. In this article, we explain what age assurance is, how current legislative proposals could affect developers, and how you can engage with policymakers to avoid unintended consequences.
Understanding Age Assurance and Its Goals
The online risks that age assurance laws seek to address are serious and well-documented. Young people face threats such as:
- Grooming for sexual purposes
- Exposure to violent or harmful content
- Online bullying and harassment
At the same time, participating in online communities—including open source projects—can be a valuable part of a young person's education and social development. Policymakers must strike a balance between freedom and protection. Unfortunately, they often lack a deep understanding of how their proposals affect developers or how the open source ecosystem functions.
What Is Age Assurance? Definitions and Methods
The term age assurance covers a wide range of techniques used to estimate or verify a user's age. It is sometimes used interchangeably with age verification, which typically refers to high-confidence methods like checking photo IDs or matching against financial records. Other approaches include:
- Self-attestation – users report their own age
- Age estimation – age is inferred from signals such as facial scanning, behavior patterns, or device usage
Each method comes with trade-offs in accuracy, privacy, security, interoperability, and accessibility. Proposals also differ on what age thresholds trigger restrictions, which services are covered, how parental consent is handled, and how access is limited. While we don't examine every approach here, it's crucial to consider the full spectrum of online risks while preserving the internet's potential for learning, coding, and global collaboration.
How Age Assurance Proposals Could Impact Developers
When policymakers design age assurance laws, they often have consumer-facing platforms in mind. But the wording can sweep in unintended targets—especially open source projects and developer services that don't present the same risks to minors.
Potential Pitfalls for Open Source Projects
A poorly crafted law might, for example, require operating systems to centrally collect and manage user age data, or restrict users from installing software outside of centralized app stores. Such requirements directly conflict with the decentralized, user-controlled norms of the open source ecosystem. In practice, this could mean:
- Hindering the distribution of open source software through alternative channels
- Imposing costly compliance duties on volunteer maintainers
- Forcing projects to collect personal data they neither need nor want
The Challenge of Decentralized Ecosystems
Another risk is placing age assurance obligations on “publishers” of operating systems—even when those publishers are individual developers or small teams. In the open source world, an “OS publisher” could be anyone who compiles and shares a Linux distribution. Applying the same rules meant for commercial giants like Apple or Google would be disproportionate and counterproductive.
For instance, a law might demand that operating systems verify a user's age before allowing any software installation. This would break the fundamental principle of user autonomy and make it nearly impossible to run code from community repositories. Developers would face an impossible choice: either implement expensive age checks or cease distributing their work.
Engaging with Policymakers
Developers and open source organizations can help shape these laws by:
- Submitting public comments on proposed regulations
- Meeting with legislators to explain how the open source model works
- Collaborating with industry groups to draft balanced age assurance standards
It's essential to emphasize that age assurance requirements should be scoped to services that present genuine risks to minors, not to infrastructure or developer tools. For more details on specific legislative proposals, see our analysis of developer impacts.
Conclusion
Age assurance laws are coming, and they will affect the software we build. By understanding the key concepts and potential pitfalls, developers can engage constructively—protecting children online without sacrificing the openness and innovation that makes the internet thrive.