Good evening, Unless the provider is within California, which Arch Linux is not, there is nothing the Californian state can do. This has been discussed endlessly on the OpenBSD mailing list the past few days. It seems on the Debian and Ubuntu mailing lists, they have been discussing how to comply, less so whether they can ignore it entirely. If Arch Linux doesn't comply, what is the Californian state prosecutors going to do? Ban * Linux? Well then good luck running any digital infrastructure. Laws such as these are impossible to comply with, they are passed to give the government the ability to fine, censor and shutdown any organisation or company which they do not agree with, whether they have a legitimate or illegitimate reason to do so. If this was passed as a US federal law, then there could be some cause for concern, but considering its currently just California (and I believe its Colorado which wants to follow suit), they can only really go after Californian companies and organisations, and they don't have the power to really get people extradited from other countries to stand trail in California. So in the end, the worst I could see happen is that Arch Linux gets banned in Cali, along with other non-complying distros, but Cali will end up having seldom digital infrastructure, and will go back to the dark ages. The one important thing is, not to follow the example of MidnightBSD which relicenced their project to ban Californians, which now makes it non-free. If Arch is to be prohibited in Californian, it must come from the state, rather than Arch. Take care, -- Polarian Jabber/XMPP: polarian@icebound.dev

There was a law passed I guess in California requiring OSes to add a bunch of stuff that breaks privacy preservation. It shouldn't really have legal reach if none of the Arch devs live in California and if Arch is willing to spend the money like DHH to fight Cali if necessary. It's probably intended to stop children from seeing pornography. But, I have no children and no need for any security problems that added code brings. There's ways to handle this stuff where it's the responsibility of the parents to pay $10 to some company that filters their internet of porn. There's various open source services for doing this on your network if you're concerned about your 13 year old finding Jenna Jameson. I do think if you comply with the law that leads to a fork attack on Arch, which might be successful. My guess is DHH's branch becomes the main. Your users definitely do not want to have to deal with a bunch of security and privacy issues this law will almost definitely add to Arch. It might be bad for the Linux kernel security as well. A bunch of these laws around computer system verification causes extreme problems for end users who are committing no crimes. There's a documented list of exploits for various network hardware products out there from laws requiring stuff like back doors for law enforcement. This is bad for Arch if you comply with that law. On Sat, Mar 7, 2026 at 4:16 PM Ralf Mardorf <ralf-mardorf@riseup.net> wrote:

On Sat, 2026-03-07 at 18:28 +0000, Some Guy called wrote:

...

Will Arch Linux add age verification to comply with Californian laws?

Looking forward to your answer!

Hi,

https://en.wikipedia.org/wiki/Social_media_age_verification_laws_in_the_Unit...

Isn't this about social media garbage that feeds children one trashy video after another via algorithms, pornography, fake news, etc.?

I'm not a lawyer, and I've only skimmed the wiki very, very superficially, but children should be encouraged to learn computer skills through Arch forums, even if it means they sometimes spend a little too much time sitting in front of the screen.

Regards, Ralf

I'm a reader of this email and have never responded or asked anything but..... I've heard a lot of the ideas people are thinking off the top of their heads currently and realize this is just getting started but I wanted to raise a possibility that may apply to Arch and not the common distributions. I've heard several comment their intentions to not approve their distro for use in California which is my favorite. But Arch, to me, is very different in that you do not download and push a button and log in and you're done. You download enough to build a system a system using the parts and pieces available in the repositories. It's the same model from the beginning days when you downloaded a floppy image from a guy name HLU and used that to build the drive then compile what pieces you needed wanted.....except instead having having to having to gather up the various pieces of code from different universities and compile everything from source, we've got that incredible repository. Anyway, it occurs to me that any "package" which supplies the age labeled spy code would need to be installed and like most other packages the user/builder installs them.. Arch supplies the slim virtual system to build the actual installation,. Arch supplies the instructions describe how to install packages available to use on the system you are building, not Arch building, the user is building. So..... why would Arch be responsible for what components a user uses to build their system...... I suppose they could expect that initial slim virtual system to ask how old you are.... but how could Arch be responsible for what others do......... In the end California will bury everyone in legal costs unless some freedom legal nonprofit steps in. Large corporations don't have pockets as deep as a government so I don't think it's about how the mpouse trap works, at this point, it's more about teaching everyone how to jump through the hoop like nice little boys and girls.... On Sat, Mar 7, 2026 at 8:45 PM Ralf Mardorf <ralf-mardorf@riseup.net> wrote:

Everything I have to say now is 100% political and has nothing to do with Arch Linux. Nevertheless, I would like to point out one thing: it is impossible to obey the laws of one country without violating the laws of another.

Every morning when I wake up, I wonder what new political nonsense has been added overnight.

Political age barriers are an issue in themselves.

I would like to point the finger at other nations, but unfortunately I am a citizen of a country that started two world wars and is one of the few countries in the world that still recruits soldiers under the age of 18. The politician who fully supports an army including minors is the politician with the highest approval ratings in my country.

Therefore, I would rather hold back when it comes to another country that believes that every operating system must register its users and verify their age.

Although I have nothing further to contribute on this topic, I will nevertheless continue reading with interest.

On 7 Mar 2026, at 19:38, Ralf Mardorf <ralf-mardorf@riseup.net> wrote: On Sat, 2026-03-07 at 18:28 +0000, Some Guy called wrote:

...

Will Arch Linux add age verification to comply with Californian laws?

Looking forward to your answer!

I don’t know why a distributed/community-driven project such as Arch Linux should bother trying to comply with this law. As it’s currently written, this law would also require any kind of embedded device running an RTOS or a custom Linux distribution (Yocto/Buildroot) to comply. This means that your modem/router, your smart TV and even your smart fridge should somehow implement this functionality. In other words, it’s currently unenforceable from a technical point of view. Major OSes will adopt it since they’re backed by corporations that simply cannot avoid doing business in these countries/states. However, as far as Arch, Debian, Gentoo, *BSD, etc. are concerned, this is a nonissue.

On 3/8/26 1:05 PM, David C Rankin wrote:

  It would be difficult to make the argument that any Arch content falls within the scope of the proposals. That notwithstanding, even if you could make the argument it applied to Arch, the individual state laws are currently enjoined on free-speech grounds and will take years to be settled (social media co's have plenty of money to extend the litigation near indefinitely).

Now the laws requiring the OS to collect and provide age information may well need to be discussed, though same caveat, while California and Colorado are slated to require this by 2027, it is doubtful these laws won't be enjoined before actually taking effect. (California's Assembly Bill No. 1043; Colorado's Senate Bill 26-051) Another option is the MidnightBSD notice, simply advising residents of states that requires age collection and provision are not authorized to use the FOSS offering: "California residents are not authorized to use MidnightBSD for desktop use in the state of California effective January 1, 2027." Solves all the problems without changes, and places the burden on resolving issues correctly with the citizens of the state promulgating the law. This may end up being an interesting exercise to watch. Nothing short of a war between the privacy advocates, and the advocates for the protection of children. Not to mention the FOSS community's eagerness to have more personal information captured in the OS -- and then by what, systemd? Funny, when I grew up, child-rearing was the responsibility of the parents making nanny-laws an unwanted intrusion on the libertt rights of the parents rendering them unnecessary. Curious when/where that became not the case. -- David C. Rankin, J.D.,P.E.

On Mon, 2026-03-09 at 03:56 -0500, David C Rankin wrote:

This may end up being an interesting exercise to watch. Nothing short of a war between the privacy advocates, and the advocates for the protection of children. Not to mention the FOSS community's eagerness to have more personal information captured in the OS -- and then by what, systemd?

I can't resist saying more about this. The questions would be 1. With an open source operating system, how can you ensure that a security mechanism that performs age verification cannot simply be bypassed before installing this operating system or using it for the first time or each time you want to use it? It would be possible to bypass this without cracking any ominous binary blobs. This makes the whole thing even more absurd, especially for users who use a distro that is not user-friendly but user-centric. 2. Who should verify and store the data? Should David, for example, hold his ID up to a webcam and have a trusted user check it and store it in a database? 3. I haven't read the law. Does every login have to be done by someone above a certain age limit for younger users? Does it have to be a legal guardian? Some have mentioned routers and smart TVs, which would be perfectly acceptable when it comes to child protection. Which devices still operate with complex gear mechanisms today? Or just with electrical circuits, on-off timers via NE555? I still have a lot of old devices and haven't had to look inside the new ones yet. But I would be very surprised if new devices didn't use computers, but instead used gears and analog electronics. What about the dishwasher, washing machine, etc.? Are 13-year-olds now not allowed to learn to be independent without someone first approving the dishwasher or washing machine? Up to what age should little ones suckle at their mother's breast? Until they are 16? Until they are 18? Even if this could be implemented, it would be disastrous for children's development.

Hi, On 09/03/2026 10:44, Ralf Mardorf wrote:

On Mon, 2026-03-09 at 03:56 -0500, David C Rankin wrote:

...

This may end up being an interesting exercise to watch. Nothing short of a war between the privacy advocates, and the advocates for the protection of children. Not to mention the FOSS community's eagerness to have more personal information captured in the OS -- and then by what, systemd?

I can't resist saying more about this.

The questions would be

1. With an open source operating system, how can you ensure that a security mechanism that performs age verification cannot simply be bypassed before installing this operating system or using it for the first time or each time you want to use it?

It would be possible to bypass this without cracking any ominous binary blobs. This makes the whole thing even more absurd, especially for users who use a distro that is not user-friendly but user-centric.

2. Who should verify and store the data? Should David, for example, hold his ID up to a webcam and have a trusted user check it and store it in a database?

3. I haven't read the law. Does every login have to be done by someone above a certain age limit for younger users? Does it have to be a legal guardian?

Please first read up about the topic instead of just making blind assumptions and FUD. So if you wish to engage on this topic at least try to be informed. All that is needed is a way for the operating system to provide an age (range) to an application / app store. Work for this is already underway in GNOME / systemd for parental controls. [1] [2] This is already wanted for parental control reasons unrelated to California law. Also note that the EU is working on age verification for applications, and it seems other countries such as Brazil are too. [3] So for this all seems to be inevitable and something distributions will have to deal with. [1] https://github.com/flatpak/xdg-desktop-portal/pull/1922 [2] https://github.com/systemd/systemd/pull/40954 [3] https://www.eff.org/deeplinks/2025/04/age-verification-european-union-mini-i...

On Mon, 2026-03-09 at 11:43 +0100, Óscar García Amor wrote:

For example, the proposals made so far for age control give me real chills. Where does privacy end and control begin?

As I said, it's 100% political and therefore has 0% to do with Arch Linux. I completely understand why there are such proposed solutions for FLOSS software, such as those from the links provided by Jelle van der Waa. I don't want to be misunderstood as criticizing this. It saves trouble. Period. But if you want to think beyond that, then it gets political: If it would help, then the ethical answer would be that violating data protection is justifiable in the interests of the child's welfare. The problem is that the task is viewed from the wrong perspective and is therefore approached in an academic and completely wrong way. Prohibitions and instruction in proper behavior are academic fantasies that are far removed from the reality of life. The only way to accomplish this task is to make the lives of children in affluent societies so interesting from the children's perspective that they find the negative aspects associated with computers far too boring and uncool to waste even a moment of their lives on them. The fact is that children are already familiar with trash that is not only restricted to people aged 16 or 18 and above, but also costs more money than children have. In other words, parents allow them access to things that have long been forbidden to them anyway. The only thing that would be necessary is for parents not to finance certain things for them. I have had and will probably continue to have dealings with elementary school children and their guardians. It doesn't matter whether parents are doing the right or wrong thing, it can't be prevented. The question is why every elementary school boy is interested in playing Call of Duty regularly (which, by the way, is harmless compared to what else elementary school-aged children consume). Children have boring lives or no prospects. If you change this, you solve many other problems as well.

Hey,

All that is needed is a way for the operating system to provide an age (range) to an application / app store. Work for this is already underway in GNOME / systemd for parental controls. [1] [2]

You seem to be shrugging off a legislation which should never exist (as it violates the rights of its citizens) as "Oh its easy to implement". This is one upside of the legislation, it forces applications to trust whatever age range is provided. In other words, Arch Linux could comply by implementing mandatory age bracket disclosure on the creation of a new user, and all applications must (by law) trust that, which for most people could just simply lie and the age will be respected. However, how long until the legislators realise that their law is weak, that its easy bypassed (just like the online safety act here in the UK) and then move to amend the bill to then force effective ID? How long until the legislation starts demanding proprietary blobs in order to effectively enforce it, as we all know open source is a major thorn in the side of government. This is the point I made in my initial email, its impossible to comply with such laws as they will inevitably become more and more evasive the more you try to work around the legislative issues. The more the legislation doesn't work, the more desperate legislators get to make it work.

Also note that the EU is working on age verification for applications, and it seems other countries such as Brazil are too. [3] So for this all seems to be inevitable and something distributions will have to deal with.

So thats it then? throw in the towel? Accept that its the end of what little liberty remains and comply? Right now the whole Cali thing is too small, but if the US federal government passed such law, or in your example, the EU, then it would be a much bigger issue. It won't stop here, it will just get worse and worse and worse. But honestly, there is nothing anyone can do anyways. Its the classic two wrapping papers used by every government for the past 50 years, its either wrapped as "protecting against terrorism" or "think of the kids", when in reality the true intent is to spy, censor, and control the population of a country. This is not about protecting kids, this is about control. As all governments do, start of small, something easy to comply with, and then build it up and up until it becomes the oppressive regime we all seem to oppose, and yet seem to support at the same time. So yeah I guess I get your point, freedom is a lost cause, we should just give up? Take care, -- Polarian Jabber/XMPP: polarian@icebound.dev

On Mon, 9 Mar 2026 at 12:33, Turcid <Turcid@protonmail.com> wrote:

Hence why the only option we should even consider is noncompliance.

This isn't just gonna go away or stop where it is. We need to resist now and always.

Sent from Proton Mail Android

I'm not sure we should encourage this political discourse in this mailinglist, nor condone noncompliance Bear in mind that polticial views aren't shared by everyone

Hi everyone, I see that this topic is generating a lot of attention, questions and fears. This is understandable, it's a pretty complex and delicate situation for all of us... which leads to my point: We (Arch Linux) are not sure yet how we want to handle this situation at the project level yet. We acknowledged your different inputs and interrogations, but we have no concrete plan of action to share on that front at the moment. Please, bear with us and hold for now... As shown by this ML thread (and related threads on other platforms), this is a complicated matter involving a lot of different stances & point of views. Speculating can quickly lead the topic astray, so let's keep it polite and friendly. :) Again, we understand the attention around this topic, but please arm yourself with patience. We will communicate as soon as we are able to. -- Regards, Robin Candau / Antiz

Hi, On 2026-03-09 10:14:23, Jelle van der Waa wrote:

All that is needed is a way for the operating system to provide an age (range) to an application / app store. Work for this is already underway in GNOME / systemd for parental controls. This is already wanted for parental control reasons unrelated to California law.

Do repos like the existing Core, Extra, and Multilib official ones count as an "app store" in their eyes? I'd "guess" that most of us are using Pacman in cli for all of our package management, and personlly I am not entirely sure that it would count, in my eyes. On 2026-03-09 14:28:41, Ralf Mardorf wrote:

If it is aimed at tech companies, a referendum exempting FLOSS projects would be one approach.

On 2026-03-09 15:38:20, Ralf Mardorf wrote:

Therefore, submit a referendum to exempt FLOSS from the regulation. Californians need to take this into their own hands.

If such a referendum or petition was to happen, I hope it would garner the right kind/amount of support. It won't be for either of us two to decide, as we're well across the pond from where this is going down for the moment. On 2026-03-09 15:35:33, Shaurya Anand wrote:

What if we change the definition of Arch, so it no longer falls under the category of an operating system? We can say that "Arch Linux is a collection of utilities and software to be used with the Linux kernel". This is a pretty bad idea according to me but could this work in theory? Like LFS is not an operating system or a Linux distro but a manual to set up one.

I've heard worse ideas for getting around it. It definitely sounds better than going nonfree. On 2026-03-09 10:43:41, Óscar García Amor wrote:

As I said before, it's an interesting debate.

On 2026-03-09 11:05:52, Ralf Mardorf wrote:

On Mon, 2026-03-09 at 11:14 +0100, Jelle van der Waa wrote:

...

[1] https://github.com/flatpak/xdg-desktop-portal/pull/1922 [2] https://github.com/systemd/systemd/pull/40954 [3] https://www.eff.org/deeplinks/2025/04/age-verification-european-union-mini-i...

This reads like satire for anyone who works with children and guardians.

Interesting sounds about right. This whole situation feels like a The Onion article come to life, and I don't work with either. On 2026-03-09 14:19:06, Robin Candau wrote:

Again, we understand the attention around this topic, but please arm yourself with patience. We will communicate as soon as we are able to.

As per this, this will be my last contribution to this thread until I (or we) know more. I'm going to be keeping an eye on how things turn out over here in Britain. With the way things have been with other laws over here (including the potential for requiring ID checks for all VPN users) I am not hopeful. -Adam

last time I checked, omarchy was just a bunch of dotfiles and shell scripts. unless that changed substantially, I doubt omarchy will ever be the main branch of anything. On 3/7/26 10:18 PM, mike lojkovic wrote:

Omarchy will become a the main branch

Hey,

If Arch is forced to comply, the MidnightBSD path looks great to me.

As I explained in my former email, banning a group of people from a open source project makes the project nonfree (aka not open source!). MidnightBSD is no longer open source software, nor is it free software, as they have removed the licence grant to Californians excluding them. Both free software and open source software require EVERYONE to have the same licence grant, without excluding any groups of people. Please do not endorse making Arch Linux nonfree, thanks! Take care, -- Polarian Jabber/XMPP: polarian@icebound.dev

On Sunday, 8 March 2026 at 20:14, Polarian <polarian@polarian.dev> wrote:

Hey, Hi,

...

If Arch is forced to comply, the MidnightBSD path looks great to me.

As I explained in my former email, banning a group of people from a open source project makes the project nonfree (aka not open source!).

I failed to see that. I am so sorry about that. Then, the next option would be to hope that this law is changed so that operating systems (distros) like Arch are not impacted. I will be looking forward to that. Because as someone already said it here, the law may even mandate real time operating systems to comply.

MidnightBSD is no longer open source software, nor is it free software, as they have removed the licence grant to Californians excluding them. Both free software and open source software require EVERYONE to have the same licence grant, without excluding any groups of people.

Please do not endorse making Arch Linux nonfree, thanks!

Trust me, my intention was not that, but it then came out like that. Maybe some workaround for Californians so that Arch is not impacted for them?

Take care, -- Polarian Jabber/XMPP: polarian@icebound.dev

Hello, all, On 2026-03-08 19:08:19, Ralf Mardorf wrote:

...you can also take a positive view of the path MidnightBSD is taking. Of course, they are not seriously excluding Californians. See, MidnightBSD isn't really restricting freedom. They are giving Californians the opportunity to decide for themselves and are preventing any unpleasantness.

When I first mentioned the MidnightBSD stance, this is exactly what I was alluding to. I probably should have worded that better...

I have no idea whether such a clause would allow you to evade the law. As a budding honorary lawyer, I would suggest structuring the license in a way that is "salvatorius".

I do see value in this, though I would want to get an actual practicing California lawyer on this just to be sure. On 2026-03-08 18:27:00, Shaurya Anand wrote:

I failed to see that. I am so sorry about that. Then, the next option would be to hope that this law is changed so that operating systems (distros) like Arch are not impacted. I will be looking forward to that. Because as someone already said it here, the law may even mandate real time operating systems to comply.

The law is absolutely written in a broad enough way to include realtime OS's. From the way I read it, it could even include OS's specifically built for the server market. As for changing the law... That would require a tonne of lobbying, and enough signatures from California/Oklahoma residents in their own petitions to make it work. Is it possible for this type of thing to be organised? Maybe, idk though.

On Sunday, 8 March 2026 at 20:14, Polarian<polarian@polarian.dev> wrote:

...

MidnightBSD is no longer open source software, nor is it free software, as they have removed the licence grant to Californians excluding them. Both free software and open source software require EVERYONE to have the same licence grant, without excluding any groups of people.

Please do not endorse making Arch Linux nonfree, thanks! Trust me, my intention was not that, but it then came out like that. Maybe some workaround for Californians so that Arch is not impacted for them?

I need to also address this one, too. I was the one who initially mentioned them, and I also did not intend for endorsing making Arch nonfree. I, among many others, am heavily advocating for free/libre software as much as I can. On 2026-03-08 06:48:25, Shaurya Anand wrote:

I don't think Arch is ever going to comply. There is no way this law should apply to such DIY Linux distros, like Gentoo, or server distros.

I think the sticky situation arises when people use Archinstall[0] to install Arch onto their systems. Wouldn't this count as an installer that takes those specific installs from being a DIY Distro into being the type actually concerned with the law? If so, how can compliance (or "compliance") be met without breaking the terms of the GPLv3?

Parents should parent their children, not the government.

Unfortunately, this is what the whole world is coming to. It's starting to look like nowhere is safe from governments trying to intervene in this way. On 2026-03-08 02:45:16, Ralf Mardorf wrote:

Everything I have to say now is 100% political and has nothing to do with Arch Linux. Nevertheless, I would like to point out one thing: it is impossible to obey the laws of one country without violating the laws of another.

Every morning when I wake up, I wonder what new political nonsense has been added overnight.

Political age barriers are an issue in themselves.

I would like to point the finger at other nations, but unfortunately I am a citizen of a country that started two world wars and is one of the few countries in the world that still recruits soldiers under the age of 18. The politician who fully supports an army including minors is the politician with the highest approval ratings in my country.

Therefore, I would rather hold back when it comes to another country that believes that every operating system must register its users and verify their age.

This is all political, unfortunate as it may be. It still warrants discussion though, especially if it affects the direction of the distro (that I assume) we all love and use. -Adam [0]: https://github.com/archlinux/archinstall

On 09/03/2026 16:13, Jonathan Whitlock wrote:

I hope it doesn't.

Not only is California law not national law, it's clearly a political movement designed to sew dissent among us.  Already people seem to be making posts that read as if it is a given that all linux distributions will abide by it.  That's setting aside the fact that linux being a user-first and distributed ecosystem can not possibly be made to comply -- it's simply not possible. If some implementation were made it would simply be disabled.  If somone was fined, I would hazard a guess that such a fine would be unenforceable if they aren't already in California to begin with.

Setting aside the obvious fact that this law was written haphazardly by imbeciles, it's a clear political statement: politicians in California want to create a world where everyone on the internet is identifiable: This is the first step towards that.  Their actions are the very embodiment of the phrase "Ask for a Penney before you ask for a pound". This is a clear affront to anyone who values their privacy and we should all unanimously agree: Age verification is a terrible idea that will end terribly.  We've already had numerous examples of doxing that has occurred as a result of ID verification services -- why are we even entertaining the possibility of moving in this direction?!?!?!

I'm going to kindly ask you to not call anyone an "imbecile" on this list.

I'm not a mainatiner of Arch, but I have made some small contributions and I would hate for this distro to suffer because of weak-spined individuals who don't know how politicians think. Politicians are the enemy.  This is an attack.  They have no legal grounds to do anything, and if they did I would still argue for resistance.  The first step in any totalitarian regime is identification and it should be resisted at all costs. I hate to break it to you, but politicians make the policy and you can influence politicians with your vote or public campaign. Either way, this rant does not belong on the Arch mailing list.

I'll ignore the fact that you might imply that the Arch Linux maintainers are weak-spined.

On 3/9/26 5:00 PM, Louis wrote:

But that doesn't matter, this law is in and the Arch Linux leadership must make a decision that mitigates detrimental impact to the project as a whole. I'd like to see more discussion about what _we can do_ on a technical and practical level rather than "this law sucks, why aren't we opposing this law harder".

I've been refraining to chime in because I wanted to avoid contributing to the chaos. Having said that, I think that having a technical dialogue would be great. As far as I know ubuntu has made an announcement regarding this topic but no technical solution has been provided or even hinted at. I'm sure they'll come up with something eventually, but it would be nice to be able to provide something more in the spirit of arch (as minimalistic as possible). Maybe we can even make something cool in the process. One of the problems I can think of is the standardization of whatever API is designed (it's intended to be consumed by others eventually, right?), and its privacy implications. Having briefly read the law, I don't think a "Share / Don't share" option on a permission dialogue would be out of the question. It would be super interesting if there's any lawyers (or so inclined) in the mailing that could provide more insight into this. In the end, integrating something like this into -let's say- a dbus package is not hard at all. I think the real challenge is to find a solution that is technically sound and that still complies properly with the law, while being modular enough so that users outside of california don't even have to install it or be bothered by it. Kindly, Fermín