Two US states are introducing laws requiring operating systems such as Windows and iOS to collect users’ ages, to help prevent minors from accessing adult-only content.
The incoming California and Colorado laws are among the latest in tougher age check laws introduced across the US, as lawmakers crack down on porn access. While most recently-introduced state laws place onus on porn sites and platforms to enforce and implement age checks, California and Colorado’s new laws place responsibility on both device-makers and sites/platforms.
Along with Apple introducing what it called a “world-first” device-level age verification system for UK iPhone users (a move Ofcom itself wasn’t fully convinced solved the UK’s legal obligations), and a proposed US federal law covering device-level verification, we seem to be at the beginning of a global shift from site-level to device-level checks.
‘What’s my age again?’ How the age checks actually work
California’s new law takes effect on January 1, 2027, and Colorado’s comes into force on July 1, 2028. Both cover closed-source operating systems including macOS and Windows, with California’s also covering Linux distributions.
Both laws will require new devices to collect the user’s age or date of birth when they set up the device. This information will be stored and passed on to apps downloaded on the device. Apps can then restrict content based on the user’s age information.
Under the laws age submission won’t have to be officially verified; instead you simply state your age bracket or date of birth when setting up your device. The laws seem to be based on the notion that parents set up their children’s devices, so would input their age information for them.
The laws are very much app-focused, and as the technology stands would not cover websites. So, while an app containing adult material might restrict content to a user if they are recorded as being under 18, if that user visits a site on the same device, the site will not automatically get the user’s age information.
This means that, initially at least, the laws are more likely to affect adult-focused apps such as dating, gambling or alcohol/tobacco-related apps, rather than porn. Most mainstream app stores have zero-tolerance policies covering sexual nudity and porn content, although recent reports have found that Apple and Google have promoted so-called ‘nudify’ apps that should be banned.
A shift towards devices
Pornhub’s parent company Aylo has been lobbying Apple, Google and Microsoft to place legal onus on device-level rather than site-level age verification, which would potentially reduce porn sites’ direct responsibilities to keep minors from accessing their explicit content.
The new California and Colorado laws don’t really mark a big win for Aylo’s stance, as the laws are focused on apps rather than sites like Pornhub. Also, rather than taking age verification responsibility away from apps and onto device companies such as Apple, the laws potentially give apps more verification responsibility.
Under the laws, as app companies will be given the ages of device users, they will be legally considered to have “actual knowledge” of the user’s age so couldn’t plausibly plead ignorance of the user’s age.
Industry-watchers have suggested that as the laws evolve they may end up requiring users to verify that they are adults with government ID or similar methods. This raises the prospect of app and site companies pushing for age verification to be confirmed purely on devices, rather than again on an individual app, site or platform.
This, ultimately, is the goal of porn companies like Aylo. The company has blocked access to its sites in around half of US states, saying that new tougher site-level age verification rules are unworkable.
Beyond the two states
Currently the California and Colorado laws are the only confirmed state laws requiring age submission on new devices, although in Texas Apple recently introduced age verification for new Apple Accounts, to comply with new state laws.
However, tech industry-watchers have suggested that tech companies may be unlikely to build separate operating systems for different states, and may simply choose to roll out age collection on all US-sold devices.
There is also a push in the country to make device-level age verification for adult content federal law.
The Parents Decide Act, if passed, would enshrine this into federal law, and would require the date of birth of every new device user. The law would require full age verification, rather than users simply telling devices their date of birth.
That’s a long way from happening. But still, just a few years ago device-level age verification seemed a distant prospect, as lawmakers firmly had porn companies in their crosshairs.
The shift has been swift, and Aylo’s noise about device-level verification is now seeming less like screaming into the legal void.
