tl;dr it was Meta (because of course it was). It is a little strange though, I would think they would absolutely want this sort of PII but they're pushing for Google and Apple to deal with it.

because reddit is made of AIDS & fail, the post they removed

I've been pulling public records on the wave of "age verification" bills moving through US state legislatures. IRS 990 filings, Senate lobbying disclosures, state ethics databases, campaign finance records, corporate registries, WHOIS lookups, Wayback Machine archives. What started as curiosity about who was pushing these bills turned into documenting a coordinated influence operation that, from a privacy standpoint, is building surveillance infrastructure at the operating system level while the company behind it faces zero new requirements for its own platforms.

I want to be clear about what this is and isn't. I am not the author of the earlier r/linux post by aaronsb and I'm not affiliated with them. I titled this to draw attention on this subreddit because the privacy implications go well beyond Linux. Every source cited here is a public record.

What the bills actually require you to hand over

Most reporting on these bills says something vague like "age checks at device setup." The statutory language is more specific and more invasive than that.

California AB-1043, signed October 2025 and effective January 1, 2027, defines "Operating system provider" under Section 1798.500(g) as "a person or entity that develops, licenses, or controls the operating system software on a computer, mobile device, or any other general purpose computing device."

Every OS provider must then: provide an interface at account setup collecting a birth date or age, and expose a real-time API that broadcasts the user's age bracket (under 13, 13 to 15, 16 to 17, 18+) to any application running on the system.

Read that again. Every app on your device gets to query a system-level API that returns your age bracket in real time. This isn't age verification at the point of accessing restricted content. This is a persistent age-broadcasting service baked into the operating system itself, queryable by every installed application.

Colorado SB26-051 (passed the Senate 28-7, now in the House) copies the same definitions in the same order, same penalty structure ($2,500 per child for negligent violations, $7,500 for intentional ones), same exemptions. The template is the ICMEC "Digital Age Assurance Act," and it's been introduced or is pending in Illinois (three separate bills), New York, Kansas, South Carolina, Ohio, Georgia, Florida, and at the federal level.

New York's S8102A goes further. It requires device manufacturers to perform "commercially reasonable and technically feasible age assurance" at device activation and explicitly bans self-reporting. The AG picks the approved methods. That means biometric age estimation or government ID verification before you can use a device you purchased.

Exemptions in all of these bills cover broadband ISPs, telecom services, and physical products. None contain any exemption for open-source software, non-commercial projects, or privacy-preserving verification methods.

The status right now:

State	Bill	Status
CA	AB-1043	Enacted, effective Jan 1, 2027
CO	SB26-051	Passed Senate, in House committee
LA	HB-570	Enacted, effective July 1, 2026
UT	SB-142	Enacted, first in nation
TX	SB-2420	Enjoined by federal judge
NY	S8102A	Pending
IL	HB-3304, HB-4140, SB-2037	Pending
Federal	KOSA, ASAA	Pending

The privacy architecture these bills create

Here's what concerns me most from a privacy perspective. These bills don't just verify age once. They create a persistent identity layer inside the operating system that applications can query at will.

The commercial age verification vendors who would provide this infrastructure (Yoti, Veriff, Jumio) charge $0.10 to $2.00 per check, require proprietary SDKs, demand API keys tied to commercial accounts, and operate cloud-only with no self-hosted option. Your age verification data goes to a third-party cloud service. Every time.

Compare this to what the EU built. The EU Digital Identity Wallet under eIDAS 2.0 is open-source, self-hostable, and uses zero-knowledge proofs. You can prove you're over 18 without revealing your birth date, your name, or anything else. No per-check fees, no proprietary SDKs, no data going to a vendor's cloud. The EU's Digital Services Act puts age verification obligations on Very Large Online Platforms (45M+ monthly users), not on operating systems. FOSS projects that don't act as intermediary services are explicitly outside scope. Micro and small enterprises get additional exemptions.

	EU approach	US bills
Who's regulated	Platforms with 45M+ users	All operating systems
FOSS exemption	Yes, five separate mechanisms	None
Verification method	Open-source wallet, zero-knowledge proofs	Commercial vendors, biometric data to cloud
Cost to non-commercial projects	$0	$100K to $2M/year
Privacy architecture	Selective disclosure, privacy by design	Full age data to vendor cloud
Works offline	Yes	No, internet required per check

The US bills assume every operating system is built by a corporation with the infrastructure and revenue to absorb these costs. The EU started from the opposite assumption and built accordingly.

Who wrote the legislation

This is where it gets interesting. Rep. Kim Carver (R-Bossier City), the sponsor of Louisiana's HB-570, publicly confirmed that a Meta lobbyist brought the legislative language directly to her. The bill as drafted required only app stores (Apple, Google) to verify user ages. It did not require social media platforms to do anything.

Meta deployed 12 lobbyists across 9 confirmed firms for this single bill, paying at least $324,992 (described as a "very conservative estimate"). The confirmed firms include Pelican State Partners (who also lobby for Roblox, letting Meta frame this as "broad industry support" rather than one company's project), Adams and Reese LLP (the #1 ranked Louisiana government affairs firm), and State Capitol Solutions.

Nicole Lopez, Meta's Director of Global Litigation Strategy for Youth, testified at the House Commerce Committee in support. She also testified in South Dakota for a similar bill. She's Meta's national point person for these laws.

HB-570 passed unanimously at every stage: House 99-0, Senate 39-0. So why did Meta need 12 lobbyists? Because the votes were never the concern. The lobbyists were there to control the text and block amendments.

The key amendment battle came from Senator Jay Morris, who expanded the bill to include app developers alongside app stores after Google's senior director of government affairs publicly questioned why "Mark Zuckerberg is so keen on passing these bills." When Morris introduced his amendment, Meta went silent. The conference committee compromise maintained dual responsibility but kept the primary burden on app stores, which is what Meta wanted from the start.

At that same Senate hearing, Morris directly questioned DCA Executive Director Casey Stefanski about who funds her organization. She reportedly deflected, said she "wasn't comfortable answering," then under continued pressure admitted tech companies provide funding but refused to name them.

The advocacy group that doesn't legally exist

The Digital Childhood Alliance presents itself as a coalition of 50+ conservative child safety organizations (later inflated to 140+, though only six have ever been publicly named). It has been testifying in favor of these bills across states. Here is what public records show about its legal status:

I searched all four regional extracts of the IRS Exempt Organizations Business Master File (eo1 through eo4.csv), which cover every tax-exempt organization registered in the United States. DCA is not there. No EIN exists for this organization.

I also searched for incorporation records in Colorado, DC, Delaware, and Virginia, plus OpenCorporates (200M+ companies), ProPublica Nonprofit Explorer, GuideStar, and Charity Navigator. No incorporation record exists in any of them.

DCA's domain was registered December 18, 2024 through GoDaddy with privacy protection and a four-year registration. The website was live and fully formed one day later: professional design, statistics, testimonials from Heritage Foundation and NCOSE staff, ASAA talking points already loaded. This is not a grassroots launch. This is a staging deployment of a pre-built site. 77 days later, Utah SB-142 became the first ASAA law signed in the country.

DCA processes donations through For Good (formerly Network for Good, EIN 68-0480736), which is a Donor Advised Fund. For Good explicitly states in its documentation that it serves "501(c)(3) nonprofit organizations." DCA claims 501(c)(4) status. DCA is classified as a "Project" (ID 258136) in the For Good system, not as a standalone nonprofit. I searched all 59,736 For Good grant recipients across five years, roughly $1.73 billion in disbursements. Zero grants to DCA, DCI, NCOSE, or any related entity. The donation page appears to be cosmetic.

Bloomberg reporters exposed Meta as a DCA funder in July 2025. The Deseret News detailed the arrangement in December 2025. No version of the website, across 100+ Wayback Machine snapshots, has ever disclosed funding sources. Every blog post and testimony targets Apple and Google. Meta is never mentioned or criticized.

DCA's leadership traces directly to NCOSE (National Center on Sexual Exploitation):

"The research is published in a git repository with every source embedded. It does not depend on Reddit's infrastructure to survive."

proceeds to post on Microslop's Github

I deploy hundreds of docker containers every day that run general purpose operating systems. These bills seem dumb at a fundamental level regardless of the terrible privacy implications.

https://redlib.catsarch.com/r/linux/comments/1rshc1f/i_traced_2_billion_in_nonprofit_grants_and_45/

It really throws a light on the shit that they're up to over this side of the Atlantic.

https://www.irishtimes.com/technology/big-tech/2025/10/30/data-protection-rules-completely-out-of-control-meta-tells-government/ https://archive.is/M8wbm

https://noyb.eu/en/former-meta-lobbyist-named-dpc-commissioner-meta-now-officially-regulates-itself

https://compliancehub.wiki/the-masks-are-off-ireland-appoints-meta-lobbyist-to-police-meta-on-data-protection/

Meta has engaged in significant lobbying activities within the European Union regarding privacy and content regulations, often overlapping with discussions on "chat control" (a controversial EU proposal to scan private messages for child sexual abuse material, or CSAM).

 

Key developments regarding Meta's influence in the EU, based on recent reports, include:

Lobbying on AI and Tech Regulation: As of April 2025, reports suggest Meta has been actively lobbying to influence or dilute EU artificial intelligence and technology regulations.

Influence on Digital Privacy Legislation: Meta and other "Big Tech" entities have been subject to intense scrutiny and lobbying investigations concerning how they affect European privacy laws, including GDPR compliance and potential chat control measures.

Regulatory Independence Concerns: Civil society organizations (including the Centre for Countering Digital Hate and EDRi) have raised concerns about the influence of former Meta lobbyists on EU regulators, notably the Irish Data Protection Commission (DPC), which is the lead supervisor for Meta in the EU.

Antitrust and Competition Conflicts: In February 2026, the European Commission notified Meta of a statement of objections regarding the exclusion of third-party AI assistants from WhatsApp, viewing this as an abuse of its dominant position. This indicates that while Meta lobbies, it is also facing heavy EU regulatory action.

Data Protection Fines: Meta has previously faced substantial fines, such as the €1.3 billion fine in 2023 linked to US-EU data transfer practices. 

The "chat control" legislation has faced delays and significant debate regarding its impact on privacy vs. security, with civil liberties groups opposing the mandatory scanning mechanisms that the proposal would introduce.

I'm glad to have an answer that allows me to direct my hate. Problem is, I already hated Facebook and The Heritage foundation.

So Meta (and their allies) are actively pushing and lobbying (illegally, if you look at DCA that doesn't even exist?) for laws that force operating systems to build a permanent age API thats full time accessible for apps?

Why not use a digital identity wallet like Europe : You can prove that you are 18+ without sharing your date of birth, name, or other information (via zero-knowledge proofs), it's like a confirmation paper from a bank or another institution without any actual information about yourself. Plus there's parental consent to children's accounts (as COPPA in the U.S. already does), or like by doing verification locally or through open-source systems, not through commercial companies with a central Database.

They knowingly ignore better, more privacy friendly alternatives to age verification because by forcing operating systems to implement a permanent age API, they create a system that burdens competitors like Apple and Google and Free and Open Source software who sometimes cant even abide to those rules, all-the-while meta's own platforms are often excluded. Apparently this fits into a broader strategy to normalize surveillance and increase dependence on commercial verification companies, which Meta indirectly benefits from.

I dont really see this changing, I expect meta getting away with everything and getting worse cause look at the inauguration. But musk also got booted so who knows. But in the end America usually doesnt care about customer rights, privacy rights, or childrens rights ig.

Im awaiting the results of the latest lawsuit where zuckerberg had to testify about accusations that social media, including Instagram, harm children’s mental health. https://edition.cnn.com/2026/02/19/tech/takeaways-mark-zuckerberg-testifiessocial-media-child-mental-health

Github is MS, so better save it while you still can.

That's an impressive investigation.

It would be tough to find a better example of why lobbying in the US is fundamentally broken. An entity like Meta has ample funding to break up an operation into distinct cells that do not directly interact in public forums, while tracking the whole process in documents protected by ACP. I think it's particularly telling that Meta lobbyists are quietly nodding along legislation pushed by "grass roots" activists and that Meta's new OS just happens to implement the technology exactly as described in the law.

It's that sort of coordinated effort that the RICO act was drafted specifically to address, but it's perfectly legal.

Thank you for this. Like, I heard a bit about this but set it aside as "to be researched later" without realizing how far along the stupidity had gotten.

The EPSTEIN CLASS which the Government is doing EVERYTHING to Protect is Behind wanting you AND your Child's IDS? I COULDNT have Guessed!

Can we trace who is behind anti trans lobbying in US and UK?

Was there ever any doubt? They've been trying to tie devices to identities for years now. This is just the end game.

The funny thing is, it's kinda hard to prove that surveillance based ads actually work. Ad platforms like to throw numbers of how may people see ads around, but it's hard to actually tie those numbers to sales. What's worse is that the way these ads are bought, sold, and how ad placement is commodified means that everything remains intentionally vague to the people buying ads. In most cases, all they know is that "everyone is doing it" and "making lots of money" and if they don't they'll be left out of the revenue party.

Right now, enough people are still drinking the kool-aid that it'll remain a safe revenue stream for companies like Meta unless something happens that hurts the cash flow of their customers. But, it kinda makes you wonder, if the vagueries of the online add ecosystem caused companies to reconsider the investment during an economic crisis, how would these ad platforms that have recently gotten very cozy with fascists make money?

Fuck that fucking shitty website.

It's crazy the amount of censorship that goes on there and how accepted it is by its audience.

And... It's gone. What the fuck?

good old reddit, must have been a real wrench for you

wait a second what are you doing reading reddit in the first place?

traitor! impure!

wow great post

If you're also trying to avoid github because Microslop, looks like this is further hosted on https://tboteproject.com/, with a decentralized repository on https://tboteproject.com/git/hekate/attestation-findings

Social media is optional. Quit relying so much on the internet for entertainment. Sail the high seas. Arr.