Age Laws Test Open Source Developers

Governments worldwide are enacting age assurance laws, pushing youth safety requirements from consumer-facing platforms to the underlying infrastructure like operating systems and app stores. This regulatory shift presents new challenges for software developers, especially those in the open source community.

The core aim is to protect minors from online harms such as grooming and exposure to inappropriate content. However, as detailed on the GitHub Blog, current proposals risk imposing significant burdens on open source software and developer infrastructure that don't pose the same risks as consumer apps.

Understanding Age Assurance

Age assurance encompasses various methods to determine a user's age, ranging from self-attestation to more robust verification techniques. These approaches vary widely in accuracy, privacy implications, and accessibility.

Policymakers are grappling with balancing child protection with the benefits of online participation, including educational and social opportunities within communities like open source development.

Unintended Consequences for Open Source

Poorly designed age assurance laws could disrupt the open source model. Mandates for centralized data collection or restrictions on software installation outside app stores conflict with the decentralized, user-controlled ethos of open source.

Furthermore, applying age assurance requirements to open source operating system publishers, who are often individual contributors or small communities, could stifle innovation and diversity. The ecosystem's strength lies in its distributed nature and the ability for individuals to contribute and redistribute software freely.

Developer Engagement is Crucial

GitHub has actively engaged with policymakers to highlight why open source code collaboration platforms should be exempt from certain regulations, citing their distinct risk profiles and significant public benefits.

While some legislation recognizes these distinctions, others are evolving to encompass broader layers of the tech stack, raising new questions for developers about compliance and impact. Examples include California's AB 1043, Colorado's SB 26-051, Illinois' HB 4140, and New York's S 8102 / A 8893, which focus on operating systems and app stores transmitting age signals to applications.

Developers need to stay informed about these evolving regulations and their potential impact on their work and the broader software ecosystem.