As more US states consider online age-verification requirements, two Colorado lawmakers want to implement the age checks at the operating system-level, after California enacted a similar law.
Colorado's SB26-051, introduced last month, would require operating systems to register the owner’s age, which third-party apps can then leverage to determine if the user is an adult. The bill calls for the device owner to register their birthdate or age, but for the purposes of creating an “age bracket,” which can then be shared to an app developer through an API to learn their age range, according to BiometricUpdate.com.
The bill comes from state Sen. Matt Ball and Rep. Amy Paschal, both Democrats. "The intent is to create thoughtful safeguards for kids online through a privacy-forward framework for age assurance," Ball told PCMag. "Unlike some laws in other states, SB 51 doesn't require users to share personally identifiable information or use facial recognition technology."
Ball also said the legislation was based on California's bill AB 1043, which was passed last year. It too requires OS makers to create a way for the device owner to register their age bracket, which can then be shared to app developers over an API. The California law starts to take effect January 1, 2027.
Ball added: "SB 26-51 is very closely modeled on it. One of the reasons for bringing SB 51 was that the tech and software industry is already complying with AB 1043, so there's minimal added burden."
The legislation also promises to centralize the age check through the OS, rather than mandating that each app enforce their own age-verification mechanism, which can involve scanning the user’s official ID, thus raising privacy and security concerns. The bill also forbids the sharing of the age-bracket data for any other purpose.
But it looks like it’s easy to bypass the age check proposed by SB26-051. The legislation itself doesn’t mention any state ID check to verify the owner’s age. In addition, the bill doesn’t seem to cover websites, only apps and app stores.
The legislation adds that “if a developer has clear and convincing information that a user's age is different than the age indicated by an age signal, the developer shall use that information as the primary indicator of the user's age range.” SB26-051 also includes a “civil penalty of not more than $2,500 for each minor affected by each negligent violation or not more than $7,500 for each minor affected by each intentional violation.”
In the meantime, some critics are blasting the proposal as overreach and invasive. “Hell no. You give an inch, they take a mile. Every single time. No compromises. No mass surveillance PERIOD,” wrote one user on Reddit.
Others are more sympathetic. Another Reddit user who identified themselves as a software engineer said the proposal lifts the burden of age verification from app developers and platform operators, which have faced lawsuits for failing to conduct adequate age checks.
But the software engineer added: “Just because the owner of the phone was 18 doesn't mean the USER is. I could be playing video games on my older brother's phone that he left lying on the desk. It's like 100% tying speeding tickets to license plates—you can try, but it doesn't stand up because somebody else might have been driving my car. You have to know the human, not the device.”
One site that supports device-level age checks is Pornhub. Its parent company, Aylo, has blocked Pornhub and the other adult sites it owns in states and countries that require age-verification in protest of those laws.
"The best and most effective solution for protecting minors and adults alike is to identify users at the source: by their device, or account on the device, and allow access to age-restricted materials and websites based on that identification," Pornhub says. "This means users would only get verified once, through their operating system, not on each age-restricted site. This dramatically reduces privacy risks and creates a very simple process for regulators to enforce."
Editor's note: This story has been updated with comment from the Colorado lawmaker Matt Ball.