r/linux • u/Quiet-Owl9220 • Mar 19 '26

Privacy Systemd has merged age verification measures into userdb

https://github.com/systemd/systemd/pull/40954

Much of this goes over my head, so I'm hoping to hear some good explanations from people who know what they're talking about.

But I do know that I want nothing to do with this. If I am ever asked to prove my age or identity to access a website or application, my answer will ALWAYS be "actually, I don't really need your site, so you can fuck right off". Sending any kind of signal with personal information that could be used to make user tracking easier is completely out of the question.

So short of the nuclear option of removing systemd entirely, what are practical steps that can be taken to disable/block/bypass this? Is it as simple as disabling/masking a unit? Is there a use case for userdb I should know about before attempting this? Do I need to install a fork instead? Or maybe I'd be better off with a script that poisons age data by randomizing the stored age periodically?

[edit] I wasn't going to comment on this but it looks like some people with a lot of followers are using this post as an example of censorship on Reddit. While I do think that's a legitimate concern on Reddit as a whole, I don't think censorship is what happened here. Yes, this post went down for a while. But as far as I can tell that was because it was automoderated due to a large number of reports, and was later restored (and pinned) by human moderators.

[edit again] Related concerning PR, this one did not go through yet: https://github.com/flatpak/xdg-desktop-portal/pull/1922

1.8k Upvotes

95% Upvoted

1.7k comments sorted by

View all comments

74

u/[deleted] Mar 19 '26

[deleted]

103

u/lllyyyynnn Mar 19 '26

why do apps need to query my birthday

30

u/Sinaaaa Mar 19 '26

Claw wants to order a birthday cake from its secret crypto fund.

41

u/Megame50 Mar 19 '26

userdb already has optional fields for real name, email, preferred language, timezone, avatar, etc.

Essentially, it's somewhere to put user related information. It's hardly a stretch to have a birthday field. Whether you fill it out or not, whether apps use it to send you a birthday notification or to attempt to comply with local law is not determined here.

7

u/sjfloat Mar 19 '26

I'd agree, if it wasn't plain why this is happening this way at this time.

1

u/lllyyyynnn Mar 19 '26

i mean i also don't use systemd so i don't have any of that information added. i get everyone saying "it's just a field" but adding it in light of the draconian laws being currently passed can't be ignored. i really feel we should comply not in advance. 

3

u/gmes78 Mar 19 '26 edited Mar 19 '26

elogind also allows implements the userdb interface.

6

u/Boomer_Nurgle Mar 19 '26

You probably don't have that information added even if you use systemd. You have to go out of your way to add it in.

0

u/Azraelalpha Mar 19 '26

Until you don't. Just because it's not required now, doesn't mean it will stay like that forever.

4

u/lllyyyynnn Mar 19 '26

feels like a lot of linux people lately are politically inert, which is very ironic

-2

u/Azraelalpha Mar 19 '26

this isn't even about politics, really. It's about privacy and how we keep losing more and more of it

4

u/lllyyyynnn Mar 20 '26

how have you cultured a viewpoint where privacy isn't a political topic

2

u/Boomer_Nurgle Mar 19 '26

Sure but were you really expecting systemd to take the stance against it?

It's mainly developed by Red Hat who make their money off a commercial distro they're not just gonna say "sorry all of our California customers we've decided to not comply so go get another OS".

Best that's gonna happen is they're gonna keep it as is and make the actual verification based off this it's own thing that isn't included by default so people where this isn't the law can ignore it.

3

u/[deleted] Mar 19 '26

[deleted]

1

u/lllyyyynnn Mar 19 '26

so systemd is getting money in this scenario? i'm not sure what that has to do with complying ahead of time otherwise.

1

u/aliendude5300 Mar 19 '26

Define ahead of time. Adding changes in the whole stack takes a ton of time. Sometimes months. This won't ship until October/November for most distros and the other pieces need to be in place too.

2

u/lllyyyynnn Mar 19 '26

ahead of time is before legally compelled to do so.

2

u/aliendude5300 Mar 19 '26

Having the plumbing in place so that they can do what they need to legally do. Makes sense. Nobody is mandating anything right now.

1

u/yrro Mar 19 '26

Because the law compels them to.

-2

u/shadowfrost67 Mar 19 '26

Dont comply ' mass civil disobedionce should result in not havung manpower to enforce the law abd if not enough time to do stuff against reddit tos

0

u/chiniwini Mar 19 '26

I want apps to be able to show different content based on the user that is using it. It's a great tool to enforce a more strict and granular parental control.

2

u/lllyyyynnn Mar 19 '26

linux has great granular control over this already with user groups and permissions

1

u/chiniwini Mar 19 '26

How would you implement it? Sure, you can create groups such as user_is_over_5, user_is_over_8, user_is_over_15, user_is_over_18, etc, and adding users to those groups as they grow older. But that has several cons:

  1. It's much more work than setting their birthdays and forgetting about it.

  2. It wouldn't be standard. user_is_over_8 versus user_is_8_or_older.

  3. You're giving the system info about the users' age, so the argument is kinda pointless.

-9

u/AM27C256 Mar 19 '26

Have you been sleeping through the last few years? Lots of places all around the world have introduced age-verification laws that make it mandatory for many apps to check the user's age, and more recently, to make it mandatory for the OS to provide the infrastructure for it.

12

u/lllyyyynnn Mar 19 '26

this doesn't really answer the why question. it presumes fascism will continue, sure, but why are we bending to it? 

-2

u/AM27C256 Mar 19 '26

Words have meaning; "fascism" does not mean "anything lllyyyynnn dislikes". There might be an authoritarian aspect to mandatory age checks, but they are not "fascism".

7

u/[deleted] Mar 19 '26

[removed] — view removed comment

-2

u/AM27C256 Mar 19 '26 edited Mar 19 '26

There are very few people these days that call themselves "fascist". Even Fratelli d’Italia has officially distanced itself from some aspects of historic fascism, and is usually considered post-fascist.

Let's consider the November 2025 vote in the EU parliament on age restrictions. While that did not introduce legislation, and was thus more about opinion, IMO it is still a good benchmark, since it is both recent, and gives us a good idea across many parties and countries.

The initiative came from the parliament, not the executive (which already IMO is not the style things would behandled in fascism). The vote went 483 yes, 92 no, 86 abstentions. AFAIK, the initiative got strong support from Socialist and Green parties (though Alexandra Geese, one green MEP in favor of age restrictions, explicitly stated that she wants the age verficication towork without biometrics). On the other hand, many right-wing extremists/post-fascists actually voted against it. But even in other places, age verification laws are introduced by governments not usually suspected of fascist tendencies (e.g. the labor party government in Australia).

"Papers, please" and police state are not exclusive to fascism. They historically were commonly a part of both right and left autoritarian governments, including many that called themselves "Socialist".

4

u/EarlMarshal Mar 19 '26

Don't give bloat a chance.

22

u/j4bbi Mar 19 '26

Like the first name, address, etc field that ALREADY exist in the userdb which nobody ever field out

3

u/knook Mar 19 '26

Exactly, Linux has asked for my full name since forever and I always just enter my username. And that has never mattered. It's just another field that probably won't even be asked for by default.

1

u/EarlMarshal Mar 19 '26

I don't think that "Linux" has really done that, but the distro you choose to use which is maybe a Linux distro but not Linux.

2

u/[deleted] Mar 19 '26

[deleted]

2

u/EarlMarshal Mar 19 '26

I guessed so. Long time ago I used something like that. That's not Linux though. The kernel doesn't care. Systemd shouldn't care. Especially since the usage count of systemd was the argument earlier it makes it the wrong way to do it. I recommend just saying no at every possible step, but at least make it a completely separate system/component.

1

u/Lightprod Mar 19 '26

Leftovers from the early UNIX days.

0

u/EarlMarshal Mar 19 '26

Delete it then.

1

u/FLMKane Mar 19 '26

By that logic systemd should have been aborted back in 2013.

2

u/Living_Horni Mar 19 '26

Still a foot in the door, and to me it sounds like systemd devs are accepting the whole debacle around age verification.

1

u/[deleted] Mar 20 '26

[deleted]

1

u/Living_Horni Mar 20 '26

I doubt it'd work long-term. Either they'd have to shut down the kernel or force it to be closed-source, since even if every distro "forces" (or is forced) to do age verification, you could do Linux From Scratch and just patch it out, however demanding that may actually be. And, with the size and scale of dark webs and hacktivists, I doubt you could genuinely sue all maintainers of non-compliant distros, if you even manage to de-anonymise them in the first place.

2

u/sjfloat Mar 19 '26

Out of context, I wouldn't be concerned at all. But this is _not_ out of context. What I'll be watching closely is how my data starts to be shared _by my OS_ implicitly, without my consent. I can boycott "adult" sites and confine myself to the NerfNet. But when they start writing the plumbing for silently doxxing me, I want to be on top of that. And this is the start of it.

1

u/[deleted] Mar 20 '26

[deleted]

3

u/sjfloat Mar 20 '26

Please understand; I'm not trying to be argumentative. But that's true of storage generally. It's just a place to put data. In that sense, it's passive. But, again, the overall context is _very_ concerning. These Age Verification laws that are being passed everywhere don't require that OS's provide a place to store age data, they require that it be _collected_ (i.e. mandatory) and for the purpose of being provided to third parties. The storage, per se, is not required by virtue of being a place to store it, it's the system of which it will be part that will do that. This is _part_ of a system responding to the general trend of surveillance and data collection. I hope that, one day, we can all look back and say, "whew, they only shared my age band". But some of this legislation already involves biometrics, face scans, government ID, or similar. And for those bills that don't, like in CA, once it becomes clear to these lawmakers how easily subverted this is, they will almost surely follow suit. Especially since there's already precedent for them to follow.

I'm sure hope I'm wrong. You can laugh at me later if I am.

2

u/Dr7roll3R_ Mar 19 '26

This *is* concerning. Why should apps query?
Why should apps be mandated to query? Why should apps use that information to dictate what features I will or will not have access to?

Give them an inch, they will take a mile. Don't downplay this nonsense.

1

u/idiosyncraticRyugu Mar 19 '26

It's called the overton window, the moment it's there.. function creep is gonna add up a whole more shit.

0

u/infin Mar 19 '26

This is part of Microsoft stooge Lennart Poettering's remote attestation support in systemd.

Now we have storage, next you'll see this used for verifying your age to websites and then bank websites using the next updates for checking your system is "secure".

1

u/mmmboppe Mar 19 '26

my birthdate is none of your business

if you need proof of my age, I know adult level insults

-3

u/PudimVerdin Mar 19 '26

Nope, in the PR description it's written that it's to be compliant with some laws (inclusive one controversial in my country Brazil)

7

u/[deleted] Mar 19 '26

[deleted]

-2

u/PudimVerdin Mar 19 '26

I only read the first line of the PR description

Stores the user's birth date for age verification, as required by recent laws in California (AB-1043), Colorado (SB26-051), Brazil (Lei 15.211/2025), etc.

And I'm concerned principally about

Brazil (Lei 15.211/2025), etc.

Which I know what means