The courts should strike it down, I don't have faith they will side with the constitution, but it's clearly unconstititional and beyond the authority of the state as well, in the realm of interstate commerce which is explicitly given to the feds, whom can't be trusted either obviously.

But the 1st amendment is clearly invalidating this, forcing people to identify themselves to groups that will record everything they say or do and sell it to everyone, including the government, that will chill speech, and groups will punish people for their speech.

Too bad scotus is all in on punishing people for speech though.

Presumably quite selectively, based on the user’s political leanings.

Not defend Democrats too much here, but they clearly have far less of a habit of doling out enforcement based on political leanings than the Republicans, even if they do enforce things quite selectively when it comes to actual leftists while letting Nazis run around with seeming impunity.

Colorado has been a solidly Blue state since the end of the W. Bush years, and even then, it was pretty split down the middle with just over half of the votes going to Bush. It's honestly been mostly-Blue-dominated since 1992. (Lauren Boebert notwithstanding)

Further, the two main sponsors of the bill are both Democrats. This genuinely seems to me to be another example of "heart in the right place but don't know what the fuck they're actually doing" which seems common for the tech illiterate and often for Democrats in general.

Once again, not saying Democrats aren't guilty of selective enforcement, just pointing out that they're far less likely to do so (or at least less likely to do so against conservatives, for genuine leftists it seems up for debate).

Now, that also means nothing in context to how other politicians can use this kind of legislation negatively, even if the writers and sponsors truly have the best of intentions. Democrats had the best intentions when it came to the PATRIOT Act and the creation of the Department of Homeland Security as well, and way back then folks like me were saying "this seems pretty dangerous, especially if we ever have a despot take control of the country and the levers for these tools" which clearly has come to pass.

Are they going to check people's PCs at the state borders as they move in then?

What is in the actual bill? I haven't read any of this but if it was just a year of birth box at local signup then this could actually be pretty good. A sort of halfway between local only parental controls & age-policing, ID-reporting corporations.

I'll caveat this by saying IANAL. But the way I read Bill 26-051 is that it's looking to implement "user age attestation" not "device or application" (WEI). Two separate things.

Age Attestation requires the OS (or really, the cloud service that implements account-level authorization) and come up with an "age signal." It prohibits using third-party non-public data, and puts the burden on the OS for managing the Go/No Go process. No PII leaves the device.

The alternative is dystopian, poorly managed KYC/AML over-reaches. Under the guise of anti-fraud/anti-gambling, these will reach deep into our communal shorts. They could well soon require individual biometric verification (iris scans, face contour maps, fingerprints, etc). No, thanks.

WEI is a separate story. It's trying to cut down on malicious apps and maybe stop individual sites doing browser fingerprinting. It can only work on systems with single-points of app installation (without side-loading) and devices already locked down with hardware TPMs. So far, that only covers iOS. All the other systems (Linux, Mac, Windows, and Android) let you install your own system-level code without having to go through the One Official appstore. And with WASM, the browser makes it all moot.

Personally, I think WEI is a total waste of time. Trying to squeeze the toothpaste back into the tube. But it's solving a different problem than age verification.

Not to say the Colorado bill is perfect. There is a truck-sized app vs. website loophole in it, so kids can still access social media sites from the browser vs their phones. But the OS can offer an API that browsers can vend to websites without every site rolling their own crappy system. It also doesn't account for a clever kid figuring out how to create a separate adult-appearing user account. Because of course, they will.

Saying it's parental responsibility is unrealistic. I've helped folks set up Screentime, router-level filters, and even Circle (in-home ARP spoofing box, and mobile VPN + fine-grain URL filtering). There are ways around all of it. Besides, the kids can still get exposed to utter bilge via school-approved sites like Zoom, YouTube, or Google Drive. Let's not even bother with messaging apps or in-game chat. This is all assuming parents have the time or knowledge to set things up and manage the filters.

We're not trying to be over-controlling, stop the kids from dancing too close at the prom, or yuck their yum. But as parents, we do want to have some sort of say in what they're exposed to online before their brains have the capacity to process them. The risk to their mental health is real, and just YOLOing it hasn't worked out too well.

I'm sure there's a lot of subtle behind-the-scenes stuff in the Colorado bill. I'll wait to hear what EFF or Mike Masnick have to say about it. But as a techie, app developer, and parent, it reads like the least-worst way to keep a minor away from nasty crap without requiring every one of us to scan our faces and provide IDs to every rando website.

I won't repeat what I said in the sibling thread.

But I don't see anywhere in this specific Colorado bill trying to restrict OS level features or go anywhere near open-source. As a parent, if I put little Timmy on Arch and give him root access, I don't get to bitch about what they do online.

This is about a single signal (kid/no kid) at the user-auth level, without slurping up PII and shipping it off into the ether.