{"id":1774,"date":"2026-03-06T08:00:00","date_gmt":"2026-03-06T05:00:00","guid":{"rendered":"https:\/\/soberano.news\/?p=1774"},"modified":"2026-03-09T19:12:50","modified_gmt":"2026-03-09T16:12:50","slug":"felca-law-may-require-age-verification-on-linux","status":"publish","type":"post","link":"https:\/\/soberano.news\/en\/estruturas-juridicas\/lei-felca-pode-exigir-verificacao-de-idade-no-linux\/","title":{"rendered":"Felca Law may require age verification on Linux"},"content":{"rendered":"

A Felca Law<\/a> has already been discussed here on Soberano. But one of its consequences has not yet received the attention it deserves: the age verification obligation which, in theory, would extend to operating systems<\/strong> - including Linux.<\/p>\n\n\n\n

The law comes into force on March 17th, 2026<\/strong>. And the text<\/a>, The new system, which is deliberately vague, opens up loopholes that worry not only ordinary users, but also software developers in Brazil and abroad.<\/p>\n\n\n\n

Fines of up to R$ 50,000,000.00 for non-compliance<\/h2>\n\n\n\n

Law 15.211 stipulates that information technology products or services \u201caimed at children and adolescents or<\/strong> access likely<\/strong> by them\u201d must adopt age verification mechanisms. Failure to comply could result in fines of up to R$ 50 million<\/strong>.<\/p>\n\n\n\n

The problem lies precisely in this elastic definition. Who determines what is \u201clikely to be accessed\u201d by minors? The law doesn't say. This means that, in practice, the government can interpret the rule in an expansive way whenever it is politically convenient - just as we have seen happen in other situations in Brazil.<\/p>\n\n\n\n

Would a general-purpose operating system such as Ubuntu, Fedora or Linux Mint fall into this category? The law doesn't rule it out. And it is this ambiguity that is stirring up forums, developer lists and the Brazilian tech community.<\/p>\n\n\n\n

\"Reddit<\/figure>\n\n\n\n

The question circulate<\/a> on Brazilian Reddit is straightforward: will any Linux distro implement a prompt asking your age?<\/strong> And if it doesn't, will the government try to ban Linux?<\/p>\n\n\n\n

The most sensible answer, shared by more experienced users in the discussion, is that there is no clear responsible legal subject<\/strong> in the case of community Linux distributions.<\/p>\n\n\n\n

The law was written with large platforms in mind - social networks, app stores, streams. Holding the Linux kernel or a distro maintained by volunteers around the world responsible would be legally unfeasible<\/strong> e technically absurd<\/strong>.<\/p>\n\n\n\n

But the debate is not unfounded. And the fact that it is happening at all reveals the most damaging side effect of vague laws: the fear and self-censorship they generate even before any inspection<\/strong>.<\/p>\n\n\n\n

What's happening outside Brazil<\/h2>\n\n\n\n

The problem is not exclusively Brazilian. In March 1st, 2026<\/strong>, Aaron Rainbolt, a developer who contributes to the Kicksecure and Whonix projects - Linux distributions focused on privacy and security -, published an open letter<\/a> on the official Ubuntu mailing list exposing a similar dilemma.<\/p>\n\n\n\n

The reason: a law passed in California<\/strong><\/a> which obliges operating system vendors to implement an age verification API, scheduled to come into force on January 1st, 2027<\/strong>. The state of Colorado is working on similar legislation.<\/p>\n\n\n\n

American law defines four age groups (under 13, between 13 and 16, between 16 and 18, and over 18) and requires the operating system to collect this information when setting up the user account, making it available via API so that application stores and websites can consult it.<\/p>\n\n\n\n

Rainbolt was clear in the title of the message: \u201cthe unfortunate need for an age verification API for legal compliance reasons<\/strong>.\u201d<\/p>\n\n\n\n

It proposes a standardized D-Bus interface that different distributions could implement in different ways, while preserving privacy as much as possible: storing only the age range, not the full date of birth, and without exposing the data to unauthorized applications.<\/p>\n\n\n\n

But even this minimalist proposal raises important questions: who guarantees that the information stored will not be accessed improperly?<\/strong> How do you deal with installations on servers, virtual machines or environments without a graphical interface? And, more fundamentally, who checks that the declared age is true?<\/p>\n\n\n\n

Rainbolt's honest answer: no one<\/strong>. The developer himself recognizes that there is nothing in the law that prevents users from simply declaring that they are 18 - making the whole mechanism technically useless for the stated purpose of protecting children, but useful for something else: standardize the collection of identity data at the operating system level<\/strong>.<\/p>\n\n\n\n

The pattern repeats itself<\/h2>\n\n\n\n

We've already written here about Felca Law<\/a> and what happened in the UK after the Online Safety Act. The narrative is always the same: protect children. The result is also usually the same: surveillance infrastructure built at the expense of everyone's privacy, with questionable effectiveness in actually protecting minors.<\/p>\n\n\n\n

In Texas, following the passing of a similar law requiring identity verification to access adult content, demand for VPNs grew by 234.8%. In the UK, 266 identity verification companies earned the equivalent of R$ 16 billion in 2025.<\/p>\n\n\n\n

The law doesn't protect children. It creates a market - and expands the state's reach into people's digital lives. Learn more about this by watching the video below:<\/p>\n\n\n\n

\n