Age Verification - MidnightBSD/src GitHub Wiki

Several jurisdictions have implemented age verification laws. The requirements vary greatly. At this time, we can only comply with a subset of these due to cost, resources and reasonable asks. For others, we've put up a ban on them.

Places with age verification: US - CA/CO/IL (ask age)
US - UT/TX/LA (mobile os with ID/CC) Brazil - ID-based, more restrictive requirements, but unclear on how they apply to us. US - NY (not passed yet, ID-based)

MidnightBSD is not designed for phones or tablets, so we don't believe the laws in UT/TX/LA apply.

NY has a broad OS proposal, which could be a serious threat to computing. We hope this doesn't pass.

The CA law we've been trying to implement but things are still in flux with slight changes in IL and CO.

Research on Age Verification laws

Core OS changes

Here's what we have: aged(8) - daemon using sqlite3 to store data writable by root.
The root user is assumed to be 18+ if not defined, as the system breaks down without assuming admin accounts are parents/adults. It's possible to set root to a different age though.

agectl(8) returns age range over a local socket for the current user. A string of -1,-1 for nothing, 18,-1 for adults, -1,9 for younger kids, etc...

libutil includes 3 new functions to manage age

int *agev_get_age_bracket(const char *username);
int agev_set_age(const char *username, int age);
int agev_set_dob(const char *username, const char *dob);

adduser added an age field that's optional for now. If you don't set it, it's a more restrictive/unknown response for apps

You can turn off the daemon in other jurisdictions, which means no response or -1 back from various methods. We're considering some kind of way to mark your jurisdiction so it can apply the correct laws (or none at all if it doesn't apply to you)

mport Package Manager

Now uses the libutil function agev_get_age_bracket to do checks with a new internal function in age.c called mport_is_age_verified

This is called from the install and update paths as we are installing packages. It blocks new installs if it fails age checks for the current user. (which is typically root anyway) It's possible old versions were compliant with a different age bracket or weren't rated. Hard to know in that scenario that we have to remove one so we leave it.

We do not block deleting an app because removing one seems fine in the spirit of this law.

This is in the master branch of mport but not yet merged into the src master branch as of 3/17/2026. if mport is compiled on an older release, it does a MidnightBSD_version check to always return true since we don't have the aged(8) yet

bool mport_is_age_verified(mportInstance *mport, mportPackageMeta *pack) 

TODO: need to add age annotation to package creation logic and code in mports