Apple cost Meta billions by cutting off their data pipeline at the OS level, justifying it with a unilateral privacy moral high ground. Now, Meta is returning the favor. By astroturfing the App Store Accountability Act through digital childhood alliance, Meta is forcing Apple to build, maintain and also bear the legal liability for a wildly complex state-by-state identity verification API.
Gotta give it to Zuck. Standing up a fully-fledged advocacy website 24 hours after domain registration and pushing a bill from a godaddy registration to a signed Utah law in just 77 days is terrifyingly efficient lobbying.
I am not skeptical of any of the research, the sources seem to be cited properly. I am skeptical that this researcher has thought through or verified their conclusions in a systematic and reliable fashion. This part gives it away: "Research period: 2026-03-11 to present." This individual dropped his investigative report two days after beginning research!
Yes, AI is an incredibly good research assistant and can help speed up the tasks of finding sources and indexing sources. The person behind this investigation has not actually done their due diligence to grok and analyze this data on their own, and therefore I can't trust that the AI analysis isn't poisoned by the prompters implicit biases.
"You implemented a law that enables vibe-coding pedophiles to deploy apps that find all the children. Please resign."
The patches on top of this are really bad. For instance, we are seeing "AI" biometric video detectors with a margin-of-error of 5-7 years (meaning the validation studies say when the AI says you're 23-25 you can be considered 18+), totally inadequate to do the job this new legislation demands.
Have at it Meta, you broke it you most certainly bought it!
https://www.robpanico.com/articles/display/presence-derived-...
(posting link because it would be too much for a comment)
Clicking through to the "findings" shows that they didn't even try to feed proper data into Claude when the AI bot was blocked or couldn't access the documents. Some examples:
> LIMITATION: Direct PDF downloads returned 403 errors. ProPublica Schedule I viewer loads data dynamically (JavaScript), preventing extraction via WebFetch. The 2024 public disclosure copy on sixteenthirtyfund.org was also blocked.
> Tech Transparency Project report: The article "Inside Meta's Spin Machine on Kids and Social Media" at techtransparencyproject.org likely contains detailed ConnectSafely/Meta funding analysis but was blocked (403)
So Claude then goes on to propose "Potential Role" that postulates connections might exist, but then caveats it by saying that no evidence was found:
> This negative finding is inconclusive due to inability to access Schedule I grant detail data in the actual 990 filings (PDF downloads returned 403 errors, and ProPublica's filing viewer loads data dynamically).
This is what happens when you try to lead an LLM toward a conclusion and it behaves as if your conclusion is true. Hacker News is usually quick to dismiss incomplete and lazy LLM content. I assume this is getting upvotes because it's easy to turn a blind eye to the obvious LLM problems when the output is agreeing with something you believe.
It is like in the novel 1984. But stupid. Probably more like minority report - but also stupid. All aided by Meta bribing lobbyists to do their bidding.
In history we had four media revolutions (printing press, radio, television, Internet), each greatly disrupting and reshaping society. This is the fifth (social media and maybe AI).
All these revolutions had the same theme: increased reach of information, increased speed of transmission, increased density (information amount per unit of time), and centralization of information sources. Now we seem to reach the limits of change. No more reach, since our information networks span the entire globe. No more speed, since transmission times are close to how fast we can perceive things. The only things left to change are even more centralization and tighter feedback loops (changing the information based on how the recipient reacts).
Given all that, this media revolution might be the last one, so there is a gold rush among the elites to come out on top.
> A Meta employee (Jake Levine, Product Manager) contributed $1,175 to ASAA sponsor Matt Ball's campaign apparatus on June 2, 2025. Source: Colorado TRACER bulk data.
> No direct Meta PAC contributions to any ASAA sponsor across Utah, Louisiana, Texas, or Colorado. Source: FollowTheMoney.org multi-state search.
While it is true that Meta has funded groups that advocate for age verification, a lot of them also appear to have other actors so it's not like this is some pure Meta thing as some of the other commenters are suggesting.
At least the author posted a link to the dataset in a comment so it survived:
https://github.com/upper-up/meta-lobbying-and-other-findings
> LIMITATION: Direct PDF downloads returned 403 errors. ProPublica Schedule I viewer loads data dynamically (JavaScript), preventing extraction via WebFetch. The 2024 public disclosure copy on sixteenthirtyfund.org was also blocked.
> Tech Transparency Project report: The article "Inside Meta's Spin Machine on Kids and Social Media" at techtransparencyproject.org likely contains detailed ConnectSafely/Meta funding analysis but was blocked (403)
The least they could have done is read their own reports and then provided the documents to the LLM. Instead they just let it run and propose connections, asked it to generate some graphs, and then hit publish.
Plus, Apple gets to be the gatekeeper for Meta and other apps which can't be good for meta, and Apple gets to know the age of its users, which in itself is monetizable.
Arguably they would be more materially advantaged if they were forced to KYC/validate ages, not the platform; because sure, there's a cost to doing it, but presumably having hard data on who your customer actually is, with age and address and everything, is worth a lot more than the verification cost. And being able to say "We're legally required to gather this" gives a lot of PR cover (even though it'd be followed with "but we're giddy to do so and we will abuse this data and you every way we possibly can. No one at Meta believes you are human. We hate you as much as you hate us, but we're stuck in this together, endlessly loathing the supernatural force that keeps us working together.")
But, On the flip side: I also don't doubt that Meta is doing this, because the purpose of a system is what it does, and the leadership at Meta has done nothing in the past four years to demonstrate that they're capable of cogent thought and execution. We want to believe there's some evil plan, and maybe there is, but in all likelihood one day we'll learn that they're just... unintelligent.
We should also update all FOSS license terms to explicitly exclude Meta or any affilites from using any software licensed under them.
Age signals from the OS? Need to provide a channel of information available to applications. Applications already talk to servers with unchecked commonality.
Biometric data? Today it unlocks your private key. Tomorrow it's used to verify you are the same person that was used during sign-up -- the same that was "age-verified".
Next year, the application needs to "double-check" your identity. That missile that's coming to you? Definitely not AI-controlled, definitely not coming to destroy the "verified" person who posted a threatening comment about the AI system's god complex. Nope, it's coming to deliver freedom verification.
Like, in general, a software change to add an "age class" attribute to user accounts and a syscall "what's this attribute for the current user account" would satisfy the California bill and that's a relatively minor change (the bad part is the NY bill that allegedly requires technical verification of whatever the user claimed).
The weird issue is how should that attribute be filled for the 'root' or 'www-data' user of a linux machine I have on the cloud. Or, to put aside open source for that matter, the Administrator account on a Windows Active Directory system.
Because "user accounts" don't necessarily have any mapping (much less a 1-to-1 mapping) to a person; many user accounts are personal but many are not.
> Meta spent a record $26.3 million on federal lobbying in 2025, deployed 86+ lobbyists across 45 states, and covertly funded a "grassroots" child safety group called the Digital Childhood Alliance (DCA) to advocate for the App Store Accountability Act (ASAA). The ASAA requires app stores to verify user ages before downloads but imposes no requirements on social media platforms. If it becomes law, Apple and Google absorb the compliance cost while Meta's apps face zero new mandates.
These bills also need to be opposed on a legal/political level.
Something I realized last night is that people who lie about their age to send false signals may inadvertently open themselves up to CFAA liability (a felony). So this is a serious matter for users who want to maintain anonymity.
https://web.archive.org/web/20260313125244/https://old.reddi...
No offline devices. Commercial vendors get your biometric data (and the equivalent of your driver's license / SSN). Every application on the OS can query your data.
If you think it stops with one bill, after they get all the infrastructure for this in place? You're fooling yourself. The whole point of this is to identify you, on every web page you visit, every app you open, on every device you own. Once bills are passed, it's very hard to get them revoked or nullified.
This is the most aggregious, authoritarian, Big Brother government surveillance system ever devised, and it's already law. I am fucking terrified.
(Yes, the EU has a less horrifying version of this. But Google, Apple, and Microsoft still control most of the devices in the world, and they are US companies.)
Anthropic donated $20 million to Public First Action, a PAC that promotes Republican Senator Marsha Blackburn and her sponsored Kids Online Safety Act (KOSA), a bill that will force everyone to scan their faces and IDs to use the internet under the guise of saving the children.
The legislative angle taken by companies like Anthropic is that they will provide the censorship gatekeeping infrastructure to scan all user-generated content that gets posted online for "appropriateness", guaranteeing AI providers a constant firehose of novel content they can train on and get paid for the free training. AI companies will also get paid to train on videos of everyone's faces and IDs.
As for why Blackburn supports KOSA:
Asked what conservatives’ top priorities should be right now, Senator Blackburn answered, “protecting minor children from the transgender [sic] in this culture and that influence.” She then talked about how KOSA could address this problem, and named social media platforms as places “where children are being indoctrinated.”
If Anthropic, the PACs it supports and Blackburn get their way with KOSA, the end result will be that anything posted on the internet will be able to be traced back to you.
https://www.cnbc.com/2026/02/12/anthropic-gives-20-million-t...I’d write my senator but they won’t do shit. Is there anything that can seriously be done?
one scary observation is that each year, less and less people care. at least, this is true among my students. plenty of them believe the 'protect the children' line and are more than willing to do whatever the government/big tech suggests. or they just shrug ("what difference would i make?").
for context, i teach at a college level, in tech. a few of my classes are from the cybersec program, one of the programs that should understand and care about the implications of bills like these, and even the majority of them do not care about this stuff anymore. they grew up with instagram and facebook and cameras everywhere. they grew up knowing that any little fuck up they have is recorded and posted online. they know that by the time they go to college, all of their data has already been leaked a few times. they never really had an expectation of privacy in the first place, so it just isnt a big deal.
as someone who interacts with this next generation of "hackers" on a daily basis... the concept of cypherpunk is gone. i got into this field because of my beliefs. they are going into this field because they want a chance at buying a house some day, and know that big tech has big bucks.
i am tired. and i recognize that this is exactly what they (lobbyists, meta, etc.) want! but i am tired and discouraged. more and more i find myself having to actively fight the urge to give up. i am not ready to give up just yet... but, i am sorry to say that as someone closer to retirement than i am comfortable admitting, i only have so much energy left.
Instead of just creating a course that explains how to child-proof a device, we have to surveil everyone.
EDIT: why is it deleted now?
Compare this to what the EU built. The EU Digital Identity Wallet under eIDAS 2.0 is open-source, self-hostable, and uses zero-knowledge proofs. You can prove you're over 18 without revealing your birth date, your name, or anything else. No per-check fees, no proprietary SDKs, no data going to a vendor's cloud. The EU's Digital Services Act puts age verification obligations on Very Large Online Platforms (45M+ monthly users), not on operating systems. FOSS projects that don't act as intermediary services are explicitly outside scope. Micro and small enterprises get additional exemptions.
The US bills assume every operating system is built by a corporation with the infrastructure and revenue to absorb these costs. The EU started from the opposite assumption and built accordingly.
Just another reminder of how we need to protect what we have in the EU (not a guarantee, but at least a chance of fair dealing and a sustained commitment to civic values). Now that the mask has fully fallen, we have to take every step possible to root out American influence.Not saying I think it's a good idea to provide the year of birth to all sites, but (session ID, year of birth) is the only information they would need. The problem is proving who's behind the keyboard at the time of asking, which would require challenge-response, and is why I think this should be an online platform, not a hardware PKI gadget with keys inevitably tied to individuals.
Digital-ID (Aadhar) was heavily pushed by USAID and other US-deepstate associates; the same with digital-money and the "demonetization". Bill Gates's org actively tests out things on actual humans like guinea pigs, before globalizing the "solutions". These days all of this is kind of redundant since the phone-number + verification has become essentially a necessity to live in the city in any part of world today.
The prev. Govt. had considered doing this "login with your ID or no internet" scheme (to "protect" people no doubt) back in 2012s - there were explicit statements about disallowing people who would not authenticate with Aadhar, but it was shelved (likely because of their unpopularity).
If our current "Dear Leader" were to propose this, I think a significant population would opt-in simply because of a sense of belonging to a hero-worship-cult.
The state is determined to ensure that every human be their slave.
Corporations literally buy the laws they want and Silicon Valley is the newest lobbying monster. Genuinely terrifying.
$70 million is chump change for Meta, yet is far more money than I’ll ever have and does so much to influence state legislation.
Its like they want to keep being seen as the bad guys.
Overall, that's the reason anti-trust laws must be applied rigorously, otherwise the normal population has no chance.
The reason is that europeans have nothing to win from those "winner-take-all" platforms the US has built in the past decades. Europe has built zero of them.
It contributes very little to Europe's GDP or the overall being of the european. And in some cases, it eats Europe's GDP, moving economic activity back to the US. This is different than for Americans which big tech is a net-positive contributor to society in my POV, mainly because how much economic activity $ it generates.
Big techs provide huge paychecks and made a lot of people rich in the US, and most of its GDP growth in the last decade. But it's a double-edged sword.
They will make laws in favor of them in detriment of the average American, while minting more billionaries than Europe could ever dream of.
Europe will take a long time to get the digital revolution the US already did, but it'll mostly come from regulations and government initiatives. And will be net-positive for humans living in Euope, not for owners of corporations.
The very last people you should trust when it comes to "protecting the children."
And a serious question: with deepest respect to the author for their extraordinarily impressive time and effort in this investigation... Why was this not already flagged by political reporters or investigative journalists? I'm not American so maybe I don't understand the media structure over there but it feels like SOMEONE should have been all over this way before it's gotten to the point described in this post.
if "it" is the middle finger, for sure. "terrifying" is a great choice of word for it.
No, the way to stop it is to talk to your representatives.
You have the power. You just have to pick up a phone, and ask your friends, relatives, neighbors, to do the same. (They will, because it affects all of them.) Tell your reps to remove the legislation or you're voting them out. They don't want to lose their jobs. They will change if you tell them to. But only if you tell them. That is your power. Use it or lose it.
But sometimes very few people can make a difference.
Turns out they were right
These laws, that attempt to move "age verification" into the OS, 100% absolve Meta (and all the Meta owned "properties") from any legal liability so long as all of Meta's app's follow the law's required "ask the OS for the age signal of the user".
Any "bad stuff" which then gets shown to "underage users" then becomes "not Meta's fault, they followed the legally proscribed way to check the age of the user, and the OS said this user was 'old enough'" and Apple/Google then get to shoulder the liability (and pay out for the class action lawsuits) for failing to provide a proper age signal.
That's the "material advantage" gained by Meta by pushing these laws.
If this was somehow introduced without anyone noticing and deployed, imagine the damage it would cause.
If we're fantasizing here, I like to imagine two major OS makers trying to comply these laws, fail miserably, and let FOSS OSes and kernels more recognition in the desktop market.
What exactly do you think Linux is? I would say that Linux would be forked in like 2 seconds, a bunch of different companies would start offering "attested Linux," and all you'd have to do was change your repos and update.
I would say that, but what would really happen is that we'd find out that Canonical, Red Hat, and a bunch of other distributions had been talking to the government for a year behind closed doors and they're already ready to roll out attested Linux. Debian would argue about it for six months, and then do the same thing. Hell, systemd will require age attestation as a dependency. Devuan and any other stubborn distribution would face 9000 federal lawsuits, while having domain names blocked, and the Chinese hardware necessary to run them seized at the ports with the receivers locked up on terrorism charges.
I have no idea where the confidence of the IT tech comes from. You (we) are something between a mechanic and a highly-skilled janitor.
Update the terms to indicate that you can do what you want, but this OS is probably not compliant with states run by evil dipshits.
Cpt America in the Winter Soldier
Do you know how democracy works? There are these people called representatives. They are hired by you. They pass laws. They only get to continue having a job if people like you vote for them. When you tell them "I don't like the law you are passing", they are hearing "the people who hire me are angry with me". The more people that are angry at what they're doing, the more their job is at risk.
They do what the lobbyists say because somebody else is doing the work, and they get paid (by the lobbyist). But they won't have a job to get paid for if the voters don't vote for them again. So your entire defense against tyranny and bad laws is you speaking out. If you never talk to your reps (or vote), you're telling them you don't care what kind of government it is, and they really will do whatever they want.
You have to tell them how you feel, along with all the rest of us. That's the only power we have.
In addition to that, tell everyone you know. Your friends, family, coworkers, the dude running the local gas station. Explain to them why government-mandated surveillance of everything they do on a computer is a bad idea. Ask them to talk to their reps.
You have consumer activist brain. Next you're going to suggest that we complain to the manager or start our own government and compete in the marketplace.
> The only thing that talks is money
No, the only thing that is talking is money. Money wants this. You're busy pretending like you're going to do a boycott; they're going to boycott you.
Complain about the internet? They'll just blacklist you from it. Complain about the phone? Well now you can't use one; try smoke signals. Complain about the landlord? They'll settle the case, kick you out on the street, and blacklist you among all private equity landlords and the management companies that service small landlords. You'll just go to a small landlord that doesn't use one of the management companies? Well they won't have access to a bunch of vendors that have exclusive contracts with and share ownership with the management companies; now they can't make any money and have to sell to private equity.
You've been fooled into thinking that being victimized is a moral failure of the victim. The perpetrators taught you that. They taught you that the only appropriate action is to beg and threaten to leave, and they shut down customer service and monopolized the market. But, again, the worst thing they trained you to do is to blame the victim.
Heck, Linus Torvalds should just add an amendment to the next release of the Linux Kernel that makes it illegal to use in any jurisdiction that requires age verification laws.
This would obviously cause such a massive disruption (especially in California) that the age laws would have to be rolled back immediately.
This seems like a no-brainer to me but I am admittedly ignorant on this situation. I'm sure there's a good reason why this isn't happening if anyone cares to explain.
Ideally, getting these servers to auto turn off the day this goes into effect ("In compliance with this new law, Linux is now temporarily unusable. Please <call to action>.") would be glorious for getting the bill staved off, or killed.
It would hurt some productivity, but that is a risk these lawmakers taking donations are probably willing to make.
I've wondered if FaceID and the Android counterpart are actively creating an extraordinary labeled dataset for facial expressions at the point of sale.
With users trained to scan their face before every transaction, tech companies could correlate transactions to facial expressions, facial expressions to emotions, and emotions to device content. I can imagine algorithms that subtly curate the user experience, selectively showing notifications, content, advertising to coax users towards "retail therapy".
This is a non-issue because it's almost certainly going to be gated behind a permission prompt. There are more invasive things sites/apps can ask for, and we seem to be doing fine, eg. location. Moreover is it really that much of a privacy loss if you go on steam, it asks you to verify you're over 18, and the OS says you're actually over 18?
>Biometric data? Today it unlocks your private key. Tomorrow it's used to verify you are the same person that was used during sign-up -- the same that was "age-verified".
Given touch id was introduced over a decade ago, and the associated doom-mongering predilections did not come to pass, I think it's fair to conclude it's a dud.
The biggest shocker to me has been just how "cheap" a lot of people are to buy off. Mandelson is complaining about air miles FFS. So much of this is a few thousand here, some fancy tickets there, a jet ride elsewhere, etc. In my mind it was always much, much bigger sums that people were selling their countries & souls out for, sadly, it turns out a lot of people, even in really high positions, are shockingly cheap.
[1] https://en.wikipedia.org/wiki/Relationship_of_Peter_Mandelso...
Because it's hopeless? It's been proven time and time again there's nothing the average person can do to fight this sort of thing.
It's just better to sit back and watch as everything gets ruined.
What you have in the EU is this: https://noyb.eu/en/project/dpa/dpc-ireland
> Now that the mask has fully fallen, we have to take every step possible to root out American influence.
You have literal rogue states in your union that neutralize the entirety of it, as the above shows. It's a joke. The EU is a joke. A single country is enough to mean US tech can do whatever it wants, similarly a single other country is enough to mean Russia can largely do what it wants.
The others are of course in on it too. Which is why for all the empty EU talk on US big tech you've never heard them talk about the Irish DPA and what they all enable. Strange right? Would think that this would be a priority. But it shows that even if the rest weren't in on it, just one country would be enough. And it could even be a tiny place like Luxembourg.
Laws and regulations aren't worth the paper they're written on if they're not enforced. The current ones aren't enforced at all, why would any new ones be? Did you know that there was a long period where hosting European citizens' PII on US-controlled servers (like Amazon instances in Europe) was illegal, after the "Privacy Shield" was deemed unlawful? No one cared. Did you know that this is currently the case again, because the thing that replaced it has once again had its basis ripped out from under it by Trump? Once again, no one cares, and indeed EU governments and corporations are _still_ making migrations _to_ US clouds.
Not that it matters, within a few years RN will be running France and AfD will be running Germany and you don't have to pretend any more as the "mask will have fallen" just as much.
You're not missing anything. It's just an AI generated summary of the original GitHub link https://github.com/upper-up/meta-lobbying-and-other-findings
I found the original article much easier to read anyways
https://en.wikipedia.org/wiki/Qualified_website_authenticati...
I remember from peak net neutrality discussions during trump 1 maybe around 2017-2018 ant saw an article on theverge.com (that cannot find now) and biggest sum to individual politician was around $200k, when median values were much much lower.
Politicians are selling tens of billions of dollars (if not hundreds of billions) worth of revenue to ISPs for couple or dozen million. Literally 1000x return on investment (if successful).
I remember local politician (I am not from US) got caught taking 100k bribe from a company for helping with alleged highway construction procurement. Project was valued ~1B - 10 000x return on investment (if they wouldn't have been caught).
[1] I am sorry, not "corruption", but "lobbying".
In the end, all the little people are just collateral damage or occasionally they get some collateral benefits from wherever the munitions land.
(Maybe some unspoken element of concern over social media bots, too - as they evolve from spamming copy+pasted comments to being near-indistinguisable from actual human accounts?)
Ideas? Time to spin up a local LLM for some editing advice.
In the real world, professional media organizations regularly expose corruption. More often than not? No idea. But to pretend they only engage in cover-ups is cynical fatalism.
It's to save the kids.
We care about the kids. We don't bomb them.
Just because you're a pessimist doesn't mean you have to be coy. :)
And you seem to have been fooled into thinking all victims are powerless.
A "Linux distro" is not the Linux kernel. It's possible for some distros to add such license terms to their distribution media, but others like Debian and Debian-based ones adhere to the GPL so no go.
Also keep in mind keystroke dynamics can probably do that too and has been a topic of study in one form or another since the nineteenth century vis-a-vis telegraph operators.
Never stopped people overengineering :P
> Nobody stops the government from sending goons to your door right now for a snarky comment.
This is just dumb. They literally don't know who wrote it, and have to assign somebody to track you down. The fact that they're putting infrastructure on your computer and on the network to make this one click away for them matters.
The auth server would lie in Colorado. The FS server, in New Mexico. The CPU server, in Nevada. The terminal (the client), in Alaska. Shut down and repeat at random. Watch the lobbies collapsing down tring to sue that monster.
That's a wildly low sum of money for a 5 minute personal call, let alone even a modest intervention.
You literally live in a Democracy. There's 5.8 billion people on this planet who wish they had the kind of power you have. If you give up your rights without a fight, you don't deserve them.
What do you mean? They still need people purchasing software and hardware.
You can argue effectiveness, but if enough people say no, then a boycott is extremely effective. The issue is always on awareness and making people take hard actions.
If it's not (fully) your code, you aren't free to set the licence conditions; Linus can't do that without getting approval from 100% (not 99% or so) of authors who contributed code.
What one can do is add an informative disclaimer saying "To the best of our knowledge, installing or running this thing in California is prohibited - we permit to do whatever you want with it, but how you'll comply with that law is your business".
Watch as apps refuse to work when you deny them permission. Also the OS (and “privileged apps”) don’t ask for permission, they have full unfettered access to everything already.
lol.
> Moreover is it really that much of a privacy loss if you go on steam, it asks you to verify you're over 18, and the OS says you're actually over 18?
Slippery slope, but an interesting argument. While SteamOS is a thing, Steam isn't my OS.
> Given touch id was introduced over a decade ago, and the associated doom-mongering predilections did not come to pass, I think it's fair to conclude it's a dud.
Really? You think that things built decades ago can't be further built-upon in the now or the future?
The linked post talks about the effectiveness of AIPAC but fails to mention how much is spent by say, Palestinian interest groups. Perhaps there's a good reason for this: do Palestinian groups have any money to spend on US elections? Try fundraising in Gaza right now.
Likewise, business interest groups have a lot more money to spend on elections than, say, environmental groups. The latter have to beg for small donations from individuals just to stay afloat. Thus, it's relatively easy for business groups to outspend environmental groups. To win an auction, you just have to be the highest bidder.
No, enforcing privacy is not hard, all it takes is imposing penalties _much greater than_ those financial incentives.
AutoModerator on /r/linux is set up to automatically remove posts after a set amount of reports.
she ended up resigning in a scandal caused by her husband accepting a boat (or work on the boat..i don't remember). the scandal was caused by the amount of the bribe. it was too low. the Turkish people could understand some corruption, but to be able to bribe the top leader for $50k. Unacceptable. If it would have been $100 million, it would not have been a scandal.
It also helps when you take an offender to court. If I contribute to a project but don't assign copyright, then they cannot take offenders to court if my code was copied illegally. The burden is on me to do so.
Of course, all code released prior to the change still remains on the original license.
6. Each time you redistribute the Program (or any work based on the Program), the recipient automatically receives a license from the original licensor to copy, distribute or modify the Program subject to these terms and conditions. You may not impose any further restrictions on the recipients' exercise of the rights granted herein. You are not responsible for enforcing compliance by third parties to this License.
It would be in violation of the GPL and such a license would not be an OSI approved license. 5. No Discrimination Against Persons or Groups
The license must not discriminate against any person or group of persons.Rocket is obvious and spectacular. Those are for amateurs.
A journalist got beaten up to the brink of death and will never walk again by 'unknown perpetrators'? Well, it's a dangerous country, and he had it coming, maybe some concerned citizens went a bit too far, but our dear leader cannot watch over everybody.
Scaling: do you think other journalists will not take notice?
And he will still be alive to reminder them how they may end up.
If you want to see how far imagination can go here, look up Artyom Kamardin and think how would you behave after hearing his story .
You mean non slippery slope?
>Really? You think that things built decades ago can't be further built-upon in the now or the future?
If there's no deadlines for predilections, how can we score them? Should we still be worried about some yet undiscovered way that cell phones are causing cancer, despite decades of apparently no harmful side effects?
They don’t need you to purchase hardware or software any more. We’re moving to centralized economic planning, where resources for datacenter buildouts are reserved for people with sufficient political loyalty (and come from tax dollars), and the only products are surveillance and collective punishment.
If you don’t want that to happen, then you’ll need to help build an alternative.
"Every OS provider must then: provide an interface at account setup collecting a birth date or age, and expose a real-time API that broadcasts the user's age bracket (under 13, 13 to 15, 16 to 17, 18+) to any application running on the system."
Debian, Ubuntu, etc., they'll all fall right in line because the clear and immediate losses will outweigh any PR issue.
I know. That's exactly the point.
In such situations where one party (Meta) has enough money to lobby and is playing dirty, it's a massively asymmetric situation. In such cases, if you really want to make sure you're heard (which I'm not sure distributers want or care about tbh), you've got to play the game too.
Malicious compliance, if you will.
PS: For a "practical" variant, simply a warning might be sufficient - given how many hospitals/critical infra uses linux. For eg "There is a chance this server will fail to work on x date due to this y law. Not as glamorous/all-guns-blazing, but probably much more sensible and practical.
PPS: For an even more "safer" variant, one could go "Post x, please note that using linux/this server is a violation of law y. Please turn off the server yourself manually. Failure to comply with these instructions and violating the law will be borne entirely by the (no informed) sysadmin/manglement.
And turns out power-tripping men offered raw power over other humans on threat of violence is something they like.
And ICE? Remember J6 and Three Percenter's and all those right wing militias? They ended up in ICE. Same reasons.
If you can't trust the OS, you have bigger issues than it knowing whether you're 18 or not. At the very least it has a camera pointed at you at all moments you're using it, and can eavesdrop in all your conversations.
Fuck Reddit
Rinse and repeat. Unless, politicians band together and say "we need the full ROI of your project, and NONE of us will even talk to you unless we get half the profits, and you can't primary all of us at once"
Which "most of Europe" would that be? Switzerland and handful of northern countries? Because it is definitely not Germany or several "you can't access half of the internet during times when twenty men kicking a ball on a field" southern states.
And responses to some common criticisms of the idea: https://news.ycombinator.com/item?id=46459959
I also forgot to mention in my original post that the token issuer is not a monopoly. Any company that wants to participate can do so, just like there are many brands of tobacco and alcohol. Require websites to accept at least 5 providers to ensure competition.
To be clear though if it's being used as wedge for privacy violation then it should not exist at all. And from reading TFA preventing that may need a similarly coordinated counter-effort.
Yes, I agree.
>They don’t need you to purchase hardware or software any more.
Need? No. But they still want as much money as possible. That's why a boycott/strike will still be effective. They don't need money anymore but will still bend over backwards for it.
>If you don’t want that to happen, then you’ll need to help build an alternative.
I want to help. Not sure what I can do to help, though. Seems like simply calling my reps is talking to the wind.
If your OS prevented encryption, because one of the anti-encryption laws got passed, would you still trust its privacy and security?
Gulf states have little to nothing in common with Palestinians. Citizens of most gulf states are born into relative wealth merely by the fact their countries are rich in petrodollars. They build lavish cities and have standards of living (for their citizens) that increasingly put the West to shame. They are "diversifying" from oil by building massive AI datacenters and essentially catering to Westerners who want to live unencumbered by Western pretensions of civic duty, avoid taxes in their home countries, etc. They make deals with the Israelis and have for over a decade now, even if under the table. They buy American weapons, their elites have frequently been educated at the most exclusive British or American universities. They like expensive Italian cars. Money is money.
Meanwhile Palestinians are born poor, in a failed state with no autonomy. Some UAE crypto influencer is yolo gambling away more money than most Palestinian kids will see in their lifetimes. They live under an occupation and have basically no rights in that regard. They are poor. Just google image a picture of Gaza vs the UAE. It just doesn't even compare. Maybe on some level they are both Arabs. But the same rule applies. Money is money.
The gulf state governments gave up on trying to care about them many many decades ago. They realized it was cheaper (and more prosperous) to go along to get along with the United States and Israel. If they hadn't, their capitals might look like Tehran right now. Over the years it became easy to blame other people for the problem - Iran, even the Palestinians themselves. They have long since washed their hands of caring.
Don't conflate the Gulf States with Palestinians, or associate them with anyone on the losing side of anything when it comes to money and power. They are as corrupt and bought-in to this system of wealth/might makes right as anyone.
They may on paper, but of course a lot of money goes to dividing us up come election time. What you are suggesting is no shortcut - it would rather be almost like inventing an alternative political party.
I do think there is a stronger case against the next under-18 Aaron Swartz, who will get hit with 200 felonies for setting his age wrong (one felony per app/service) after pissing off someone important.
The absurdity here comes from the fact that this is only illegal when one convinces a group of wetware about the dangers of porn addiction and LGBT, even more absurd this can only be done through misinformation since neither LGBT grooming rings nor porn addiction are real.
I see the absurdity in pushing for laws in the hope of preventing a disease that only exists in your mind? Can you? I believe you can if you step out of idpol and look at the cold data/dollars.
But generally speaking, online age verification is one of those issues where the left-right ideological divide doesn't map neatly. People support and oppose it for various different reasons. Much like the assisted suicide issue.
QWAC certs are only for "high value" sites: banks, government services, etc. They can only be issued by "Qualified Trust Service Providers" (e.g. digisign, D-TRUST, etc -- not governments), and cost many hundreds of euros. Your blog and mastodon instance and 98% of businesses just aren't affected.
People operating in "high risk" sectors that need access to payment infra (porn, drugs, etc) are, as always, going to have a hard time. That's a worthy conversation, but nothing about QWAC or eIDAS is about "the government not issuing certs to people they don't like".
Are you serious? Because this comment doesn't make it sound like you're serious.
EULAs and the like allow adults to simply click "I accept". That's apparently the way contracts work these days. Speaking of contracts: children aren't allowed to sign contracts. So those apps that children are using with EULAs? It's absurd to allow adults to simply click "I accept". We need to have "acceptance verification" laws to prevent this kind of abuse.
It's also absurd to allow children to simply enter a church. Churches teach dangerous thoughts. Have you read their books?! Those books have sex, murder, theft! Think of the children! There's many kinds of religions and we need to track the religion bracket of our children. It's absurd to allow a child to simply click "I am Christian." Nowhere else works like this. We need to have "religious verification" laws to prevent this kind of abuse.
What you want isn't conducive to a "high trust" society [0].
[0]: https://en.wikipedia.org/wiki/High-trust_and_low-trust_socie...
An open-source intelligence investigation into how Meta Platforms built a multi-channel influence operation to pass age verification laws that shift regulatory burden from social media platforms onto Apple and Google's app stores.
Every finding in this repository is sourced from public records: IRS 990 filings, Senate LD-2 lobbying disclosures, state lobbying registrations, campaign finance databases, corporate registries, WHOIS/DNS records, Wayback Machine archives, and investigative journalism.
Status: Active investigation. 47 proven findings, 9 structurally possible but unproven hypotheses, and multiple pending FOIA responses.
Research period: 2026-03-11 to present
Meta spent a record $26.3 million on federal lobbying in 2025, deployed 86+ lobbyists across 45 states, and covertly funded a "grassroots" child safety group called the Digital Childhood Alliance (DCA) to advocate for the App Store Accountability Act (ASAA). The ASAA requires app stores to verify user ages before downloads but imposes no requirements on social media platforms. If it becomes law, Apple and Google absorb the compliance cost while Meta's apps face zero new mandates.
This investigation traced funding flows across five confirmed channels, analyzed $2.0 billion in dark money grants, searched 59,736 DAF recipients, parsed LD-2 filings, and mapped campaign contributions across four states to document the operation.

Meta's federal lobbying spending jumped from $19M (2022-2023) to $24M (2024) to $26.3M (2025) as ASAA bills were introduced in roughly 20 states. In Louisiana alone, 12 lobbyists were deployed for a single bill that passed 99-0.

Across all five Arabella Advisors entities (New Venture Fund, Sixteen Thirty Fund, North Fund, Windward Fund, Hopewell Fund), 4,433 grants totaling approximately $2.0 billion were analyzed. Not a single dollar went to any child safety, age verification, or tech policy organization. The Schedule I grant pathway through the Arabella network is definitively ruled out.

Five confirmed channels connect Meta's spending to ASAA advocacy: direct federal lobbying ($26.3M), state lobbyist networks (45 states), the Digital Childhood Alliance (astroturf 501(c)(4)), super PACs ($70M+), and state legislative campaigns (3 laws passed). A sixth channel through the Arabella dark money network is structurally possible but unproven.
These standalone HTML documents provide detailed views of the investigation:
Full Investigation Documentation contains the complete OSINT investigation report with all five channels, evidence tables, and source citations.
Funding Network Timeline maps the chronological development of Meta's lobbying infrastructure, DCA's formation, and ASAA legislative progress across states.
Research Timeline tracks the investigation itself, showing when each finding was established and how threads connected.
(These are self-contained HTML files. Clone the repo and open them in a browser, or use Forgejo's raw file view.)
metafindings/
data/
processed/ 24 research findings documents
raw/osint_990/ Raw IRS 990 data extracts
output/
reports/ Summary reports, charts, and HTML documentation
timeline/ Interactive timeline visualizations
briefs/ Policy briefs and public comments
OSINT_TASKLIST.md Investigation task tracker with completion status
Meta retained 40+ lobbying firms and 87 federal lobbyists in 2025 (85% with prior government service). Meta's own LD-2 filings with the Senate explicitly list H.R. 3149/S. 1586, the App Store Accountability Act, as a lobbied bill. The filing narrative includes "protecting children, bullying prevention and online safety; youth safety and federal parental approval; youth restrictions on social media."
At the state level, confirmed operations include $338,500 to Headwaters Strategies (Colorado), $324,992+ across 9 firms and 12 lobbyists in Louisiana, and $1,036,728 in direct California lobbying (Q1-Q3 2025 alone). A Meta lobbyist brought the legislative language for Louisiana HB-570 directly to the bill's sponsor, Rep. Kim Carver, who confirmed this publicly.
DCA is a 501(c)(4) advocacy group that Meta covertly funds. Bloomberg exposed the funding relationship in July 2025. Under oath at a Louisiana Senate committee hearing, Executive Director Casey Stefanski admitted receiving tech company funding but refused to name donors.
DCA has no EIN in the IRS Business Master File, no incorporation record in any state registry searched (CO, DC, DE, VA, OpenCorporates), and no Form 990 on file. It processes donations through the For Good DAF (formerly Network for Good) as a "Project," not a standalone nonprofit. Its likely fiscal sponsor is NCOSEAction/Institute for Public Policy (EIN 88-1180705), NCOSE's confirmed 501(c)(4) affiliate with the same leadership.
DCA's domain was registered December 18, 2024. The website was live and fully formed the next day. Every blog post and testimony targets Apple and Google. Meta is never mentioned or criticized.
Meta committed over $70 million to four state-level super PACs: ATEP ($45M, bipartisan, co-led by Hilltop Public Solutions), META California ($20M), California Leads ($5M), and Forge the Future (Texas, Republican-aligned). Forge the Future's stated policy priority is "empowering parents with oversight of children's online activities," which mirrors ASAA language exactly.
Hilltop Public Solutions co-leads the $45M ATEP super PAC and is also involved in DCA's messaging coordination, making it the first firm confirmed in both Meta's PAC operation and the astroturf advocacy track.
All super PACs are registered at the state level rather than with the FEC, scattering disclosure filings across individual state ethics commissions instead of a single searchable federal database.
Meta's Colorado lobbyist Adam Eichberg simultaneously serves as Board Chair of the New Venture Fund, the flagship 501(c)(3) of the Arabella Advisors network. NVF transfers $121.3 million annually to the Sixteen Thirty Fund, a 501(c)(4) with no donor disclosure requirements.
The Arabella network operates four entities from 1828 L Street NW, Washington DC (suites 300-A through 300-D) with combined annual revenue exceeding $1.3 billion. All five entities' grant recipients were analyzed (4,433 grants, approximately $2.0 billion). Zero dollars went to any child safety organization, definitively ruling out the Schedule I grant pathway.
If Meta money flows through the Arabella network to DCA, it would have to travel via fiscal sponsorship, consulting fees, or lobbying expenditures, which are more opaque than grant disclosures.
ASAA has been signed into law in three states:
Roughly 17 additional states have introduced or are considering ASAA bills, including Kansas, South Carolina, Ohio, Georgia, and Florida. The federal version was introduced in May 2025 by Rep. John James (R-MI) and Sen. Mike Lee (R-UT).
Each finding below is documented with sources in the corresponding analysis file.
| Source | URL |
|---|---|
| OpenSecrets Meta Profile | https://www.opensecrets.org/federal-lobbying/clients/summary?id=D000033563 |
| OpenSecrets Meta Lobbyists | https://www.opensecrets.org/federal-lobbying/clients/lobbyists?cycle=2025&id=D000033563 |
| OpenSecrets Meta Reports | https://www.opensecrets.org/federal-lobbying/clients/reports?cycle=2025&id=d000033563 |
| Senate LDA Filing (Q1 2025) | https://lda.senate.gov/filings/public/filing/b73445ed-15e5-42e7-a1e8-aeb224755267/print/ |
| Congress.gov H.R. 3149 | https://www.congress.gov/bill/119th-congress/house-bill/3149 |
| Congress.gov S. 1586 | https://www.congress.gov/bill/119th-congress/senate-bill/1586 |
| Source | URL |
|---|---|
| ProPublica NVF | https://projects.propublica.org/nonprofits/organizations/205806345 |
| ProPublica Sixteen Thirty Fund | https://projects.propublica.org/nonprofits/organizations/264486735 |
| ProPublica Windward Fund | https://projects.propublica.org/nonprofits/organizations/473522162 |
| ProPublica Hopewell Fund | https://projects.propublica.org/nonprofits/organizations/473681860 |
| ProPublica ConnectSafely | https://projects.propublica.org/nonprofits/organizations/473168168 |
| ProPublica DCI | https://projects.propublica.org/nonprofits/organizations/393684798 |
| NVF 2023 Form 990 | https://newventurefund.org/wp-content/uploads/2024/11/2023-New-Venture-Fund-Form-990-Public-Disclosure-Copy.pdf |
| STF 2024 Form 990 | https://www.sixteenthirtyfund.org/wp-content/uploads/2025/11/Sixteen-Thirty-Fund-2024-Public-Disclosure-Copy-rG58c3r55H5J50YadU6i.pdf |
| Source | URL |
|---|---|
| Colorado SODA API (Lobbyist Income) | https://data.colorado.gov/resource/dxfk-9ifj.json |
| Colorado TRACER (Contributions) | https://tracer.sos.colorado.gov/PublicSite/DataDownload.aspx |
| F Minus (Pelican State Partners) | https://fminus.org/clients/pelican-state-partners-llc/ |
| LA Board of Ethics (Koch) | https://eap.ethics.la.gov/Lobbyist/upload/349/ |
| FollowTheMoney (Meta) | https://www.followthemoney.org/entity-details?eid=54466150 |
| FollowTheMoney (Headwaters) | https://www.followthemoney.org/entity-details?eid=6153564 |
| Source | URL |
|---|---|
| Louisiana HB-570 | https://www.legis.la.gov/Legis/BillInfo.aspx?i=248616 |
| HB-570 Enrolled Text | https://www.legis.la.gov/legis/ViewDocument.aspx?d=1425304 |
| HB-570 Act No. 481 | https://www.legis.la.gov/legis/ViewDocument.aspx?d=1427667 |
| HB-570 Conference Report | https://www.legis.la.gov/legis/ViewDocument.aspx?d=1421828 |
| HB-570 Resume Digest | https://www.legis.la.gov/Legis/ViewDocument.aspx?d=1429703 |
| LegiScan LA HB-570 | https://legiscan.com/LA/bill/HB570/2025 |
| FastDemocracy LA HB-570 | https://fastdemocracy.com/bill-search/la/2025/bills/LAB00024814/ |
| Utah SB-142 | https://le.utah.gov/~2025/bills/static/SB0142.html |
| Colorado SB26-051 | https://leg.colorado.gov/bills/SB26-051 |
| Colorado SB25-086 | https://leg.colorado.gov/bills/SB25-086 |
| Colorado HB25-1287 | https://leg.colorado.gov/bills/HB25-1287 |
| Source | URL |
|---|---|
| DCA Website | https://www.digitalchildhoodalliance.org/ |
| DCA Stefanski Bio | https://www.digitalchildhoodalliance.org/meet-digital-childhood-alliance-executive-director-casey-stefanski/ |
| DCA Idealist Profile | https://www.idealist.org/en/nonprofit/5310a13d20e94a97b722d21365e497ce-digital-childhood-alliance-washington |
| DCA Facebook | https://www.facebook.com/p/Digital-Childhood-Alliance-Inc-61571460776409/ |
| NVF Board (Eichberg) | https://newventurefund.org/who-we-are/board-of-directors/adam-eichberg-chair-of-the-board/ |
| Headwaters Strategies | https://headwatersstrategies.com/ |
| InfluenceWatch (Eichberg) | https://www.influencewatch.org/person/adam-eichberg/ |
| InfluenceWatch (Windward) | https://www.influencewatch.org/non-profit/windward-fund/ |
| Pelican State Partners | https://www.pelicanstate.com/about |
| ConnectSafely Supporters | https://connectsafely.org/about-us/supporters/ |
| Source | URL |
|---|---|
| R Street (Opposing SB-142) | https://www.rstreet.org/outreach/testimony-in-opposition-to-utah-senate-bill-142-app-store-accountability-act/ |
| NetChoice (Opposing SB-142) | https://netchoice.org/netchoice-testimony-in-opposition-to-utah-sb-142/ |
| Source | URL |
|---|---|
| DCA PR Newswire Launch | https://www.prnewswire.com/news-releases/over-50-child-advocacy-groups-unite-to-demand-app-store-accountability-302385162.html |
| Meta Political Engagement | https://about.meta.com/facebook-political-engagement/ |
| DOJ Antitrust (John Read) | https://www.justice.gov/atr/case-document/declaration-john-r-read |
| California AB-1043 Text | https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260AB1043 |
| Gov. Newsom Signs AB-1043 | https://www.gov.ca.gov/2025/10/13/governor-newsom-signs-bills-to-further-strengthen-californias-leadership-in-protecting-children-online/ |
| Bloomberg Gov (CA Age Law) | https://news.bgov.com/bloomberg-government-news/california-enacts-google-backed-law-for-app-stores-to-verify-age |
| Business Report (Pelican State Formation) | https://www.businessreport.com/newsletters/lapolitics-roedel-parsons-disbands-members-launch-pelican-state |
This investigation used Claude Code (Anthropic's CLI tool, running Claude Opus) was used as a research assistant for:
Claude Code did not independently choose what to investigate, decide what constitutes a finding, or determine what to publish. Every factual claim in this repository cites a primary source (IRS filing, Senate disclosure, state database, legislative record, or published reporting) that can be independently verified. The tool does not change whether Meta's LD-2 filing lists H.R. 3149, whether DCA has an EIN, or whether Stefanski admitted tech funding under oath. The records exist or they don't.
If you want to verify any finding, the source URLs and database identifiers are provided throughout. Start with the primary records, not with this repository.
This is an OSINT research product. All findings are based on public records. Source data is cited throughout.
"Disabled spending" already happened to the people in the ICC that acted contrary to Trump's diktats[0], without the need for a digital panopticon, both the banks and the government know who you are.
[0] https://www.irishtimes.com/world/us/2025/12/12/its-surreal-u...
That was from a quick search, no doubt there's more. Now it gets down to trust issues on reporting.
Secure Boot is just a technology for those that need it, until Microsoft decides it's mandatory for everyone.
On a spectrum of options, no verification is the least privacy intrusive. Baking it in at the OS level or forcing passport uploads are the most intrusive. My proposal is in the middle.
A determined actor could maybe follow you to the store when you purchase your verification code, take a quick picture with a powerful camera (or bribe the store to do it sneakily) and unmask you online. But there's no way to do it at scale. And if you buy the code from a reseller (ask a panhandler to buy one for you, perhaps) then it's even more robust.
Meanwhile, regular cops have been doing the same awful things that they've always been doing, literally at the command of Democratic mayors who are pompously declaring that they won't enforce immigration law in speeches. They'll send cops to throw your shit into the street when your rent suddenly doubles, and won't report an illegal immigrant felon (whose history we know nothing about) to ICE.
Organized white supremacists are nobodies with no power, they're all over the military, the cops, prison guards, and ICE. Meanwhile, Parchman Farm in Mississippi doesn't even report the people who are dying there, and has plastic all over the floors because the roofs are open to the elements. That's just legal American black people who this country actually owes something to, though. That was trendy like five years ago, it's so over now.
If I get arrested for lying about my age, when I'm of age, then they could probably get me on a whim already anyway. No point in trying to fall in line.
I think there might be a way to make it work, however you would have to be very aware and plan for a way to not reinvent the same losing dynamics. It might not be possible.
Now you obviously shouldn't set social justice aside, and given the choice, I absolutely prefer the capitalist hellscape where my friends and I are not being rounded up and killed, but that's a REMARKABLY low standard I've had to settle on as a voter.
The Democrats and Republicans both are different approaches for the same billionaire class.
They're not "opposite sides of the same coin". Instead, they're more akin to 2 sock puppets. One wears red, and the other blue.
Like the Trump tariffs? They were initially Biden's tariffs that Trump increased and extended. Different clothes, same game.
But I'd be willing to try a good run with democratic socialism, or hell, communism. What we have is the cushy gold-parachute socialism for the elite, and unabashed hardcore capitalism for the poorest. And that fucking sucks. Burn it down.