System76, the Linux hardware company, just took a public stance against mandatory age verification schemes. Their argument is simple: you can't verify someone's age online without building a surveillance infrastructure that will inevitably be abused.
They're right. And the fact that a hardware company is saying this while most of Big Tech stays silent tells you everything about the current state of corporate courage.
The age verification trap
The political pitch is always the same: "protect the children." Nobody argues against protecting kids. That's the point. It's a framing that makes opposition politically toxic.
But the implementation details matter. Every age verification system proposed so far requires one of two things: uploading government ID to every website you visit, or a centralized identity verification service that tracks which sites you access.
Both options create massive privacy risks. Government ID uploads create honeypots for identity theft. Centralized verification creates a browsing history database that governments, hackers, and data brokers would kill to access.
The UK tried this in 2019. They abandoned it because the privacy implications were unsolvable. Australia is pushing forward with it anyway. Several US states have passed their own versions. The technical problems haven't been solved. The laws passed anyway.
Why System76's stance matters
System76 is a ~200 person company selling Linux laptops and desktops. They don't have a lobbying operation. They don't have a policy team. They're taking a public position on a politically charged issue because their leadership believes it's the right thing to do.
Compare that to companies with actual policy teams. Google has thousands of people in government relations. Apple markets itself on privacy. Microsoft talks about responsible technology. Where are their public statements opposing age verification mandates?
They're quiet because opposing age verification can be spun as "not caring about children." And public companies optimize for not being in negative headlines, not for being right.
System76 doesn't have that constraint. They serve a customer base that self-selects for caring about privacy and digital freedom. Their stance is authentic to their brand and their users. It's also just correct on the merits.
The technical reality
I've looked at every major age verification proposal. None of them work without creating worse problems than they solve.
Digital ID verification: requires sharing government identity documents with third-party services for every age-gated site. One breach exposes millions of IDs linked to browsing histories.
Device-level verification: requires your phone or OS to attest your age to websites. This means your device manufacturer becomes a gatekeeper for internet access. Apple and Google would love this, which should concern you.
Third-party age estimation: uses facial analysis to guess your age from a webcam. Accuracy is terrible for anyone between 16 and 25. Also normalizes mandatory facial scanning to access websites. No thanks.
Blockchain/zero-knowledge proofs: the technically elegant solution. You prove you're over 18 without revealing your identity. Sounds great in a whitepaper. In practice, someone still needs to verify your age initially and issue the credential. That initial verification has all the same problems.
What I want to see
More companies taking System76's position. Not because age verification is a perfect political winner, but because the technical community has an obligation to explain why these proposals don't work.
Politicians aren't engineers. They hear "verify age online" and think it's like checking ID at a bar. We know it's not. We know the infrastructure required. We know the risks.
If we don't say it publicly, who will?
System76 said it. I'm saying it. Age verification mandates are surveillance infrastructure disguised as child safety. The tradeoff is not worth it, and the people who understand the technology have a responsibility to make that case.