Dear Debian Developers and Project Members, I am writing as a long-time supporter of Debian and its commitment to freedom, privacy, and open-source principles to raise a concern about a troubling trend gaining ground in the broader tech and legislative landscape: mandatory age verification systems.
As governments in various jurisdictions push legislation requiring age verification for access to online services and software, I want to urge the Debian Project to take a firm and proactive stance against implementing any such mechanisms in future releases of Debian GNU/Linux. My concerns are as follows. First, regarding privacy: age verification inherently requires the collection of sensitive personal data (identity documents, biometrics, or third-party authentication), which puts users at risk of data breaches, surveillance, and profiling. This fundamentally conflicts with Debian's Social Contract and its commitment to its users. Second, on the matter of anonymity and safety: many of Debian's users rely on the system precisely because it does not track or identify them. Activists, journalists, whistleblowers, and people in authoritarian regimes depend on this, and age verification would erode these protections entirely. Third, concerning free software principles: introducing gatekeeping mechanisms into a free and open distribution would set a dangerous precedent, potentially fragmenting the user base and undermining the universality that makes Debian so valuable. Finally, on effectiveness: research consistently shows that age verification systems are trivially circumvented and do little to protect the people they are intended to protect, while imposing real costs on legitimate users. I say this not only in the abstract: as someone who conducts geopolitical research and identifies as LGBT, the prospect of both of those identities being stored in any kind of verification system is deeply concerning to me personally. In many parts of the world, that combination of attributes could make someone a target, and no software distribution should be complicit in creating that kind of risk for its users. I understand that legislative pressure may make this a difficult issue to navigate in some jurisdictions. However, I believe Debian is in a unique and powerful position, as a community-driven, non-commercial project, to resist such mandates and advocate loudly for user rights. I respectfully ask that the Debian Project issue a clear public position opposing age verification requirements, refuse to implement any age-gating mechanisms in the base distribution or official repositories, and collaborate with organizations like the EFF, FSF, and Privacy International to oppose such legislation. Thank you for your continued dedication to building a system that respects its users. I hope this concern receives the consideration it deserves. With respect and gratitude, Kat
