A bill introduced by Representative Josh Gottheimer in the House on April 13 would require Apple, Google, and every other operating system vendor to verify the age of anyone setting up a new device in the United States.
The legislation, H.R. 8250, travels under the friendlier name of the Parents Decide Act, and it is among the most aggressive surveillance mandates ever proposed for American consumer technology.
We obtained a copy of the bill for you here.
The press releases describing it lead with children. The text describes something much larger. To confirm a child is under 18, the system has to identify everyone else, too, and the bill builds the infrastructure to do exactly that.
Reclaim Your Digital Freedom.
Get unfiltered coverage of surveillance, censorship, and the technology threatening your civil liberties.
This is child safety as a delivery mechanism for mass identification. The pattern is familiar by now. A genuine harm gets named, a sympathetic victim gets centered, and the solution proposed reshapes the digital lives of three hundred million people who were not the problem.
The Parents Decide Act follows that template with unusual precision. It takes the real suffering of real children and uses it to justify building a national identity layer underneath every device sold in the country, administered by two private companies, with the details to be filled in later.
The mandate sits in Section 2(a)(1), which obligates providers to “Require any user of the operating system to provide the date of birth of the user” both to set up an account and to use the device at all. Adults included.
There is no carve-out for grown users, no opt-out for people who simply want to turn on a phone without handing a date of birth to Apple or Google first.
The age check is the entry fee for owning a computer. What happens to that data afterward gets handed off to the Federal Trade Commission to sort out later. A federal bill that mandates identification as a condition of using a general-purpose computing device represents something the United States has not previously had, which is a national ID requirement for turning on a device.
Gottheimer framed the proposal at a Ridgewood news conference on April 2, standing outside the local YMCA with a coalition of allies. “With each passing day, the internet is becoming more and more treacherous for our kids. We’re not just talking about social media anymore — we’re talking about artificial intelligence and platforms that are shaping how our kids think, feel, and act, often without any real guardrails,” he said.
His diagnosis of the current system is accurate enough. “Children are able to bypass age requirements by entering a different birthday and accessing apps without any real verification. Kids can bypass age requirements by simply typing in a different birthday. That’s it. That’s the system,” he said.
The remedy he proposes just happens to require building new surveillance plumbing underneath every device sold in the country, and routing that plumbing through two of the largest companies on earth. The solution chosen is disproportionate to the problem, and disproportionate in a specific direction, which is the direction of less privacy and less anonymity for everyone.
Section 2(a)(3) directs operating system providers to “Develop a system to allow an app developer to access any information as is necessary” to verify a user’s age.
Translated out of legislative prose, Apple and Google become age brokers for the entire American app ecosystem. Every app that wants to check whether you are over 18, or over 13, or over 21, will be able to ping the operating system for an answer derived from the birth date you handed over at setup. The bill presents this as a convenience. It is a new data pipeline between the OS layer and every developer who plugs into it, and the bill spends remarkably little time explaining how that pipeline will be constrained.
Free speech implications travel through that same pipeline. Once the operating system knows your age with verified certainty, it can tell any app to deliver, restrict, or withhold content accordingly. The bill’s supporters describe this as parental control. The infrastructure it builds is a content control system, running at the OS level, with Apple and Google as the gatekeepers of who sees what.
The First Amendment has historically protected the right to read, watch, and speak without first presenting identification. This bill erodes that principle at its foundation. Once verified age becomes a standard signal flowing from the operating system to every app, the default assumption shifts. Users are no longer presumptively anonymous adults with full access to lawful content. They are identified subjects whose permissions are determined by the data Apple or Google holds about them.
An age-verification layer built to block AI chatbots from minors is also capable of blocking journalism a state deems too violent, political commentary an administration deems too inflammatory, reporting on drugs or protest tactics, or any other subject a future regulator decides requires age gating.
The infrastructure is neutral about content. It cares only that the user has been identified. Every future fight over what Americans are allowed to see online will start from a position where the identification layer already exists, and the only remaining question is who qualifies for access. That is a profound change in how speech works, and the bill enacts it while pointing at children.
What the bill says about data protection is effectively a to-do list for the FTC. Section 2(d)(1)(B) tells the Commission it must eventually issue rules ensuring that birth dates are “collected in a secure manner to maintain the privacy of the user” and are “not stolen or breached.”
Those are outcomes, not mechanisms. The legislation sets no retention limits, no minimization requirements, no restrictions on secondary uses, and no prohibition on linking age data to other identifiers Apple and Google already hold. It offers no guidance on how providers should verify the age of a parent or guardian beyond instructing the FTC to figure that out within 180 days of enactment. The entire architecture of the system is to be drawn up after the fact by regulators working under a safe-harbor provision that shields operating system providers from liability as long as they follow whatever rules eventually emerge.
Congress is being asked to authorize a surveillance system it has not designed, whose operation it does not understand, and whose safeguards do not yet exist.
The Parents Decide Act solves the self-reported-birthday problem by demanding something verifiable, which in practice means a government ID, a credit card, a biometric scan, or some combination.
However, Gottheimer has not specified which. The bill does not either. It’s up to the FTC to decide.
Operating system providers will, and the incentives point toward whatever is cheapest to deploy at scale. Facial analysis is cheap. ID uploads are cheap. What is expensive is building a verification system that does not also create a persistent, cross-referenced database of everyone who has ever activated a phone. The incentives run directly against user privacy, and the bill provides no meaningful counterweight.
The bill also deputizes a duopoly. Requiring “operating system providers” to perform nationwide age verification is a requirement only two companies can easily satisfy in the mobile space, and a handful more across desktop and console platforms.
Smaller OS developers, open-source projects, Linux distributions, custom Android forks, privacy-focused alternatives, all face a compliance burden designed around the assumption that the provider is a trillion-dollar firm with legal staff and biometric-scanning partnerships already in place.
The safe harbor in Section 2(b) protects providers who follow the rules, but following the rules requires infrastructure only the incumbents can build. A law nominally aimed at tech companies entrenches the two tech companies most responsible for the status quo.
Apple and Google become the mandatory identity checkpoints for every app developer in the country, which is a commercial position worth a great deal of money and a great deal of leverage. Any future competitor that wants to build a privacy-respecting operating system will discover the law has made that effectively illegal.
There is also another change buried in the text. The definition of “operating system” in Section 2(g)(4) covers “software that supports the basic functions of a computer, mobile device, or any other general purpose computing device.” That language reaches well beyond phones and tablets.
Laptops run operating systems. Desktop computers run operating systems. Gaming consoles, smart TVs, cars with infotainment software, and a growing catalog of ambient devices all qualify under a plain reading of the definition. The bill does not distinguish between the family iPad and the laptop a college student uses for coursework. Every device with an OS becomes a device that verifies age at setup, and by extension, a device that identifies its user at setup. The scope creep is built into the definitions.
Gottheimer cited cases of teenagers allegedly harmed by AI chatbots and by algorithmically promoted content about self-harm.
What the bill does with those harms is use them as justification for an identity system that applies to every user. The template is consistent: a child is hurt, legislation is drafted, the legislation reshapes the digital environment of everyone, child and adult, subject and bystander alike.
Less invasive alternatives exist and have existed for years.
Device-level parental controls already ship with iOS and Android. Family Sharing and Google Family Link already let parents configure age-appropriate restrictions. App stores already allow per-app age ratings.
None of these require every user in the country to prove their age to Apple or Google when turning on a phone. The bill skips past those options in favor of a mandate that treats universal age verification as the baseline condition of device ownership.
Protecting children does not require building any of this. The bill’s authors chose to build it anyway, and the choice tells you what the bill is actually for.
