openSUSE "terms of site" raise complaints about age restrictions [LWN.net]

By Joe Brockmeier
May 19, 2026

Many people in the Linux community began using the operating system—and contributing to open source—at a tender age, often well before their 16th birthday. Thus, a recent change in openSUSE's terms of site (ToS) that required users of the project's web site to be "at least 16 years of age or the age of majority" in their jurisdiction has raised objections. The terms have since been modified, though users must still have parental approval to create accounts if they are younger than 16.

Must be 16 or older to enter

The age restriction seems to have been added on March 10, 2026, according to the site's history. The openSUSE site terms stated that using the site, at all, indicates acceptance of the ToS: "If at any time the Terms are no longer acceptable to You, You should immediately cease all use of this web site." Since the restrictions also forbade use by those under 16, the ToS meant that younger users were told not to even read openSUSE documentation, blog posts, etc.

Perhaps someone in SUSE's legal department believed that this language is necessary, and in some way enforceable. In reality, the vast majority of people simply browsing the openSUSE web sites are unlikely to ever see—much less agree to—the ToS unless specifically looking for it.

However, the ToS also covers contributions to openSUSE, use of the Open Build Service, and so forth. It may not affect casual users of openSUSE, but would (if observed) inhibit participating in the openSUSE project in any meaningful way. As written, the ToS did not even allow for users under the age of 16 to read the site with parental permission.

On May 8, Teckids founder and chairperson Dominik George complained on the openSUSE project mailing list about the restriction. He said that he had more than a decade of experience working with digital spaces for children: "That's why I can assure you: There is no legal reason to ban minors."

He also claimed that the new terms were also against openSUSE's code of conduct, which say that the project is "dedicated to providing a positive experience for everyone, regardless of such attributes, (including but not limited to)" a number of factors—including age. George called for the project to revert the change in terms, or at least to reword them so that they were only applicable for creating an account.

Some other Linux projects do have age requirements for creating accounts, though none that I've found attempt to impose age requirements for merely browsing their web sites. The new-account form on Fedora Accounts (which cannot be linked to directly) requires that users attest to being 16 or older; Canonical's terms of service requires that users be 13 or older to create an account, and to have parental permission between the ages of 13 and 18. Debian does not have a centralized account service, but none of its various services that I looked at had an age requirement for creating an account.

Discussion

On May 11, Luboš Kocman replied that he had shared George's feedback with SUSE's legal and data privacy teams. Jeff Mahoney, an openSUSE board member and SUSE employee, said that the age requirement was not requested by the project or openSUSE's board. "There are members of the board (or board-adjacent) who began using Linux at ages younger than 16 and the intention was not to prohibit participation of young people." There was a request, he said, to update the ToS to be "not be quite so US-centric" and that led to a review by SUSE's legal team.

Neal Gompa said that Fedora had needed to raise its minimum age requirement from 13 to 16 in order to comply with the European Union's General Data Protection Regulation (GDPR). There was some extended debate about when parental consent was necessary for users to create an account, or for an entity to collect personally-identifiable information; George said that there was no EU law that required a minimum age for using web sites and later replied that registering an account probably needed consent from a guardian due to contract law, "but not due to restrictions posed by privacy laws".

Patrick Fitzgerald said that he had "speed-read the relevant sections" of the GDPR, and did not think it applied. "I cannot see any legal requirement to discourage younger users. I started using a computer at age 14. Mind you, that was a little bit before the internet was widely available".

After a number of exchanges, George said he was "mostly fine with openSUSE copy-pasting all contract laws of the world into its ToS" as long as there was a way for minors to accept them, presumably with parental consent, though he did not say that explicitly. He would not take that approach, though, "because it's redundant and tedious, unnecessary work." He did acknowledge, though, that "that these considerations are not as trivial in reality".

Rollback

On May 13, Kocman replied to the list to say that the matter was with SUSE legal and that he was reminding them daily. On May 15, Jeff Mahoney provided an update to the list to say that SUSE's legal team had agreed to change the text to the following:

By creating an openSUSE account, you represent that you are at least 16 years of age or the age of digital consent in your jurisdiction. If you are under 16 years of age (or below the applicable age of digital consent in your jurisdiction), you may only create an account with the verifiable consent of your parent or legal guardian. No age requirement applies to general browsing or passive access to publicly available content on this site.

He added that the work was not done: "We don't want to ban contributors under the age of 16 either but we don't have a system in place to handle 'verifiable consent' yet." That, he said, was a legal requirement in the US and EU. He committed to bringing an update to the community when he had something to share.

It will be interesting to see how SUSE approaches "verifiable consent". To show that a parent or guardian has provided consent seems to imply that SUSE will also need to verify (at least some) users' ages. The topic of age attestation and verification has been a controversial topic lately for many reasons; any system that requires users to provide proof of age is likely to be unpopular.

Various governments around the world continue to put laws on the books that, in a variety of ways, push responsibilities onto service providers to put up ineffective safety bumpers to make the Internet "safe" for children. It is hard to see, however, how legal requirements that require age-gating participation in open-source communities makes anyone safer; it only increases the legal liability for open-source projects or their sponsors.

to post comments

It's a shame

Posted May 19, 2026 19:25 UTC (Tue) by jpeisach (subscriber, #181966) [Link] (2 responses)

I am speaking from someone who was on the internet way younger than they should have been (we're talking, like, 8), but if we aren't encouraging people who are young to find their passions and explore it, it is a waste of their time that they could be utilizing during peak brain development stages.

I am so glad I was able to spend my early years finding what I love online. I'm glad when I was 13 I started contributing to Ubuntu. And now my later teenage years (currently 18), I am starting to contribute to the kernel.

But this makes it more tedious for younger, curious people to find the information they seek, and limits the opportunities they have.

If I was not doing the things I've been doing as early as I did, I would not be the person I am today.

It's a shame

Posted May 20, 2026 1:16 UTC (Wed) by mb (subscriber, #50428) [Link] (1 responses)

See? Now you became addicted to it!

Back in my day we didn't do such dangerous things like creating SuSE or Ubuntu accounts.
Like everybody else we did harmless things like smoking cigarettes behind the school gym.
I'm glad that today's youth is protected from the really dangerous stuff such as SuSE accounts. That would surely lead to getting bullied by the cool smoker kids and therefore be really dangerous.

I wouldn't be surprised if the GDPR was one of the most misread and misinterpreted laws out there.
At least here in Germany I am constantly being confronted with "we do this because of GDPR" for things that are obvious BS.
It's just a law that makes for nice, easy and at first glance plausible looking excuses if people or companies do not *want* to do something.

It's a shame

Posted May 21, 2026 11:53 UTC (Thu) by marcH (subscriber, #57642) [Link]

> Back in my day we didn't do such dangerous things like creating SuSE or Ubuntu accounts.
> Like everybody else we did harmless things like smoking cigarettes behind the school gym.

I suspect it wasn't your intention but you summarized the current "screen problem" really well: way too many of today's teenagers don't go out and hangout with friends any more. Before schools started to realize the extent of the issue and finally ban phones on school grounds, they had even stopped talking face to face at recess and lunch time. Obviously, the immense majority of them are not actively contributing to open-source or active in any other way. They are just passively donating their brain time to addictive anti-social networks and they have much fewer real-life relationships. Is this the right price to avoid car crashes, drugs, STDs and other risks in real life? Not sure. For sure screen addiction is solving earth overpopulation at an amazing speed. Too fast in fact. Even better for the environment: the richer the country, the faster its births are plummeting.

Of course this is all true for way too many adults too! But adults are in theory supposed to take care of themselves, their brain is not (supposed to be) developing anymore. Also, the majority of adults don't want evil regulations to protect them from themselves and no one cares when they die by the millions. Only children draw tears.

Open-source is just collateral damage and a minuscule rounding error in this much greater "age of consent" debate. Please don't forget that.

Better off keeping it vague

Posted May 19, 2026 20:29 UTC (Tue) by kleptog (subscriber, #1183) [Link] (11 responses)

> If you are under 16 years of age (or below the applicable age of digital consent in your jurisdiction), you may only create an account with the verifiable consent of your parent or legal guardian.

It's true that a person under-16 (country dependant) cannot consent to having their data processed under the GDPR. But this is only an issue if OpenSUSE is collecting data that requires giving consent. Just creating an account isn't enough. Even contributing doesn't require processing any personal information so it's not clear what exactly they're aiming at.

And saying things like:

> with the verifiable consent of your parent or legal guardian

is likely to increase your burden since you now have to collect personal information on the parents too. In this situation you're better off staying vague (for EU regulations anyway, other countries may require the opposite). As long as your site isn't targetting minors, you don't have to do anything special (otherwise every site on the internet would need to check this and that would be absurd and counterproductive.)

Better off keeping it vague

Posted May 20, 2026 6:44 UTC (Wed) by epa (subscriber, #39769) [Link] (10 responses)

I thought the definition of personal information was interpreted quite broadly, so that even an email address can’t be stored without consent.

Better off keeping it vague

Posted May 20, 2026 7:39 UTC (Wed) by natureshadow (subscriber, #123294) [Link] (3 responses)

Yes, e-mail addresses, and all other pseudonyms, are personal information.

Personal information can generally (under GDPR) be processed and stored without any consent at all of the processing or storage is necessary for a particular purpose intended by the subject.

Hence, if your service is granting authenticated access to a collaboration platform, and it is very reasonable to use an e-mail address for account management or authentication, no consent is needed to handle it, and no age restriction is imposed (by GDPR).

Better off keeping it vague

Posted May 20, 2026 10:13 UTC (Wed) by epa (subscriber, #39769) [Link] (2 responses)

Your comment and others talk about what is reasonable or necessary. And I agree, this seems like common sense. But it's a point of view, and not stated explicitly in the statute. I would not be surprised if a company's legal&compliance department decides that it's safer to just forbid storage of email addresses.

This kind of came up in relation to kernel development using Bugzilla, see <https://lkml.org/lkml/2024/11/13/517>. And yes, there were different viewpoints about whether the user could reasonably have expected their email address to be disclosed publicly, having filed bugs on a public tracker. Which is kind of my point -- you get into the position of making arguments in response to a GDPR complaint, when you wanted to have certainty and be able to get on with real work.

Better off keeping it vague

Posted May 20, 2026 16:06 UTC (Wed) by kleptog (subscriber, #1183) [Link] (1 responses)

> Your comment and others talk about what is reasonable or necessary. And I agree, this seems like common sense. But it's a point of view, and not stated explicitly in the statute. I would not be surprised if a company's legal&compliance department decides that it's safer to just forbid storage of email addresses.

It is in statute: this is classic GDPR Article 6.1(f) "legitimate interest" [1]. You need to be able to communicate with the users and email is the normal way to do that.

> This kind of came up in relation to kernel development using Bugzilla, [snip]

This is completely different. The email address is an intrinsic part of email so an email archive needs to store it. The discussion there is: do you need to display the email to anyone viewing the archive? I think you can argue it either way. The usual solution is to let people use nicknames and don't show the email address anywhere.

I remember a story in the early days of the GDPR that people, especially from states with recent authoritarian experience, were asking where the checklist was that they could use to determine if something was covered of not. There isn't such a checklist and that is deliberate. You as a data processor need do your own balancing of all the different requirements from different angles and make a choice. And you need to be transparent about it.

If your legal department has found to way to reduce the amount of data they store while still maintaining their service, then I guess the goal of the GDPR has been achieved.

In the particular case of archives there is the guidance from the European Archive Group[1]. They point out that the integrity of public archives can be more important than the minimisation of personal data.

You have the paradox that minors cannot consent to the processing of their personal data, but knowing they are a minor is itself personal data which you can't process. The only way out is to not ask and don't do anything that requires explicit consent.

[1] https://eur-lex.europa.eu/eli/reg/2016/679/oj#art_6
[2] https://www.concernedhistorians.org/content_files/file/et...

Better off keeping it vague

Posted May 21, 2026 13:24 UTC (Thu) by Wol (subscriber, #4433) [Link]

> > Your comment and others talk about what is reasonable or necessary. And I agree, this seems like common sense. But it's a point of view, and not stated explicitly in the statute. I would not be surprised if a company's legal&compliance department decides that it's safer to just forbid storage of email addresses.

> It is in statute: this is classic GDPR Article 6.1(f) "legitimate interest" [1]. You need to be able to communicate with the users and email is the normal way to do that.

The thing is, there's nothing stopping you seeking to collect and store as much PII as you like, *as long as* you abide by the rules! I work as an analyst for an online retailer, I'm also a volunteer for a charity maintaining a (e- and snail- mail) mailing list. As such I'm subjected to a lot of compulsory training, including GDPR.

And as I see it, PII falls into two categories. If you can come up with a *good* answer to the question "Why do you *need* this info?", you can collect it no problem. That "are you 16?" question - you need to know the answer in order to comply with the law - you can collect it no problem. But if SUSE say wanted to know our home address - why? - they need to get *informed* consent to collect it unless they're mailing us a DVD or something. (Like SuSE did to me many moons ago :-)

The other thing about informed consent is it has to be voluntary - "we won't do business without it" can NOT be informed consent, but with informed consent you can collect anything you like. You can think up any excuse you like, and if the customer buys it, no problem (unless, of course, you fall foul of "but it wasn't informed consent, the detail was in a filing cabinet behind a locked door with a sign saying "beware of the leopard", on Alpha Centauri").

The corollary of collection, of course, is storage and processing. You are allowed to keep it for as long as you *need* it, or the subject's permission lasts. And you must keep it safe, and dispose of it as soon as whichever of those conditions ceases to apply. That "I am a minor" reply? You can process it, your web server responds "I'm sorry you're under age, go away", AND YOU DELETE ALL TRACE OF ANY PII.

Part of the trouble, I believe, is what has been pointed out before. American law says what you must do, American lawyers want to be able to tick off a list that says "we followed procedure" (past tense). European law is much more involved with results, we have a "do our procedures achieve the desired aim" (current tense) mindset.

The correct approach to the GDPR is (1) Are we asking for more information than we need? If so, (2) are we making sure we get permission? (3) EVERY time it is accessed, is it for necessary purposes, or within the subject's grant of consent? And (4) are we running cleanup processes regularly to get rid of stuff we no longer need? Everything there is present tense, anathema to an American lawyer. But really, it's not hard, and if you're up-front and honest about what you're doing you'll find it hard to go wrong. Secondly, the chances are the regulator will come around and have a quiet, off-the-record chat and give you a decent opportunity to put things right, but firstly the chances are your customers will put you on the straight and narrow pretty quickly! Just don't give the regulator the impression he's being played. Things can get nasty pretty quick. The law is intentionally vague to make it easy to catch "breaking the spirit of the law". But it plays the other way too - the regulator won't go for someone trying to play fair, because it's too easy for the Judge to let them off.

(And (2) includes implied permission - if they *choose* to interact with our services, I won't say that authorises *everything*, but it's hard for them to argue they didn't agree to the server showing their posts to all and sundry, for example - that's what servers do!)

(Just note how I worded (3) - that includes unauthorised access! So you just don't allow unauthorised access :-)

Cheers,
Wol

Better off keeping it vague

Posted May 20, 2026 7:39 UTC (Wed) by anselm (subscriber, #2796) [Link]

I thought the definition of personal information was interpreted quite broadly, so that even an email address can’t be stored without consent.

Consent is only one of a number of available justifications for storing personal information. It may well be possible that storing an email address is a matter of operational necessity, which is another available justification. E.g., if you're running an email distribution list, you have to have email addresses for your subscribers on file in order to be able to send them list messages by email, so this is a technical precondition rather than an optional thing that a subscriber might want to consent to or not.

One could argue that subscribing to the list in the first place is an expression of consent, but once someone says that they wish to subscribe to the list (an abstract desire), putting their email address into the membership database (an implementation detail) becomes a matter of operational necessity on the part of the list operator for as long as the person remains a subscriber. Conversely, if a person tells the list operator at some point that they no longer consent to having their email address stored, they're of course perfectly entitled to do that but it means they will effectively unsubscribe from the list.

Better off keeping it vague

Posted May 20, 2026 7:42 UTC (Wed) by elaforma (subscriber, #165356) [Link] (4 responses)

An e-mail address is absolutely personal information, but if you have a good enough reason (and "it's really, actually necessary for the thing you're trying to do" -- as opposed to "necessary to support our business model" -- is generally good enough), you don't need anybody's consent.

Better off keeping it vague

Posted May 20, 2026 10:33 UTC (Wed) by ballombe (subscriber, #9523) [Link]

It is relatively easy to have lot of email addresses to use for different purpose.
In that sense, it is much less personal than, say, your first name.

Better off keeping it vague

Posted May 22, 2026 7:02 UTC (Fri) by milesrout (guest, #126894) [Link] (2 responses)

Whatever legal fictions have been created saying that it is, outside of those legal fictions it doesn't make any sense to say that an email address is "private". People publish their email addresses all over the place and it's inherent in the concept of an address that they're public.

The undemocratic expansion of "privacy" as a concept to cover things that are not private and have never been private needs to stop.

Better off keeping it vague

Posted May 22, 2026 7:15 UTC (Fri) by elaforma (subscriber, #165356) [Link]

It's not private, it's personal. Just like your phone number, street address, or date of birth, it is specifc to you, and therefore (under GDPR) yours (and not anybody else's) to dispose of.

Better off keeping it vague

Posted May 22, 2026 9:37 UTC (Fri) by kleptog (subscriber, #1183) [Link]

As elaforma pointed out, personal data is not necessarily private. And email addresses are a good example.

If you email someone it includes your email address obviously. You don't need to ask for permission to store that since it's perfectly expected that when someone sends an email the address is in there. A git repo includes an email address in every commit. If you host git repositories, then you don't need to ask for permission to pass on that info since you can assume that by pushing a commit the user consented to it going wherever the repo gets cloned to. That's just how git works.

If you clone a git repository and then start harvesting those emails to sell on to advertisers so they can start spamming, then you need to ask permission since that's not an obvious use-case for the email address in a git repository. An interesting case is a git commit to a repo that was clearly described as being private, but then at a later date someone decides to push it publicly. The person doing that would have to weigh up the pro and cons to decide if it's a valid case to do without explicit consent.

As for undemocratic: by now dozens of democratic countries around the world have enacted provisions along similar lines, so I don't see how you can claim it's undemocratic. I do still see a lot of people misunderstanding it though. (And it does seem that some of the US versions of the legislation miss the necessary nuances.)

Is your age restriction really necessary?

Posted May 21, 2026 8:56 UTC (Thu) by jimbo (subscriber, #6689) [Link]

Having celebrated my 16th birthday 50 times and counting, I question the idea of age-restriction for a site focussed on creating great computer systems.

Young minds can be a fertile source of great ideas - why should they wait until they've been round the Sun another 2 years - or longer for the more precocious talents out there?

Under 10

Posted May 22, 2026 6:59 UTC (Fri) by milesrout (guest, #126894) [Link]

I believe I still have a tshirt somewhere from an Installfest I attended when I was 8 or 9 years old.

No reason to ban young people from viewing a website about Linux. Keep kids off social media, but a Linux website is not social media.