When a code editor buries a minimum age requirement deep in its terms of service, most users scroll past without a second thought. But Zed Industries’ eligibility clause—stating that users must be at least 13 years old, or the minimum age required in their country to consent to the service—has become an unlikely flashpoint in a much larger debate over age verification, platform liability, and who gets to use the open internet.
The provision, found in Section 21 of Zed’s Terms of Service, reads in part: “You must be at least 13 years old to use the Services. If you are under 18, you must have your parent or legal guardian’s permission to use the Services.” The language is standard boilerplate for American technology companies, drawn from the Children’s Online Privacy Protection Act (COPPA), which has governed the collection of data from children under 13 since 1998. But what was once a straightforward compliance measure is now entangled in a web of new state laws, proposed federal legislation, and international regulatory pressure that threatens to reshape how every software provider—from social media giants to developer tool startups—interacts with its users.
Why a Code Editor’s Terms of Service Matter More Than You Think
Zed is a high-performance, open-source code editor built in Rust, designed for professional developers and teams. Its user base skews heavily toward adults. Yet the company still felt compelled to include an age eligibility clause, a reflection of the legal environment facing any company that offers an online service, collects user data, or provides cloud-based features. Zed’s terms also specify that by using the service, users represent that they meet these age requirements and that, if under 18, they have parental consent. The clause is not unique to Zed; nearly identical language appears in the terms of service for GitHub, Visual Studio Code, JetBrains products, and scores of other developer-focused platforms.
What makes the current moment different is the speed at which legislatures are moving to impose new obligations on software providers. In the United States alone, more than a dozen states have passed or are considering laws that go far beyond COPPA’s original framework, requiring platforms to verify the ages of their users through government-issued identification, biometric scans, or third-party verification services. The implications extend well beyond social media. Any service that collects data, offers accounts, or provides interactive features could find itself in the crosshairs.
California’s AB 3030 and the Expanding Regulatory Net
As WebProNews previously reported, California’s AB 3030 has sparked intense controversy by proposing age verification requirements that could apply to a sweeping range of online services. The bill, which targets platforms that host content deemed harmful to minors, has drawn criticism from civil liberties organizations, open-source advocates, and technology companies alike. Critics argue that the law’s broad language could ensnare not just social media platforms but also Linux distribution repositories, code hosting services, and even developer tools like Zed that offer any form of online interaction.
The concern is not hypothetical. Under AB 3030’s framework, any service that allows user-generated content or provides access to material that could be classified as harmful to minors may be required to implement age verification. For a code editor with collaborative features, cloud syncing, or an integrated chat function, the line between a regulated platform and an exempt tool is far from clear. The law’s critics have pointed out that requiring age verification for such services would impose significant costs, create privacy risks, and potentially exclude entire categories of users—including young developers who rely on open-source tools to learn programming.
The Federal Push: COPPA 2.0 and the Kids Online Safety Act
The pressure is not coming from states alone. At the federal level, the proposed COPPA 2.0 legislation would raise the age threshold for data collection consent from 13 to 16, a change that would force companies like Zed to update their terms of service and, potentially, implement new verification mechanisms. The Kids Online Safety Act (KOSA), which passed the U.S. Senate in 2024 with broad bipartisan support, would impose a “duty of care” on platforms to prevent harm to minors, including requirements for age verification and content filtering. According to reporting by the Electronic Frontier Foundation, KOSA’s vague language could lead to widespread censorship and surveillance, as platforms rush to comply by restricting access and collecting more personal data.
For developer tool companies, the stakes are high. Zed’s terms of service currently rely on self-declaration—users affirm that they meet the age requirement, and the company takes them at their word. This approach, while common, may not satisfy the more aggressive verification standards being proposed in new legislation. If COPPA 2.0 or KOSA become law, companies that currently rely on self-attestation could be forced to adopt third-party age verification systems, collect government-issued identification, or implement biometric checks. Each of these options carries significant privacy and security risks, particularly for a company whose users are developers—a population that is acutely sensitive to surveillance and data collection.
International Pressures and the Patchwork Problem
The regulatory pressure is not confined to the United States. The European Union’s Digital Services Act (DSA) and the United Kingdom’s Online Safety Act both impose obligations on platforms to protect minors, with enforcement mechanisms that can include substantial fines. Australia has moved aggressively as well; in late 2024, the Australian government passed legislation banning children under 16 from social media platforms entirely, with age verification requirements that apply to a broad range of online services. As reported by BBC News, the Australian law has prompted significant debate about the feasibility and privacy implications of large-scale age verification.
For companies like Zed that operate globally, the result is a patchwork of conflicting requirements. Zed’s terms of service reference “the minimum age required in your country,” an acknowledgment that the legal threshold varies by jurisdiction. In the EU, the General Data Protection Regulation (GDPR) sets the age of digital consent at 16 by default, though individual member states can lower it to as young as 13. In South Korea, the threshold is 14. In Brazil, it is 12 under certain conditions. Complying with all of these regimes simultaneously is a logistical and legal challenge that grows more complex with each new law.
Open Source and the Age Verification Paradox
The tension between age verification laws and open-source software is particularly acute. Zed is open source; its code is freely available on GitHub, and anyone can download, modify, and use it. The terms of service, including the age eligibility clause, apply to Zed’s hosted services—its cloud features, account system, and collaborative tools. But the underlying software itself is distributed under an open-source license that imposes no age restriction. This creates a paradox: a 12-year-old can freely download and compile Zed from source, but may be legally barred from creating an account to use its cloud features.
This paradox is not unique to Zed. As WebProNews noted in its coverage of AB 3030, Linux distributions and open-source projects face similar dilemmas. Many open-source communities operate on a model of radical openness, where anyone—regardless of age—can contribute code, file bug reports, and participate in discussions. Imposing age verification on these communities would fundamentally alter their character and could discourage the next generation of developers from participating in open-source projects.
The Privacy Trade-Off That No One Wants to Make
At the heart of the debate is a fundamental tension between protecting children and preserving privacy. Age verification systems, by their nature, require the collection of sensitive personal information. Government-issued IDs can be forged, leaked, or misused. Biometric scans raise civil liberties concerns. Third-party verification services introduce new intermediaries with access to user data. For a company like Zed, whose users are developers building software for sensitive applications, the prospect of collecting and storing identity documents is fraught with risk.
The Electronic Frontier Foundation has been among the most vocal critics of mandatory age verification, arguing that such systems inevitably lead to broader surveillance and data collection. In a detailed analysis of KOSA, the organization warned that age verification requirements would “effectively require all users, including adults, to submit to identity checks,” undermining the privacy of everyone who uses the internet. The argument resonates strongly in the developer community, where pseudonymity and minimal data collection are deeply held values.
What Comes Next for Software Companies and Their Users
Zed’s age eligibility clause is a small piece of a much larger puzzle. As state, federal, and international regulators push for stricter age verification, every software company—from the largest cloud providers to the smallest open-source projects—will need to reckon with the legal, technical, and ethical implications. The current approach of self-attestation, where users simply check a box or agree to a terms of service clause, is increasingly seen as insufficient by lawmakers. But the alternatives are expensive, privacy-invasive, and technically challenging.
For now, Zed’s terms of service represent the status quo: a good-faith effort to comply with existing law while minimizing the burden on users. Whether that approach will survive the coming wave of legislation remains to be seen. What is clear is that the debate over age verification is no longer confined to social media. It has reached the tools that developers use to build the internet itself, and the decisions made in the next few years will shape the relationship between software, privacy, and regulation for a generation.
WebProNews is an iEntry Publication