Griffin Linux — Official Position Statement
Age Verification, Linux, and Why Griffin Won’t Comply
Griffin Linux is a solo project built to make Linux accessible to everyday Windows users. It is still alive, still growing, and will not bend to age-verification mandates for reasons that are both technical and principled.
Bobby Comet — Griffin LinuxApril 2026Final Position Statement
First: the project lives on
Griffin Linux is not going anywhere. This is a solo project built and maintained by me, Bobby Comet, and it continues to be developed, refined, and will be distributed as a free and open Linux distribution based on Kubuntu later this year. Griffin’s goal has always been to lower the barrier for people making the switch from Windows: familiar workflows, a polished desktop experience, and tools that just work, all without giving up the freedoms that make Linux what it is. That mission has not changed.
What I want to address here is a question that has been weighing on me as age verification laws continue to spread: what do they mean for Griffin, and where does this project stand? The answer is detailed below, and it is final.
What Griffin is, and how it is distributed
Griffin is Kubuntu at its core, with a layer of tools, configurations, and design choices on top that make the Linux desktop feel more immediately familiar to someone coming from Windows. It ships as an ISO image, a single file you download, write to a USB drive, and boot. That’s it. No account. No subscription. No server handshake.
The ISO will be hosted wherever I determine gives the best options for distribution and, if necessary, geo-blocking. That could be a dedicated website, a specific page, or another platform. I will make that call based on what gives me the most control over access if a legal situation ever demands action. Torrent downloads and source code will remain available through their existing channels regardless, as those are decentralized by nature and outside the scope of any regional compliance demand.
Additionally, all Griffin tools will be made available for other distributions in the Ubuntu family. Some tools are more distro-agnostic than others, but the goal is that users on Ubuntu, Linux Mint, Pop!_OS, and similar systems can access the Griffin experience and toolset even if they are not running Griffin itself. Linux is Linux; the desktop should be for everyone.
Why age verification cannot work on Linux
Linux is not a product with a managed distribution pipeline. It is not an app store, a walled garden, or a platform with a central authentication layer. Griffin is an ISO image, a static file. Anyone with an internet connection can download it, verify its integrity with a checksum, and run it. There is no account creation, no runtime connection back to my servers, and no gatekeeper that could realistically demand proof of age.
Why enforcement is structurally impossible on a Linux distribution
✕
No central gatekeeper. An ISO can be mirrored anywhere in the world. Blocking one download source does nothing when torrents and mirrors exist independently.
✕
No user accounts at download. Linux requires no registration to obtain or install. There is no checkpoint at which to request identification.
✕
Open source means forkable. Any verification gate added to Linux and, by proxy, Griffin could be removed by any developer and the project re-released under the same open license within hours.
✕
ISOs have no runtime server connection. Once installed, Linux has no mandatory connection back to any server. There is nothing to “check in” with for ongoing compliance.
✓
This is by design. The open architecture of Linux is what makes it trustworthy, auditable, and free. Griffin is Linux at heart, and will stay that way.
Age verification for a Linux distribution is not a policy question with a technical solution. It is a technical impossibility. The architecture does not accommodate it, and attempting to bolt one on would undermine the entire value proposition of open-source software.
Why demanding government IDs is dangerous — with evidence
Even setting aside Linux entirely, the mechanism these laws mandate, submitting government-issued identification to access online content, creates massive, centralized databases of the most sensitive personal data imaginable. This is not a theoretical risk. It has already happened multiple times, and the pattern is consistent: collect IDs, get breached, expose everyone.
⚠ Breach: Discord, October 2025
Hackers compromised a third-party support provider used by Discord, stealing approximately 70,000 images of government-issued IDs along with names, email addresses, IP addresses, and billing metadata. Discord had collected this data to comply with the UK’s Online Safety Act age verification requirements. The company had explicitly stated it did not permanently store identity documents. The breach showed those assurances meant nothing once the data was in a third party’s hands.
Sources: Proton.me, Electronic Frontier Foundation — Oct–Dec 2025
⚠ Breach: AU10TIX identity verification, 2024
AU10TIX, a major identity verification company used by platforms including Uber and TikTok, left login credentials exposed online for more than a year. A researcher gained access to data, including users’ names, dates of birth, nationalities, ID numbers, and images of identity documents, the exact records users had uploaded to prove their ages.
Source: Electronic Frontier Foundation / 404 Media, 2024
⚠ Systemic risk: Persona, 2026
After the Discord breach, Discord contracted Persona as its new age verification provider. Security researchers subsequently found Persona’s systems accessible via a U.S. government-authorized server. The pattern is clear: the age verification industry creates new attack surfaces faster than it secures old ones.
Source: Techdirt, February 2026
The Electronic Frontier Foundation has stated that online age verification is incompatible with privacy, and that data breaches in this space will expose not just personal data but also information about which sites a user visits. Texas’s own law prohibits retaining verification data after the process is complete, but as the Discord breach demonstrated, regulators have no real power to enforce deletion once data exists in a third party’s system.
When the Supreme Court upheld Texas HB 1181 in a 6–3 ruling in June 2025, Justice Kagan’s dissent specifically raised the chilling effect of forcing users to self-identify to access legal content, and the real-world privacy risks that follow. The majority compared submitting a government ID online to showing a driver’s license at a liquor store. The difference is that the liquor store does not store your ID in a database accessible to hackers operating from the other side of the world.
What the data breach actually means for you
A leaked government ID is not like a leaked password that you can reset. It enables identity theft, financial fraud, synthetic identity creation, and, when combined with AI tools, sophisticated impersonation and sextortion attacks. Users have no choice but to submit their data to multiple platforms under these laws, so the risk compounds with every mandate that passes and every site that complies. The criminals who benefit most from age verification laws are the ones who build markets supplying stolen or fake IDs to get around them.
Griffin’s position: final and not subject to negotiation
Griffin Linux will not implement age verification. It cannot, for the technical reasons above. It should not, for the privacy and security reasons above. And as a solo developer, I am not willing to compromise the open nature of this project or put my users’ data at risk to satisfy a mandate that does not translate to how Linux works.
If specific regions attempt to legally compel compliance, my response is straightforward: those regions will be geo-blocked from accessing Griffin’s official download. I will retain the ability to implement this at the hosting level, which is one of the factors that will guide where the ISO is ultimately hosted. I will not collect identification. I will not hand data to third-party verifiers. I will not build a database of user identities that can be stolen, sold, or subpoenaed.
Torrent downloads and source code remain unaffected by any regional block, as they are decentralized by nature. Users in blocked regions who wish to run Griffin can obtain it through those channels or via VPN, both of which are entirely legal to use and entirely outside my control, as they should be. This is how open-source software has always navigated political barriers.
Final stance — April 2026This is Griffin Linux’s definitive position on age verification. It will not be revisited unless a meaningful shift in the legal landscape occurs that materially changes the situation, and any such development will be addressed openly at that time. Until then, this statement stands as written.
The bottom line
Griffin Linux is alive and being actively developed by me, Bobby Comet. The goal, making Linux accessible to people switching from Windows, while keeping it Linux at heart, has not changed.
Age verification on a Linux distribution is architecturally impossible and ethically indefensible given the demonstrated pattern of breaches that follow these mandates everywhere they are imposed.
Griffin tools will remain available for the broader Ubuntu family, so anyone can get the Griffin experience regardless of which distro they run. The ISO will be hosted where it gives me the best control. Torrents and source code stay decentralized and open.
Regions that try to force compliance will be geo-blocked from the official servers. I will not be collecting your ID. That is not negotiable, and it is not changing.
— Bobby Comet, Griffin Linux