[Feature] Reject User Registration Below (Predefined) Age #4560

New Issue

GiteaMirror · 2025-11-02T05:54:37-06:00

GiteaMirror commented

2025-11-02 05:54:37 -06:00

Originally created by @bagasme on GitHub (Dec 28, 2019).

Description

Currently Gitea accepts user registration for any age. As #8353 will add Terms of Service, we will now require users registers at age 13 or older. The age will be calculated using date of birth entered when an user register to Gitea. Gitea should reject users which their age are under 13, during registration.

Existing users must be prompted to add their date of birth. Again, if their age are under 13, they should be terminated.

Originally created by @bagasme on GitHub (Dec 28, 2019). ## Description Currently Gitea accepts user registration for any age. As #8353 will add Terms of Service, we will now require users registers at age 13 or older. The age will be calculated using date of birth entered when an user register to Gitea. Gitea should reject users which their age are under 13, during registration. Existing users must be prompted to add their date of birth. Again, if their age are under 13, they should be terminated.

GiteaMirror added the type/proposal label 2025-11-02 05:54:37 -06:00

GiteaMirror closed this issue

2025-11-02 05:54:37 -06:00

GiteaMirror commented

2025-11-02 05:54:38 -06:00

@zeripath commented on GitHub (Dec 28, 2019):

How about just adding "by signing up you agree to the terms & conditions" waiver instead.

Birthdates are sensitive personal data and we should not be collecting them.

@zeripath commented on GitHub (Dec 28, 2019): How about just adding "by signing up you agree to the terms & conditions" waiver instead. Birthdates are sensitive personal data and we should not be collecting them.

GiteaMirror commented

2025-11-02 05:54:38 -06:00

@bagasme commented on GitHub (Dec 28, 2019):

@zeripath I agree. But how can we determine user's age if we don't store their birthdate?

@bagasme commented on GitHub (Dec 28, 2019): @zeripath I agree. But how can we determine user's age if we don't store their birthdate?

GiteaMirror commented

2025-11-02 05:54:38 -06:00

@zeripath commented on GitHub (Dec 28, 2019):

You don't.

The purpose of GDPR is that you should store and obtain only that which is necessary.

It's simply not necessary to get a user's date of birth - even if you want to exclude persons under the age of 13 just stick it in the terms waiver or if you want to make it explicit stick a checkbox in where they state they're over 13. (I'm suspicious that we should set that at 18 because we absolutely do not want to have any reason to collect a user's dob by default and under 18 year olds should probably have some limited account to allow for more complete deletion on request but I dunno.)

Even sticking a dob selector on does not absolve you of having to deal with children's data. If it comes to light that a child has lied on the dob selector then the rules about children's data still apply - in our case that would be just to delete the user, their repositories, their comments on other repositories.

(Further more extreme interventions would probably include deleting any unmerged PRs they've made and informing any repo owner about the need to rewrite history to replace that user's email address. I dunno if we can really do that last one though - as it could reveal the user's age?!)

However we should not be collecting user's ages. We don't need that data. We don't want that data. It's highly sensitive data. It's completely counter to the purpose of the GDPR to collect this data.

Even if we make limited accounts for children 13-18 we still don't need their dob - they can self assert that they're over 18 to obtain a non limited account perhaps by email check. That's still an age verification check as per GDPR - but again if they lie it still doesn't absolve us of our responsibilities - although it does give us an excuse to explain why we can't completely erase them.

@zeripath commented on GitHub (Dec 28, 2019): You don't. The purpose of GDPR is that you should store and obtain only that which is necessary. It's simply not necessary to get a user's date of birth - even if you want to exclude persons under the age of 13 just stick it in the terms waiver or if you want to make it explicit stick a checkbox in where they state they're over 13. (I'm suspicious that we should set that at 18 because we absolutely do not want to have any reason to collect a user's dob by default and under 18 year olds should probably have some limited account to allow for more complete deletion on request but I dunno.) Even sticking a dob selector on does not absolve you of having to deal with children's data. If it comes to light that a child has lied on the dob selector then the rules about children's data still apply - in our case that would be just to delete the user, their repositories, their comments on other repositories. (Further more extreme interventions would probably include deleting any unmerged PRs they've made and informing any repo owner about the need to rewrite history to replace that user's email address. I dunno if we can really do that last one though - as it could reveal the user's age?!) However we should not be collecting user's ages. We don't need that data. We don't want that data. It's highly sensitive data. It's completely counter to the purpose of the GDPR to collect this data. Even if we make limited accounts for children 13-18 we still don't need their dob - they can self assert that they're over 18 to obtain a non limited account perhaps by email check. That's still an age verification check as per GDPR - but again if they lie it still doesn't absolve us of our responsibilities - although it does give us an excuse to explain why we can't completely erase them.

GiteaMirror commented

2025-11-02 05:54:39 -06:00

@zeripath commented on GitHub (Dec 28, 2019):

Now if you allow marketing on your Gitea site you might actually have a valid reason for collecting dob - as the marketing company could demand it... But Gitea itself doesn't need it.

@zeripath commented on GitHub (Dec 28, 2019): Now if you allow marketing on your Gitea site you might actually have a valid reason for collecting dob - as the marketing company could demand it... But Gitea itself doesn't need it.

GiteaMirror commented

2025-11-02 05:54:39 -06:00

@bagasme commented on GitHub (Dec 29, 2019):

GitHub TOS says that:

If we learn of any User under the age of 13, we will terminate that User’s Account immediately.

Maybe Gitea site admin could perform such intervention. Facebook however, enforce age requirement during registration.

@bagasme commented on GitHub (Dec 29, 2019): [GitHub TOS](https://help.github.com/en/github/site-policy/github-terms-of-service) says that: ``` If we learn of any User under the age of 13, we will terminate that User’s Account immediately. ``` Maybe Gitea site admin could perform such intervention. Facebook however, enforce age requirement during registration.

GiteaMirror commented

2025-11-02 05:54:39 -06:00

@zeripath commented on GitHub (Dec 29, 2019):

Exactly - Facebook use the dob for other things. We can simply have similar a thing to GH in our ToS

@zeripath commented on GitHub (Dec 29, 2019): Exactly - Facebook use the dob for other things. We can simply have similar a thing to GH in our ToS

GiteaMirror commented

2025-11-02 05:54:39 -06:00

@bagasme commented on GitHub (Dec 30, 2019):

@zeripath So what purpose of DOB in this case (Gitea) rather than just age verifying?

@bagasme commented on GitHub (Dec 30, 2019): @zeripath So what purpose of DOB in this case (Gitea) rather than just age verifying?

GiteaMirror commented

2025-11-02 05:54:39 -06:00

@6543 commented on GitHub (Jan 14, 2020):

I'm against colecting unessesary information

-> if its realy required a instance admin could use custom template to pervorm @zeripath's suggestion

@6543 commented on GitHub (Jan 14, 2020): I'm against colecting unessesary information -> if its realy required a instance admin could use custom template to pervorm @zeripath's suggestion

GiteaMirror referenced this issue

2025-11-02 13:17:48 -06:00

[PR #4560] [MERGED] cmd/serve: pprof cpu and memory profile dumps to disk #17420

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#4560