@grahamperrin This feels like the wrong approach. The CRA has a sensible approach of decoupling products from open-source projects. If you sell a product then you have a load of obligations. If you have an open-source project then you can do whatever you want and the liabilities apply only to people who roll up your code. This means that Google and others who ship Android phones, for example, have obligations under the CRA, but the Linux kernel does not.But that’s really dodging the issue of whether this is a good idea at all, because market pressures will come back to the projects indirectly if everyone downstream has these requirements. Most consumer operating systems have some form of parental controls. I think the right approach for the things these laws are trying to do is require labelling for commercial content and provide OS-supported tooling for hiding certain kinds of content. We already have such labelling requirements for films, for example.
