I foresee a wave of new porn-related open source applications in Colorado's future.

So a FOSS app running a device local diffusion model specifically for porn would be free of age checks. From a technical perspective that's not all that different from, say, an ansible playbook or bash script or whatever to download a model from HF and configure a local inference stack yet I feel like it must be an unintended loophole.

(5)(a) "COVERED APPLICATION" MEANS A CONSUMER SOFTWARE APPLICATION THAT IS ACCESSED THROUGH A COVERED APPLICATION STORE AND THAT MAY BE RUN OR DIRECTED BY A USER ON A DEVICE.

(b) "COVERED APPLICATION" DOES NOT INCLUDE:

(I) A SOFTWARE APPLICATION THAT DOES NOT PROCESS USERS' PERSONAL DATA; OR

(II) AN APPLICATION FROM A FREE, PUBLICLY AVAILABLE CODE REPOSITORY.

On the one hand, I'm absolutely against blanket age verification laws like this one, think there are better ways to solve the stated problem, and believe that the current crop of legislation is being pushed by bad actors for nefarious purposes by means of pandering to public mania.

On the other hand, I do appreciate that a possible unintended consequence of the out provided by (5)(b)(I) could be that PII (along with user generated content in general) becomes similarly radioactive to if the US had passed a GDPR equivalent. Either that or it's used as a justification for every single online service to require government ID in order to interact with it "because liability". Unfortunately I assume the latter is somewhat more likely at this point.

Also is it defined precisely what it means to "process users' personal data"?

That wording could be interesting, because it's ambiguous if free is applicable to the repository or the project. Presumably, the latter. This means you could absolutely do source-open but not open-source and still get around it.

Well it says code repository not artifact repository. But it doesn't prohibit obfuscation or transpilation and more generally doesn't appear to specify anything beyond "free and publicly available". I really get the feeling that the people who wrote the law don't have a clear idea of what they're trying to say here and that any court decision is going to be a roll of the dice.

hopefully if each state starts crafting dumb laws like this they all get banned via commerce clause due to infeasibility of compliance

the only ones that'll bebanned are where they dont prostrate themselves to the fascists.