California lawmakers unanimously pass Linux exemption from age-verification law — software distributed under the GPL, MIT, BSD, and Apache licenses are exempt

Tom's Hardware ^ | 29 August 2026 | Luke James

[ShadowAce]

California’s legislature has passed Assembly Bill 1856, exempting open-source operating systems from the State’s Digital Age Assurance Act months before the law is due to take effect on January 1, 2027. The Senate amended the Bill on August 21 before passing it on the 26th in a 39-0 vote, with the Assembly then accepting these changes in a concurrence vote the following day. The amendment ends almost a year of uncertainty surrounding whether Linux distributions and SteamOS would be forced to collect user age data during account setup alongside Windows, macOS, iOS, and Android. AB 1856 has now been sent to Governor Gavin Newsom, who signed the original act into law last October.

These amendments redefine the term “operating system provider” to exclude any person or entity that distributes an OS or application “under license terms that permit a recipient to copy, redistribute, and modify the software.” Any software distributed under the GPL, MIT, BSD, and Apache licenses satisfies that test, which removes the likes of Debian, Fedora, Ubuntu, Arch, and the BSD family from AB 1856’s scope.

A second exclusion removes software components that aren’t “offered to consumers as a stand-alone executable application through a covered application store” from the law’s definition of an application, covering libraries and dependencies distributed through package managers like apt and pacman. AB 1856 doesn’t explicitly say that repos aren’t app stores, but a store’s main obligation under the law is to request an age signal from the user’s OS provider and pass it to developers; an exempt open-source OS produces no signal. A third carve-out excludes storefronts distributing extensions or add-ons that run exclusively inside a host application, which takes browser extension stores out of scope.

The amendments to AB 1856 also remove the original definition of “user,” which read, “a child that is the primary user of a device,” and technically classified every device owner in California as a child. The law’s signaling framework depends on adults declaring their age on account setup, so their devices get flagged as 18 and over, but under that definition nobody could ever be flagged as an adult.

In addition, lawmakers inserted a new provision prohibiting anyone from requesting an age signal from an OS provider or app store unless required by law. That closes off potential abuse of the age API that could have led to it being used as a general-purpose data collection channel even when age verification wasn’t required. Platforms and developers also gain a good-faith safe harbor against erroneous signals, protecting them from liability when age-gating signals are inaccurate.

Windows, macOS, iOS, and Android remain fully in scope, with age collection required at account setup from January 1, 2027. A later July 1, 2027, deadline applies to devices set up before January 1. Whether SteamOS is in scope isn’t yet clear: its Arch-based system components are open source, but Valve distributes the image alongside the proprietary Steam client. GrapheneOS, which in March said it would refuse to comply with age-verification mandates, is distributed under open-source MIT and Apache licenses and now falls outside the law’s scope entirely, though Brazil’s Digital ECA still applies to it.

Assemblymember Buffy Wicks, who wrote both the Digital Age Assurance Act and the AB 1856 amendment, introduced the exemption back in February following criticism from Linux developers and the Electronic Frontier Foundation.

---

TOPICS: Computers/Internet
KEYWORDS: linux

[Paal Gulli]

The Linux kernel is open source and anyone can hack it to their heart’s content, so there was never any chance that Kommiefornia could have mandated something be put in that the Linux boffins couldn’t have removed.

[oldtech]

Well, I wonder how many of us read that & still don’t know what it amounts to; what it is really all about. If it was signed by the californica governor, I guess that would be reason enough to be suspicious of it.

[Drew68]

What is the purpose of this requirement? What does it accomplish?

The ultimate purpose behind age verification laws are to prevent people from surfing and posting anonymously, but they sell it as a "Think about the children!!!" initiative and many conservatives lap it up.

"I don't want to give my ID to some third-party government bureaucracy to approve, log, and archive my web usage."

"You must want kids to look at porn! Sicko! Pervert!"

[Pontiac]

The ultimate purpose behind age verification laws are to prevent people from surfing and posting anonymously,

Thanks, that makes sense.

but they sell it as a "Think about the children!!!" initiative and many conservatives lap it up. "I don't want to give my ID to some third-party government bureaucracy to approve, log, and archive my web usage." "You must want kids to look at porn! Sicko! Pervert!"

Benjamin Franklin: "Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety."

Unfortunately if we are to protect Liberty, we have to protect the liberty of everybody, including the sickos.

Yes kids get hurt. When kids get hurt we punish those sickos.

We don't punish everyone by limiting freedom so as to try to kids.

When we try to do it that way, the sickos quickly find ways to get around those limitations.

Humans are infinitely inventive when seeking to do evil.