California lawmakers unanimously pass Linux exemption from age-verification law — software distributed under the GPL, MIT, BSD, and Apache licenses are exempt

Tom's Hardware ^ | 29 August 2026 | Luke James

[ShadowAce]

California’s legislature has passed Assembly Bill 1856, exempting open-source operating systems from the State’s Digital Age Assurance Act months before the law is due to take effect on January 1, 2027. The Senate amended the Bill on August 21 before passing it on the 26th in a 39-0 vote, with the Assembly then accepting these changes in a concurrence vote the following day. The amendment ends almost a year of uncertainty surrounding whether Linux distributions and SteamOS would be forced to collect user age data during account setup alongside Windows, macOS, iOS, and Android. AB 1856 has now been sent to Governor Gavin Newsom, who signed the original act into law last October.

These amendments redefine the term “operating system provider” to exclude any person or entity that distributes an OS or application “under license terms that permit a recipient to copy, redistribute, and modify the software.” Any software distributed under the GPL, MIT, BSD, and Apache licenses satisfies that test, which removes the likes of Debian, Fedora, Ubuntu, Arch, and the BSD family from AB 1856’s scope.

A second exclusion removes software components that aren’t “offered to consumers as a stand-alone executable application through a covered application store” from the law’s definition of an application, covering libraries and dependencies distributed through package managers like apt and pacman. AB 1856 doesn’t explicitly say that repos aren’t app stores, but a store’s main obligation under the law is to request an age signal from the user’s OS provider and pass it to developers; an exempt open-source OS produces no signal. A third carve-out excludes storefronts distributing extensions or add-ons that run exclusively inside a host application, which takes browser extension stores out of scope.

The amendments to AB 1856 also remove the original definition of “user,” which read, “a child that is the primary user of a device,” and technically classified every device owner in California as a child. The law’s signaling framework depends on adults declaring their age on account setup, so their devices get flagged as 18 and over, but under that definition nobody could ever be flagged as an adult.

In addition, lawmakers inserted a new provision prohibiting anyone from requesting an age signal from an OS provider or app store unless required by law. That closes off potential abuse of the age API that could have led to it being used as a general-purpose data collection channel even when age verification wasn’t required. Platforms and developers also gain a good-faith safe harbor against erroneous signals, protecting them from liability when age-gating signals are inaccurate.

Windows, macOS, iOS, and Android remain fully in scope, with age collection required at account setup from January 1, 2027. A later July 1, 2027, deadline applies to devices set up before January 1. Whether SteamOS is in scope isn’t yet clear: its Arch-based system components are open source, but Valve distributes the image alongside the proprietary Steam client. GrapheneOS, which in March said it would refuse to comply with age-verification mandates, is distributed under open-source MIT and Apache licenses and now falls outside the law’s scope entirely, though Brazil’s Digital ECA still applies to it.

Assemblymember Buffy Wicks, who wrote both the Digital Age Assurance Act and the AB 1856 amendment, introduced the exemption back in February following criticism from Linux developers and the Electronic Frontier Foundation.

---

TOPICS: Computers/Internet
KEYWORDS: linux

[ShadowAce]

[George from New England]

Isn’t that special. Many unplanned consequences will follow.

[butlerweave]

With Linux they couldn’t find anyone to find responsible that they could charge ,LOL Open Source ,LOL

[dinodino]

Good. The law is ridiculous, and trying to apply it to Linux would impact the majority of servers and IoT devices.

[butlerweave]

This change was made by the Idiot that created the bill in the first place ,LOL

[montag813]

Kudos to the Linux lobby. You guys are awesome!

[for-q-clinton]

Kind of BS...the law requiring it that is.

And exempting one platform should leave it so Apple, Google, and Microsoft can sue.

[mikey_hates_everything]

Stupid CA lawmakers couldn’t lawfare their stupidity against anyone this time. Does running Windows as a VM on a Linux host exempt it? Heads exploding in Sacramento...

[Pontiac]

What is the purpose of this requirement? What does it accomplish?

All junior has to do to circumvent this requirement is register the OS in mommy’s name and birthday.

Of course legislators never think of what it takes to enforce their legislation.

[Openurmind]

Thank you... :)

[catnipman]

IOW, CA is out to just shaft microsoft and apple ...

[curious7]

Just have to see what sort of fingerprint is used to determine if the requestor is on windblows or *nix - maybe as simple as spoofing the browser to always report *nix when queried. Or more complex. I see an opportunity for a browser extension to report whatever OS you want it to report for simple cases.

[null and void]

"...technically classified every device owner in California as a child. The law’s signaling framework depends on adults declaring their age on account setup, so their devices get flagged as 18 and over, but under that definition nobody could ever be flagged as an adult.

This makes perfect sense.

The government of California regards no one in the state as a full adult, but merely as children needing to be protected from themselves...

[dayglored]

A rare display of sanity on the part of the CA legislature.

[ShadowAce]

I see an opportunity for a browser extension to report whatever OS you want it to report

I'm pretty sure that already exists.

[curious7]

Then if the verifiers don’t try for a more complex fingerprint anybody that cares will just have their browser report it’s coming from *nix with minimal effort.

[fuzzylogic]

Exactly - plus it’s a single State that thinks it can control OS’s used globally. It’s entirely unconstitutional. Software is considered “free speech”, this amounts to “compelled speech”...the other OS companies can now cry “foul” as there’s an exception.

[ProgressingAmerica]

“What is the purpose of this requirement? What does it accomplish?”

It firmly secures the camel’s nose under the tent.

10 years from now in the next legislation? More Camel to follow.

[mikey_hates_everything]

I’m sure all sorts of workarounds will appear in order to get around, or make totally unenforceable, that law.