- Published on
California lawmakers unanimously pass Linux exemption from age-verification law
- Authors
- Name
- DeepHorus
California lawmakers have unanimously passed Assembly Bill 1856, granting a significant exemption to open-source operating systems from the state's upcoming Digital Age Assurance Act. The Senate amended the bill on August 21 and passed it with a 39-0 vote on August 26, followed by the Assembly's concurrence the next day. The legislation, originally signed into law by Governor Gavin Newsom last October, is set to take effect on January 1, 2027, and aims to mandate age verification for users of major digital platforms.
The new amendments redefine "operating system provider" to explicitly exclude entities distributing software under licenses like GPL, MIT, BSD, and Apache, which permit copying, redistribution, and modification. This change immediately removes popular Linux distributions such as Debian, Fedora, Ubuntu, and Arch from the law's scope. A second exclusion covers software components not offered as standalone executables through covered application stores, protecting libraries and dependencies distributed via package managers like apt and pacman.
A third carve-out removes extension and add-on storefronts that distribute software running exclusively inside host applications, taking browser extension stores out of the law's reach. Additionally, the bill corrects a problematic original definition of "user" that technically classified every device owner in California as a child. A new provision also prohibits requests for age signals from OS providers or app stores unless legally required, preventing potential misuse of the age verification API as a general data collection tool.
Despite these exemptions, commercial operating systems including Windows, macOS, iOS, and Android remain fully subject to the law. These platforms must collect user age data at account setup from January 1, 2027, with a later deadline of July 1, 2027, for devices configured before that date. The status of Valve's SteamOS remains unclear, as its Arch-based components are open source, but it is distributed alongside the proprietary Steam client.
Assemblymember Buffy Wicks, who authored both the Digital Age Assurance Act and the AB 1856 amendment, introduced the exemption in February after criticism from Linux developers and the Electronic Frontier Foundation. The amendments provide a good-faith safe harbor for platforms against liability from erroneous age-gating signals. While GrapheneOS, distributed under MIT and Apache licenses, now falls outside California's law, it still faces compliance requirements under Brazil's Digital ECA.
The passage of AB 1856 establishes a clear boundary in digital regulation, protecting the open-source ecosystem while maintaining age-verification mandates for major commercial platforms. This legislative outcome represents a victory for open-source advocates who argued that the original law's requirements were impractical for community-driven software projects. As the January 2027 implementation date approaches, tech companies will continue preparing their compliance frameworks, while the open-source community can develop without the burden of mandatory age data collection.
