For the better part of a year, Linux developers had a deadline hanging over their heads: January 1, 2027, the date California’s new age verification law would require every operating system sold or used in the state to start asking people for their birthday. This week, state lawmakers made sure that deadline will never apply to Linux at all.
Assembly Bill 1856 passed its final vote on August 27, when the Assembly accepted the Senate’s changes 69-0. The Senate had passed its own version 39-0 the day before. The bill now sits on Governor Gavin Newsom’s desk, and once he signs it, operating systems distributed under licenses like the GPL, MIT, BSD, and Apache License will be formally excused from California’s Digital Age Assurance Act.
TL;DR
- California’s Digital Age Assurance Act (AB 1043) requires operating systems to collect a user’s age at setup starting January 1, 2027
- AB 1856 rewrites the law so software distributed under open licenses no longer counts as a regulated “operating system provider”
- The bill passed both chambers unanimously, 69-0 in the Assembly and 39-0 in the Senate, and now heads to Governor Newsom, who signed the original law back in October 2025
- Windows, macOS, iOS, and Android are all still fully covered
- Colorado passed a similar law earlier this year with its own open source carve-out, so California isn’t acting alone here
- SteamOS is stuck in a gray area nobody has resolved yet
How the Exemption Actually Works
The whole carve-out comes down to one new clause in the bill’s definitions section. AB 1856 rewrites “operating system provider” to exclude anyone who distributes an OS or application “under license terms that permit a recipient to copy, redistribute, and modify the software.”
The bill never names a license by brand, but that phrasing is close to a textbook definition of open source. It covers the GPL, MIT, BSD, and Apache licenses, which is why Debian, Fedora, Ubuntu, Arch, FreeBSD, and most of the rest of the ecosystem fall outside the law’s reach the moment Newsom signs.
Package Managers Are Untouched
The law only applies to standalone applications sold through a “covered application store.” Libraries and dependencies pulled in through apt, pacman, dnf, or similar tools were never really in scope to begin with, and AB 1856 spells that out directly.
Extension Stores Are Exempt Too
Storefronts that only distribute add-ons running inside another application, like a browser’s extension store, don’t count as covered application stores at all.
Lawmakers also slipped in a straightforward anti-abuse rule: nobody, not an OS maker, not an app store, can request a person’s age signal unless a law actually requires it. That closes off the obvious next move, where age-check infrastructure quietly turns into a general-purpose tracking system.
The Drafting Error That Made Every Adult a Legal Child
Buried in the original bill was a mistake nobody seems to have caught until developers started reading the actual statute. The old law defined “user,” for signaling purposes, as “a child that is the primary user of a device.” Read literally, that left the law with no way to describe an adult at all. Every device owner in California was, on paper, a child.
AB 1856 deletes that definition entirely. It’s a small fix compared to the open source exemption, but it’s a good reminder that a law written to protect kids online needed a basic copy edit before adults could even use it correctly.
Why Lawmakers Backed Down in the First Place
The exemption didn’t come out of nowhere. The original Digital Age Assurance Act passed the legislature in 2025 with support from some of the largest names in tech, including Google, Meta, and Snap, and Newsom signed it that October. What nobody in Sacramento seems to have fully worked through is what “operating system provider” would even mean for software with no company behind it and nobody to hold liable.
The open source world noticed fast. More than 400 computer scientists signed an open letter warning that OS-level age checks would build surveillance infrastructure without doing much to actually stop minors from getting around it. Several projects didn’t wait around for a legislative fix:
- GrapheneOS announced in March that it would never collect age data, full stop, even if that meant losing sales in places that required it.
- DB48X, an open source calculator firmware project, published a legal notice stating flatly that its software would not implement age verification.
- MidnightBSD went the opposite direction and shipped what’s believed to be the first native age-verification code of any operating system, a daemon called aged, built mainly to deal with Brazil’s much stricter verification law.
- One developer forked Debian into a distro called Ageless Linux for the sole purpose of refusing to comply, complete with plans for a cheap board to hand out to kids with the age check stripped out. It racked up nearly 600 upvotes on Hacker News within hours of going live.
Assemblymember Buffy Wicks, who wrote both AB 1043 and this fix, introduced AB 1856 back in February. The open source exemption itself didn’t show up until later amendments that spring, once developers and the Electronic Frontier Foundation started raising the alarm publicly.
California Almost Dragged Every Website Into This Too
The Linux exemption wasn’t the only thing riding on this bill. For a few months this spring, AB 1856 would have also forced every website and browser operating in California to request an age signal from visitors, stretching the law’s reach from apps and app stores out to the entire open web.
The EFF fought that version hard, warning it would compound the privacy and speech problems already built into AB 1043. Lawmakers stripped the browser and website language out of the bill by early summer, and in July the EFF formally dropped its opposition, while still maintaining that it thinks the underlying law is a bad idea.
What survived is narrower, and genuinely better for users. If a developer gets an age signal tied to a specific device, that knowledge now only applies to that one device, not to every website and app the person happens to touch.
Who’s Still Stuck With This
None of this helps you if you’re not running Linux. Windows, macOS, iOS, and Android are all fully in scope, and none of their licenses come close to qualifying for the carve-out. Apple and Google are already building their own compliance tools: a Declared Range API on iOS and macOS, and a Play Age Signals API on Android, both still in beta.
Starting January 1, 2027, new device setups on those platforms have to ask for a birthday. Devices already in use before that date get a grace period: operating system providers have until July 1, 2027 to add the interface, and developers get the same deadline to request a signal for apps that were already installed.
Getting it wrong is expensive. Violations can run up to $2,500 per affected child for a negligent violation, and up to $7,500 per affected child if it was intentional, enforced by the state Attorney General. There’s a good faith defense written into the law, but it only covers honest mistakes in an erroneous signal, not skipping compliance altogether.
SteamOS is the case nobody’s resolved. Its core is Arch Linux, about as open source as operating systems get. But Valve ships it bundled with the proprietary Steam client and storefront, and the company hasn’t said publicly whether it considers itself covered by the law or exempt from it. Nobody’s forced the question yet. With a huge share of Steam Deck owners living in California, somebody probably will.
Could Apple Just Relicense Its Way Out of This?
The moment the bill’s text started circulating, Linux forums did what they always do and went hunting for the loophole. The theory that got the most traction: what if a company like Apple or Microsoft released one small, technically MIT-licensed module to handle the age check, kept the rest of the operating system closed, and claimed the exemption anyway?
The read that won out among people who actually sat down with the statute is that this probably doesn’t work. The exemption applies to an operating system or application distributed under an open license, not to a single function buried inside one. A company would have to make the entire product genuinely redistributable and modifiable to qualify, not just the one file that happens to check a birthday. Slapping an MIT header on a lone stub function while keeping everything else closed source doesn’t turn the operating system itself into open source software.
None of this has been tested in court, and nobody arguing about it in a forum thread is a lawyer. But it’s a decent sign that Linux users spent an afternoon trying to break the exemption and mostly came up empty.
The Internet Already Has Jokes About It
r/linux found out within hours, and the reaction was a mix of genuine excitement and the community’s favorite running bit showing up right on schedule: someone declared 2027 the legally mandated Year of the Linux Desktop. Someone else guessed, half joking, that this exemption is about to become the single best argument any parent has ever had for putting Mint on the family computer.
There’s real skepticism mixed into the jokes too. Multiple commenters pointed out that a carve-out like this only lasts as long as the next legislative session, and that lawmakers this comfortable regulating the internet by age bracket could come back and close the gap once age verification becomes normal everywhere else. For now, open source just won a fight most of its users didn’t even know they were having, and won it 69-0.
