Summary: California’s AB 1856 amendment excludes operating systems distributed under licenses allowing copying, redistribution, and modification from the Digital Age Assurance Act; the Senate passed it 39-0 on August 26. Debian, Fedora, Ubuntu, Arch, and BSD distributions therefore avoid age collection at account creation, while commercial Windows, macOS, iOS, and Android remain covered from January 1, 2027. The bill had reached Governor Newsom, whose signature was still outstanding in the report.
California’s legislature reached a result that lawmaking rarely produces: a blanket exemption pulling open-source operating systems out of an age-verification law. The amended text was finalized on August 21, and on August 26 the Senate carried the AB 1856 amendment 39-0; the Assembly concurred with the Senate version the following day, after which the bill landed with Governor Newsom — Tom’s Hardware reported while the signature was still outstanding. The Digital Age Assurance Act began as a requirement that operating system providers gather age information at account creation. The amendment cuts differently, excluding any system distributed under particular free licenses, so Debian, Fedora, Ubuntu, Arch, and the BSD family left the law’s scope at a stroke.
One Definition Change, a Whole Ecosystem Exempt
Only a single definition moves under the amendment: an “operating system provider” no longer reaches anyone distributing an OS “under license terms that permit a recipient to copy, redistribute, and modify the software.” Put plainly, a license that allows copying, redistribution, and modification — and GPL, MIT, BSD, and Apache all do — means you are not a provider as this law defines one. Alongside that come two specific carve-outs: libraries and dependencies delivered through package managers (so long as they are not offered to consumers as stand-alone executable applications through a covered app store) sit outside the scope, and browser extension stores are exempt as well. Anyone who works inside dependency trees all day will recognize what those two clauses buy: they close off the nightmare in which a statute accidentally swallows an entire ecosystem. For maintainers giving their time without pay, staying clear of a state’s compliance perimeter is not a legal technicality; it is the line between shipping and shutting down.
Commercial Systems Keep Their Obligations
The exemption reaches open source alone, and the duties still land on commercial systems. Windows, macOS, iOS, and Android stay covered: age information must be collected at account creation beginning January 1, 2027, and devices already set up before then have until July 1, 2027. Two boundary cases merit a flag: SteamOS is stuck in an unclear position — the Arch base beneath it is open source, but the Steam client bundled with it is proprietary — whereas GrapheneOS carries MIT/Apache licensing and sits plainly inside the exemption.
The Pushback That Shaped the Amendment
Assemblymember Buffy Wicks brought AB 1856 forward, and she also wrote the original act; her February reintroduction of the amendment answered, directly, the criticism that Linux developers and the EFF aimed at that original text. Beyond the exemption, the amendment closes several technical gaps: the original definition of “user” was faulty enough to treat every device owner as a child, and that language is gone. Fresh provisions bar platforms from requesting age signals where the law does not require them, and a good-faith safe harbor keeps platforms from being held automatically liable when age signals come back inaccurate. A tally with no dissent points to legislators genuinely willing to hear the technical community out.
Where the Statute Still Cannot Reach
That an exemption is not the same thing as safety is the reminder a 807-point Hacker News thread delivers. First, platforms can route around a statute: once a service judges a device through hardware attestation, no operating system choice protects you, and the Web Environment Integrity proposal surfaced repeatedly in that thread. Second, Android’s identity stays contested: AOSP is open source, but what of Google’s proprietary additions? Third, a PR adding a birthdate field once appeared in systemd — proof that the incentive for vendors to comply proactively is real. Fourth, California sets a precedent rather than a finish line: Colorado carries a comparable carve-out, while Illinois’ draft law holds no open-source exception whatsoever, so expect the same fight to replay in other states.
What This Means for Developers and Users
Upstream contributors and distribution maintainers come out ahead in a concrete way: no distribution processes to rework and no age fields to add for the sake of one state’s compliance regime. Ordinary users, meanwhile, see the privacy gap widen: the same laptop sits inside the age-collection perimeter when it runs Windows or another commercial system, and outside it when it runs a Linux distribution. Timing counts as well — should Newsom sign, commercial platforms get four months to build age collection into new account creation, with devices already set up following by July 2027. For everyone else, the episode reads as a textbook case: define “provider” too broadly and an entire ecosystem of unpaid contributors gets swept in, and what finally broke the deadlock was not lobbying but a few lines about license terms.