California’s legislature unanimously produced an unusual outcome: a blanket exemption for open-source operating systems from an age-verification law. On August 26, the state Senate passed the AB 1856 amendment 39-0 (the amended text was completed on August 21); the Assembly concurred the next day, and the bill now sits with Governor Newsom — his signature was still pending when Tom’s Hardware reported. The Digital Age Assurance Act originally required operating system providers to collect age information when accounts are created. The amendment excludes any system distributed under certain free licenses — meaning Debian, Fedora, Ubuntu, Arch, and the BSD family are instantly out of the law’s scope.
One Definition Change, a Whole Ecosystem Exempt
The core of the amendment is a single definitional change: an “operating system provider” no longer includes anyone who distributes an OS “under license terms that permit a recipient to copy, redistribute, and modify the software.” In plain terms: if your license permits copying, redistribution, and modification — GPL, MIT, BSD, and Apache all qualify — you are not a provider under this law. The amendment adds two specific carve-outs: libraries and dependencies distributed through package managers (as long as they are not offered to consumers as stand-alone executable applications through a covered app store) are out of scope, and browser extension stores get an exemption too. For anyone who deals with dependency trees daily, those two clauses head off the disaster scenario of a statute accidentally covering an entire ecosystem. For voluntary, unpaid maintainers, staying out of a state’s compliance perimeter is not a legal nicety; it is the difference between shipping and shutting down.
Commercial OSes Stay in Scope
The exemption goes to open source only; the obligations still land on commercial systems. Windows, macOS, iOS, and Android remain covered: from January 1, 2027, age information must be collected at account creation, and devices already set up before that date get until July 1, 2027. Two edge cases are worth noting: SteamOS’s status is unclear — its Arch base is open source, but the bundled Steam client is proprietary — while GrapheneOS, licensed under MIT/Apache, clearly falls inside the exemption.
The Backlash Behind the Amendment
AB 1856 was authored by Assemblymember Buffy Wicks, who wrote the original act; she reintroduced the amendment in February in direct response to criticism of the original from Linux developers and the EFF. Beyond the exemption, the amendment fixes several technical flaws: the original definition of “user” was flawed enough to treat every device owner as a child, and that language is gone. New provisions bar platforms from requesting age signals unless the law requires it, and add a good-faith safe harbor so platforms are not automatically liable for inaccurate age signals. A unanimous vote suggests this was a case where legislators actually listened to the technical community.
What the Statute Cannot Reach
The 807-point Hacker News thread is a reminder that an exemption is not the same as safety. First, platforms can route around statutes: if a service switches to hardware attestation to judge a device, no operating system choice saves you — the Web Environment Integrity proposal came up repeatedly in the thread. Second, Android’s identity remains contested: AOSP is open source, but what about Google’s proprietary additions? Third, systemd once saw a PR adding a birthdate field — the incentive for vendors to proactively comply is real. Fourth, California sets a precedent, not a finish line: Colorado has a similar carve-out, while Illinois’ draft law has no open-source exception at all — expect the same fight in other states.
What It Means for Developers and Users
For upstream contributors and distribution maintainers, this is a concrete win: no need to change distribution processes or add age fields to satisfy one state’s compliance regime. For ordinary users, the privacy gap just widened: on the same laptop, Windows or another commercial OS puts you inside the age-collection perimeter, while a Linux distribution does not. The calendar matters too: if Newsom signs, commercial platforms have four months to build age collection into new account creation, with already-set-up devices following by July 2027. For everyone else, the law is a textbook case — when a statute defines “provider” too broadly, an entire ecosystem of unpaid contributors gets swept in, and in the end the rescue came not from lobbying but from a few lines about license terms.
Sources
- California lawmakers unanimously pass Linux exemption from age-verification law — Tom’s Hardware
- California lawmakers unanimously pass Linux exemption from age-verification law — Hacker News
AI-assisted summary compiled from the sources above, reviewed by a human before publishing.