Summary: Illinois Governor JB Pritzker signed HB5511 on July 31, making it Public Act 104-0664 and requiring covered manufacturers to collect age in OS setup starting in 2028. Devices create four age brackets from a self-declared birth date and share an encrypted signal that triggers minor protections. Unlike Colorado and California, Illinois has no open-source exemption.
Illinois Governor JB Pritzker signed HB5511, the Children’s Social Media Safety Act, in the opening week of August; it is now Public Act 104-0664. The notable thing about the law is not “protecting minors” — by now that is consensus politics in US states — but the layer at which it places the duty to collect age: the operating system. Device makers, OS vendors and app stores are all captured by the term “covered manufacturer,” and starting in 2028 they have to gather age inside the out-of-box setup flow. What tech media seized on in early August was a different, less noticed detail: no open-source exemption survives in this version.
A Law That Places the Duty at the OS Layer
The bill cleared the legislature in June with lopsided margins and a unanimous final concurrence vote, and it was signed on July 31. Illinois borrows the model from Colorado’s SB26-051 and California’s AB-1043 — it is the third state to take this OS-level route — and the approach travels because it answers a coordination problem: a single age signal per device rather than a fresh identity check every time a teenager opens an app. Instead of every app verifying age for itself, the operating system collects the data once and issues an age signal.
Platform duties come attached to that signal. By default minors receive chronological, follow-only feeds; notifications stay silent between 10 PM and 7 AM; adult strangers are barred from contacting or viewing minors; profiles are kept out of search and location data is masked. The defaults can be overridden by parents — and by minors themselves once they turn 16.
How It Works: Four Brackets and an Encrypted Signal
Setup asks a parent or account holder to declare the child’s birth date, and the system turns that into one of four brackets: under 13, 13 to 15, 16 to 17, and 18-plus. The collection is deliberately thin — a self-declared birth date only, with no passport checks or face scans required. That bracket travels over an encrypted API that shares the minimum needed, with no third-party disclosure beyond what the statute demands. As soon as an app receives a minor bracket, the law deems it to have “actual knowledge,” and the full protection set switches on by itself. Apps no longer build their own age gates; each one reads a single signal from the device and calibrates its defaults to match.
The timeline runs in two stages: operating systems must have the interface ready by January 1, 2028, and apps must begin requesting signals by July 1, 2028. The penalties carry a puzzling gap — the bill text sets up to $2,500 per child for negligence and $7,500 for intent, while the governor’s press release quotes as much as $50,000 for each violation. Enforcement belongs solely to the Illinois Attorney General; there is no private right of action. Manufacturers and apps that act in good faith are not liable when a signal turns out to be incorrect.
No Open-Source Exemption: Linux Projects Get Swept In
Colorado and California both wrote exemptions for open-source projects into their versions. Illinois “has none of this,” as coverage put it, and the definitions of “covered manufacturer” and “application store” are broad enough to reach commercial and nonprofit projects alike. Enforcement, in practice, looks lopsided: a hobbyist maintainer with no Illinois business presence is practically out of reach, whereas vendors earning revenue in the state — Google, Microsoft, Apple — stand directly inside the penalty range. The chilling effect lands instead on distributions and community projects that have no legal department, even though the obligation is written to apply to everyone.
The Wider Picture: The Age-Verification Wave and Anonymity
That same week, the outlet Effort published an investigation charting the lobbying machinery behind this wave: five UK-founded organizations, together with their American affiliates, are advancing digital ID and age-verification bills across 21 states and in Congress. The 5Rights Foundation on its own engaged on 42 bills in 18 states, 11 of which became law, and its founder Baroness Beeban Kidron has even endorsed VPN bans, arguing that restrictions without them are “for show and headlines, not for children.” One frequently cited template is California’s AB 2273, co-designed by 5Rights and modeled on the UK’s Age Appropriate Design Code.
To supporters this is child safety. To critics the endpoint reads as de facto real-name identification — and the room adults have to use the internet anonymously is being compressed state by state.
For developers the impact is direct: if your product has multi-state US users, age-signal APIs become a 2027–2028 compliance line item, and fragmented rules across states are the next cost center.