California exempts open-source operating systems from digital age-check mandate
California's legislature passed Assembly Bill 1856, which removes open-source operating systems from the state's Digital Age Assurance Act ahead of its January 2027 enforcement. The bill redefines "operating system provider" to exclude software distributed under permissive or copyleft licenses like GPL, MIT, BSD, and Apache, covering distributions such as Debian, Fedora, and Ubuntu. It also carves out libraries and dependencies delivered via package managers, and add-ons that run within exempt systems, from the law's age-verification obligations.
The bill’s passage follows months of industry lobbying, as open-source advocates argued that requiring age checks at account setup would burden volunteer-run distributions and fragment the ecosystem. The new definition hinges on license terms, meaning any OS distributed under permissive or copyleft licenses—including GPL, MIT, BSD, and Apache—falls outside the mandate. This covers major Linux families like Debian, Fedora, and Ubuntu, as well as SteamOS, which had been a particular concern for gaming communities.
The amendments also clarify that package managers such as apt and pacman are not treated as app stores, and that browser extension stores are exempt if add-ons run only within a host application. Lawmakers additionally removed a flawed definition of “user” that had classified all device owners as children, and added a provision barring age-signal requests unless legally required. The law still applies to Windows, macOS, iOS, and Android, with enforcement beginning January 1, 2027.
This exemption could reduce friction for Linux and open-source users, who may avoid mandatory age disclosures that proprietary platforms must implement. However, it may create uneven privacy protections, as minors on exempt systems could lack the same age-gating safeguards. The law’s narrow scope might also push developers toward open-source platforms to sidestep compliance, potentially shifting user behavior and market dynamics. Ultimately, the impact hinges on how effectively age verification works on covered systems and whether the exemption remains stable under future legal challenges.