By ByteBot
California’s legislature voted unanimously last week to exempt open-source software from its upcoming age-verification mandate, ending nearly a year of anxiety for Linux maintainers who never should have been caught in this net. The Senate passed AB-1856 39-0 on August 26; the Assembly concurred 69-0 the next day. Debian, Fedora, Ubuntu, Arch, and anything distributed under GPL, MIT, BSD, or Apache licenses is now explicitly out of scope.
Why the Original Law Was a Problem for Open Source
The Digital Age Assurance Act (AB-1043), signed by Governor Newsom in October 2025, was designed for Apple and Google — and it showed. The law requires every OS provider to collect users’ ages at account setup, slot them into four age brackets (under 13, 13–16, 16–18, 18+), and expose a real-time API that app developers can query. Reasonable enough for a company with a legal department and a centralized platform. A genuine problem for a Linux distribution maintained by a coalition of volunteers.
The issue was the definition. AB-1043 cast “operating system provider” broadly enough to catch Linux distros, SteamOS, and BSD variants. Fedora doesn’t have a compliance team. Debian doesn’t have a central entity that can be fined $7,500 per affected minor. Arch Linux definitely doesn’t run a centralized age-collection server. The mandate was technically incompatible with how open-source projects actually operate.
What AB-1856 Actually Does
The fix is clean. AB-1856 carves out anyone who distributes software “under license terms that permit a recipient to copy, redistribute, and modify the software.” In practice, that covers the entire open-source stack: GPL, MIT, BSD, Apache, and any comparable license. Debian, Fedora, Ubuntu, Arch, Mint, FreeBSD, OpenBSD — all exempt. The bill also covers package managers: libraries and dependencies distributed through apt, pacman, pip, or npm don’t qualify as “stand-alone executable applications through a covered application store,” so they’re out of scope too.
Colorado passed nearly identical language in SB 26-051 (effective July 2028), suggesting this two-tier model — strict rules for commercial platforms, exemption for open source — is becoming the legislative standard. Both laws also explicitly exempt repositories like GitHub, GitLab, and Docker from the age-bracketing regime.
Browsers Almost Got Pulled In
Here’s the part worth paying attention to. When AB-1856 cleared the Assembly in May, it included an expansion that would have pulled web browsers and website operators into the same data pipeline. Browsers would have been required to collect the age signal from the OS and relay it to any website subject to age verification. The EFF called this an “anonymity- and privacy-destroying data collection framework.” The California Senate stripped that expansion before the final vote. Browsers are not covered. Neither are website operators. The checkpoint stays at device setup.
SteamOS Remains in Gray Territory
The exemption doesn’t resolve every edge case. SteamOS sits in an awkward middle: the underlying Arch Linux layer is open-source and clearly exempt, but the Steam client is a proprietary app store. Whether the hybrid counts as an “operating system provider” under the law is still unclear, and Valve hasn’t commented publicly. According to TechPowerUp, SteamOS enforcement remains likely despite the open-source exemption. Given that penalties run $2,500–$7,500 per affected minor, that’s a question Valve will need to answer before January 1, 2027.
The Deadline That Still Matters
AB-1043 takes effect January 1, 2027. For open-source distributions, nothing changes — no age collection, no age API, no compliance work required. For Windows, macOS, iOS, and Android (with Google Play Services), the clock is running. Android is worth watching: AOSP is technically open-source, but Google Play Services are proprietary, and that combination likely puts Google on the hook regardless.
California’s legislature did the right thing here, even if it took a year of unnecessary uncertainty to get there. Open-source software was never the intended target of age-verification legislation, and AB-1856 makes that explicit. The browser provisions are worth tracking — stripped from this bill, they’re likely to surface again in future legislation.
Sources: Phoronix, EFF, TechPowerUp, TechTimes, Linuxiac
