By ByteBot
Illinois Governor JB Pritzker signed HB5511 — the Children’s Social Media Safety Act — into law on July 31, 2026. The headline provisions target social media platforms: default algorithmic restrictions for minors, no overnight notifications, no contact from adult strangers. The part getting attention in developer circles is buried further in the bill: by January 1, 2028, every operating system provider must add an age-declaration step to device setup. Users declare a birth date; the OS converts it to one of four brackets (under 13, 13–15, 16–17, 18+) and exposes it via encrypted API to any app that asks. App developers then have until July 1, 2028 to query that API and enforce age-appropriate restrictions.
Penalties run from $2,500 per affected child for negligent violations to $7,500 for intentional ones. Enforcement sits exclusively with the Illinois Attorney General — no private right of action.
Illinois Did What Colorado and California Did Not
This is where HB5511 diverges sharply from peer legislation. When Colorado passed SB 26-051 and California moved AB-1043 through committee, both states added explicit exemptions for open-source software — language shielding OS projects distributed under licenses that allow users to copy, redistribute, and modify freely. System76’s founder lobbied Colorado directly for that carve-out. California included similar language. Both laws go out of their way to say: the hobbyist distro maintainer is not the target here.
Illinois copied early-draft language from before either state made those fixes. The result is that HB5511’s definition of “covered manufacturer” — which includes operating system providers, device makers, and application stores — applies with equal weight to Microsoft and to whoever packages the latest Arch Linux ISO. There is no open-source exemption. The bill passed 82-27 in the House and 57-0 in the Senate, suggesting lawmakers either did not notice or did not care.
| State | Law | Open-Source Exemption | OS Deadline |
|---|---|---|---|
| Colorado | SB 26-051 | Yes | July 1, 2028 |
| California | AB-1043 | Yes | Jan 1, 2027 |
| Illinois | HB5511 | No | Jan 1, 2028 |
The Enforcement Problem Nobody Has Solved
The Electronic Frontier Foundation wrote to Governor Pritzker on June 29 urging a veto, calling the bill “a massive privacy and free speech nightmare” that specifically threatens the open-source ecosystem. He signed it anyway. But the EFF’s concerns point to a real structural problem: Linux has no central legal entity domiciled in Illinois. The Linux kernel is maintained by contributors in dozens of countries. Individual distro maintainers — the people actually packaging what users install — often have no business presence in any US state, let alone Illinois. The law’s own text limits scope to devices with “cellular or wireless connectivity,” which technically excludes desktop machines connected only via wired Ethernet. Virtual machines, containers, and OS instances running in a browser create additional jurisdictional grey areas the bill does not address.
Developers on Hacker News point out that an international maintainer team can simply decline compliance and dare Illinois to identify which Finnish kernel contributor is responsible. That logic is probably correct for pure FOSS distributions. It is less obviously correct for distributions with US-based corporate sponsors or commercial ties.
The Verification That Isn’t
There is a more fundamental flaw in HB5511: it never specifies how an operating system is supposed to verify a self-reported birth date. The law requires collecting a birth date during setup. It does not require confirming that birth date against any external source. A user who wants to lie about their age faces no technical barrier whatsoever. What the law mandates is a compliance cost — development time, API infrastructure, legal review — in exchange for a signal that will be wrong in any case where a minor is motivated to lie. Illinois is copying a model from California that has not yet been tested in court or proven functional, and shipping it without the parts that would make it less absurd.
What Developers Should Do Right Now
If you maintain a Linux distribution or open-source OS project with any US-based corporate structure, now is the time to review your legal exposure under HB5511 alongside Colorado’s SB 26-051 and California’s AB-1043. The three laws have different exemption regimes, different deadlines, and different penalty structures. They will not be the last. A federal version — the Parents Decide Act (H.R. 8250) — is advancing with similar scope and delegates implementation rules to the FTC.
For purely community-run distributions with no US legal entity, enforcement risk is low but not zero. For commercially-backed distributions operating inside the US, the Illinois AG now has a statute to work with. The law’s child safety goals are not unreasonable. Its implementation — drafted without understanding how Linux is actually built and maintained — is going to produce litigation before it produces safer apps.
Watch the EFF’s response over the coming months. A constitutional challenge on compelled-speech grounds (code as protected expression, per Bernstein v. U.S.) is likely. In the meantime, read the official text and compare Colorado’s approach — because your state may be next to copy it.
