Back in May, we reported that California lawmakers amended Assembly Bill 1856 to carve open-source operating systems out of the state’s upcoming age verification requirements. Three months later, that exemption survived the legislative process intact, and the bill has cleared both chambers of the California Legislature.
AB 1856 passed the California Senate on August 26 in a unanimous 40–0 vote. A day later, the Assembly voted 69–0 to concur with the Senate amendments, sending the measure to Engrossing and Enrolling, the final legislative preparation stage before it can be presented to Governor Gavin Newsom.
For Linux users and distributions, the bill’s most important part remains unchanged. Its definition of an “operating system provider” explicitly excludes an entity that distributes an operating system or application under license terms allowing recipients to copy, redistribute, and modify the software.
That language effectively leaves most traditional open-source operating systems, including Linux distributions, outside the scope of the OS-level requirements.
The provision first appeared during the bill’s journey through the Assembly and was already part of AB 1856 when we covered it in May. What is notable now is that it survived subsequent Senate amendments and remains in the version approved by both chambers.
For operating systems that are covered, AB 1856 builds on California’s Digital Age Assurance Act, which is scheduled to take effect on January 1, 2027.
Under the current text, when an operating system runs on a device and includes an account setup feature, its provider must offer an interface that asks the account holder for the birth date, age, or both, of the device’s primary user during account setup.
The operating system must then be capable of providing a digital age signal to covered application stores and application developers through a reasonably consistent real-time API.
Instead of exposing a precise birth date, the signal identifies one of four age ranges: under 13, 13 through 15, 16 through 17, or 18 and older. The bill describes this age-bracket information as nonpersonally identifiable data and requires providers to send only the minimum necessary information.
Covered application stores must request the signal from the operating system and make it available to developers. Developers, meanwhile, are required to request an age signal when an application is downloaded to and launched from a particular device.
The legislation has also changed significantly since the version that passed through the Assembly earlier this year.
Earlier drafts included explicit requirements involving web browsers and website operators. This created a broader chain through which an operating system could provide age information to a browser and ultimately to a website.
Those browser-specific provisions are no longer present in the bill that cleared the Legislature. The current framework instead centers on operating system providers, covered application stores, and application developers.
Websites have not disappeared entirely from the picture, however. When a developer receives an age signal, the bill can treat that information as “actual knowledge” of the user’s age range across certain related platforms and access points, including developer-operated websites through which the same user can create or access an account associated with the application.
The latest Senate amendments also make clear that entities cannot request these age signals whenever they want. A person may not request a signal from an operating system provider or covered application store unless required under the Digital Age Assurance Act or another applicable law.
There are also limits on how the information may be used. Operating system providers cannot share the signal with third parties for unrelated purposes, while developers are similarly prohibited from requesting more information than necessary or sharing the signal for purposes outside the law.
For devices configured before January 1, 2027, operating system providers would have until July 1, 2027, to provide an interface allowing the account holder to supply the age information needed for the signal.
Violations can carry substantial penalties. The bill provides for civil penalties of up to $2,500 per affected child for each negligent violation and up to $7,500 per affected child for each intentional violation, enforceable through an action brought by the California Attorney General.
At this point, AB 1856 has passed the Legislature but has not yet become law. The California Legislature currently lists it as an active bill that has passed, with the August 27 Assembly concurrence sending it to Engrossing and Enrolling.
Still, for the open-source community, the important development is already clear: the carve-out added earlier this year was not stripped out as the proposal moved through the Senate.
If AB 1856 ultimately becomes law in its current form, proprietary operating system vendors covered by the legislation will face new requirements around providing standardized age signals.
Most Linux distributions, by contrast, should remain outside those OS-level obligations thanks to the bill’s explicit exemption for software distributed under licenses that permit copying, redistribution, and modification.
