Notes ·
California Is Carving Linux Out of Its Age-Gating Law
Joshua MorrisCalifornia lawmakers have passed an amendment that would exempt most open-source operating systems from the state's upcoming Digital Age Assurance Act. That is a significant correction.
California passed AB 1043 last year, requiring operating-system providers to collect a user's age or birth date during account setup and make an age-bracket signal available to applications and app stores beginning in 2027. The idea was clearly written with platforms like Windows, macOS, iOS and Android in mind. Then somebody had to answer the obvious question: what exactly is an "operating system provider" when the operating system is Linux?
There may be no company controlling it, no mandatory online account, no central application store. Anyone can copy it, modify it, or redistribute their own version. Trying to impose the same compliance architecture on Debian that you impose on Apple doesn't merely create an inconvenience—it misunderstands how the software exists.
AB 1856 now tries to fix that. The amended definition excludes distributing an OS or application under license terms that permit copy, redistribute, and modify. Software under GPL, MIT, BSD and Apache licenses generally falls outside. Debian, Fedora, Ubuntu, Arch and the BSDs should no longer be expected to somehow become California age-signaling platforms.
The Senate approved the amended bill 39-0 on August 26. The Assembly concurred 69-0 the following day. It is now headed to Gov. Gavin Newsom, who signed the original Act last year.
I don't think lawmakers were deliberately trying to force volunteer Linux developers to build identity infrastructure. Linux was collateral damage from defining a category too broadly. Who provides Arch Linux? Who is responsible for a fork somebody creates tomorrow? Where is the centralized authority California expects to ask me how old I am? There isn't one. I am glad California appears willing to recognize that rather than forcing open-source projects to manufacture centralized infrastructure simply to satisfy the regulation.
There are other useful corrections. Software components not offered as standalone executables through a covered app store are excluded—that matters for libraries via apt and pacman. Extension stores operating exclusively within another application are carved out too. And the bill prohibits requesting an age signal when no law actually requires one. Once an OS exposes a standardized age signal, it would be very easy for that infrastructure to become useful for things nobody originally intended.
The Linux exemption doesn't resolve my broader concerns about age-gating. AB 1043 still applies to the large proprietary operating systems. The EFF has argued that liability may pressure companies to verify ages more aggressively rather than simply trusting what users tell them. That concern doesn't disappear because Linux gets an exemption—it just means we aren't forcing decentralized open-source projects into the same system.
GrapheneOS is an interesting beneficiary—the project had already said it would rather stop selling devices in age-verification jurisdictions than collect personal information, and the new language appears to remove it from California's definition. SteamOS is less obvious: Arch-based underneath, but Valve distributes it alongside proprietary Steam. That boundary may eventually make for an interesting test.
What I like most is that open source forced the legislature to confront an assumption hidden inside its original design: software has a provider, the provider controls distribution and accounts, and the provider can add age verification because the government tells it to. That model describes the dominant commercial platforms pretty well. It does not describe computing itself. There is something healthy about keeping systems around that cannot easily be turned into centralized enforcement points because no single organization actually controls them.
The amendment still needs the governor's signature. But assuming that happens, California will have done something surprisingly sensible: it wrote a technology law broad enough to accidentally capture Linux, listened when people explained why that made no sense, and backed Linux out of it.