Notes ·
California Is Carving Linux Out of Its Age-Gating Law
Joshua MorrisThat is a significant correction.
California passed AB 1043 last year, requiring operating-system providers to collect a user's age or birth date during account setup and make an age-bracket signal available to applications and app stores beginning in 2027.
The idea was clearly written with platforms like Windows, macOS, iOS and Android in mind.
Then somebody had to answer the obvious question:
What exactly is an "operating system provider" when the operating system is Linux?
There may be no company controlling it.
There may be no mandatory online account.
There may be no central application store.
Anyone can copy it.
Anyone can modify it.
Anyone can redistribute their own version.
Trying to impose the same compliance architecture on Debian that you impose on Apple doesn't merely create an inconvenience.
It misunderstands how the software exists.
AB 1856 now tries to fix that.
The amended definition excludes a person or organization distributing an operating system or application under license terms that permit the recipient to:
copy
redistribute
modifyThat means software under licenses such as the GPL, MIT, BSD and Apache licenses generally falls outside the definition.
Debian, Fedora, Ubuntu, Arch and the BSDs should no longer be expected to somehow become California age-signaling platforms.
The Senate approved the amended bill 39-0 on August 26.
The Assembly concurred with the Senate amendments 69-0 the following day.
It is now headed to Gov. Gavin Newsom, who signed the original Digital Age Assurance Act last year.
This is a good example of why architecture matters in legislation
I don't think lawmakers were deliberately trying to force volunteer Linux developers to build identity infrastructure.
Linux was collateral damage from defining a category too broadly.
"Operating system" sounds like a reasonably straightforward thing until regulation attaches obligations to whoever provides one.
Apple provides iOS.
Microsoft provides Windows.
Then you get to Linux and the model starts falling apart.
Who provides Arch Linux?
Who is responsible for a fork somebody creates tomorrow?
What happens when I download source code, change it and build the operating system myself?
Where exactly is the centralized authority California expects to ask me how old I am?
There isn't one.
That is one of the fundamental properties of open-source software.
The law was trying to regulate a relationship that does not necessarily exist.
I am glad California appears willing to recognize that rather than forcing open-source projects to manufacture centralized infrastructure simply to satisfy the regulation.
The exemption is broader than Linux
There are a couple of other useful corrections in AB 1856.
Software components that are not offered to consumers as standalone executable applications through a covered app store are excluded from the definition of an application.
That matters for the enormous ecosystems of libraries and dependencies distributed through systems like apt and pacman.
The bill also carves out stores that distribute extensions or add-ons that operate exclusively within another application, which should keep browser-extension repositories from being treated like general-purpose app stores.
And it prohibits requesting an age signal when no law actually requires one.
That last part is important.
Once an operating system exposes a standardized age signal, it would be very easy for that infrastructure to become useful for things nobody originally intended.
A developer should not get to ask for my age merely because the operating system happens to have the answer.
The underlying law still deserves scrutiny
The Linux exemption doesn't resolve my broader concerns about age-gating infrastructure.
AB 1043 still applies to the large proprietary operating systems.
Beginning January 1, 2027, those systems are supposed to ask for age information during account setup and provide applications with an age-bracket signal.
The law itself does not require everyone to upload identification or submit to facial recognition.
But the Electronic Frontier Foundation has argued that the liability attached to getting these decisions wrong may create pressure for companies to verify ages more aggressively rather than simply trusting what users tell them.
That concern doesn't disappear because Linux gets an exemption.
It just means we aren't forcing decentralized open-source projects to participate in the same system.
GrapheneOS is an interesting beneficiary.
The project had already said it would rather stop selling devices in jurisdictions requiring age verification than redesign itself around collecting personal information.
Because GrapheneOS is distributed under open-source licenses that allow modification and redistribution, the new language appears to remove it from California's definition of an operating-system provider.
SteamOS is less obvious.
The underlying operating system is based on Arch Linux and contains enormous amounts of open-source software, but Valve distributes it alongside its proprietary Steam client and ecosystem.
That boundary may eventually make for an interesting test of what exactly qualifies for the exemption.
Open source turned out to be a useful constraint
What I like most about this change is that open source forced the legislature to confront an assumption hidden inside its original design.
The law assumed software has a provider.
The provider controls distribution.
The provider controls account creation.
The provider controls applications.
The provider can add an age-verification mechanism because the government tells it to.
That model happens to describe the dominant commercial computing platforms pretty well.
It does not describe computing itself.
Free software makes that obvious.
There is something healthy about keeping systems around that cannot easily be turned into centralized enforcement points because no single organization actually controls them.
California seems to have recognized that distinction before the law took effect.
That is good.
I would much rather see lawmakers correct a technically bad assumption after engineers point it out than defend it simply because the bill already passed.
The amendment still needs the governor's signature.
But assuming that happens, California will have done something surprisingly sensible:
It wrote a technology law broad enough to accidentally capture Linux, listened when people explained why that made no sense, and backed Linux out of it.