\n
<\/p>\n
California\u2019s legislature has passed Assembly Bill 1856, exempting open-source operating systems from the State\u2019s Digital Age Assurance Act months before the law is due to take effect on January 1, 2027. The Senate amended the Bill on August 21 before passing it on the 26th in a 39-0 vote, with the Assembly then accepting these changes in a concurrence vote the following day. The amendment ends almost a year of uncertainty surrounding whether Linux distributions and SteamOS would be forced to collect user age data during account setup alongside Windows, macOS, iOS, and Android. AB 1856 has now been sent to Governor Gavin Newsom, who signed the original act into law last October.<\/p>\n
These amendments redefine the term \u201coperating system provider\u201d to exclude any person or entity that distributes an OS or application \u201cunder license terms that permit a recipient to copy, redistribute, and modify the software.\u201d Any software distributed under the GPL, MIT, BSD, and Apache licenses satisfies that test, which removes the likes of Debian, Fedora, Ubuntu, Arch, and the BSD family from AB 1856\u2019s scope.<\/p>\n
A second exclusion removes software components that aren\u2019t \u201coffered to consumers as a stand-alone executable application through a covered application store\u201d from the law\u2019s definition of an application, covering libraries and dependencies distributed through package managers like apt and pacman. AB 1856 doesn\u2019t explicitly say that repos aren\u2019t app stores, but a store\u2019s main obligation under the law is to request an age signal from the user\u2019s OS provider and pass it to developers; an exempt open-source OS produces no signal. A third carve-out excludes storefronts distributing extensions or add-ons that run exclusively inside a host application, which takes browser extension stores out of scope.<\/p>\n
Latest Videos From<\/span>Tom’s Hardware<\/span><\/span><\/p>\n The amendments to AB 1856 also remove the original definition of \u201cuser,\u201d which read, \u201ca child that is the primary user of a device,\u201d and technically classified every device owner in California as a child. The law\u2019s signaling framework depends on adults declaring their age on account setup, so their devices get flagged as 18 and over, but under that definition nobody could ever be flagged as an adult.<\/p>\n In addition, lawmakers inserted a new provision prohibiting anyone from requesting an age signal from an OS provider or app store unless required by law. That closes off potential abuse of the age API that could have led to it being used as a general-purpose data collection channel even when age verification wasn\u2019t required. Platforms and developers also gain a good-faith safe harbor against erroneous signals, protecting them from liability when age-gating signals are inaccurate.<\/p>\n Windows, macOS, iOS, and Android remain fully in scope, with age collection required at account setup from January 1, 2027. A later July 1, 2027, deadline applies to devices set up before January 1. Whether SteamOS is in scope isn\u2019t yet clear: its Arch-based system components are open source, but Valve distributes the image alongside the proprietary Steam client. GrapheneOS, which in March said it would refuse to comply with age-verification mandates, is distributed under open-source MIT and Apache licenses and now falls outside the law\u2019s scope entirely, though Brazil\u2019s Digital ECA still applies to it.<\/p>\n Assemblymember Buffy Wicks, who wrote both the Digital Age Assurance Act and the AB 1856 amendment, introduced the exemption back in February following criticism from Linux developers and the Electronic Frontier Foundation.<\/p>\n \n
\n You may like
\n <\/span><\/p>\n