California and US state age verification legislation

California lawmakers passed Assembly Bill 1856 to exempt open-source software from the state’s Digital Age Assurance Act. The bill, sent to Governor Gavin Newsom, clarifies that operating system providers distributing software under licenses like GPL, MIT, or Apache—such as Debian, Fedora, and Ubuntu—are not subject to mandatory age-verification requirements. This exemption also extends to software components and libraries distributed via package managers.

However, proprietary systems including Windows, macOS, iOS, and Android remain subject to the law, which is scheduled to take effect on January 1, 2027. Experts suggest these requirements may trigger a global standard, as major tech companies often deploy uniform software builds worldwide. Under the Act, major operating systems would be required to request user age during device setup and share age ranges with applications.

As implementation approaches, legislative trends in other states like Colorado and Illinois are mirroring these efforts to move age verification from individual websites directly into device operating systems. Under these regulations, the age declared during setup would be categorized by the OS and transmitted as a data signal to all subsequently installed applications. This shift aims to ensure apps automatically recognize a user's age group.

Privacy advocates, including the Electronic Frontier Foundation (EFF), warn that while initial methods might allow simple birth date declarations, companies may eventually implement more invasive verification, such as facial scanning, government ID uploads, or biometric data, to mitigate legal liability. Critics argue this could lead to the end of online anonymity and increased digital surveillance. Additionally, the proposed federal Parents Decide Act could potentially expand such requirements to the operating-system level across the United States.