California’s Digital Age Assurance Act (AB 1043), signed by Governor Newsom in October 2025, required any “operating system provider” to collect user age at account setup and transmit age laws signals to app developers by January 1, 2027. AB 1856, passed unanimously in late August 2026, rewrote who qualifies as a provider — and open-source projects got a clean exit.
What AB 1856 Actually Changed
A redefined “OS provider” and several targeted carve-outs give open-source platforms a clear path out of California’s age-verification mandate.
- Any OS distributed under licenses permitting copying, redistribution, and modification — GPL, MIT, BSD, Apache — is excluded from the “OS provider” definition entirely
- Platforms falling outside the law’s scope include Debian, Fedora, Ubuntu, Arch, the BSD family, and GrapheneOS — examples of software licensed under those qualifying terms, not a statutory list
- Package managers like apt and pacman, plus browser extension stores, are carved out — they don’t qualify as “applications” under the amended law
- The original AB 1043 defined “user” as “a child that is the primary user of a device,” which technically classified every California device owner as a minor (yes, every single one); AB 1856 quietly deletes that definition
- The California Senate passed AB 1856 39–0 on August 26, 2026; the Assembly concurred on August 27; the bill now awaits Governor Newsom’s signature
The Electronic Frontier Foundation confirms AB 1856 “exempts open-source operating systems from the requirement to collect and transmit users’ age-bracket data” — but EFF also warns the bill expands age-gating in other areas. File this one under “progress, not victory.”
Four major platforms — Windows, macOS, iOS, and Android — remain fully in scope. New California device setups must include an age prompt by January 1, 2027. Pre-existing devices get until July 1, 2027. AB 1856 also blocks entities from requesting age signals unless legally required, limiting the API from metastasizing into a general-purpose surveillance app-style data-collection channel. Developers acting on erroneous signals receive a good-faith safe harbor.
SteamOS sits in genuine legal limbo. Its system components are Arch-based and open source, but Valve bundles the whole image with the proprietary Steam client. The law doesn’t resolve this. For the millions running SteamOS on a Steam Deck, that ambiguity is the entire ballgame.
What This Means for Everyone Else
If your next device setup happens in California after January 1, 2027, an age prompt is coming — and the regulatory ripple effects may travel well beyond state lines.
Anyone setting up a new iPhone, Android phone, Windows PC, or Mac in California after January 1, 2027 will encounter an age prompt before reaching the home screen. Assemblymember Buffy Wicks authored both AB 1043 and its corrective amendment — AB 1856 arrived after sustained backlash from Linux developers and EFF criticism made the original scope untenable. California is now the first state to test OS-level age enforcement at scale, and other states are watching.
The open-source question is settled. Whether OS-level age enforcement survives legal challenges, spreads across state lines, or sets international precedent — that clock just started running.
