California lawmakers unanimously pass Linux exemption from age-verification law

California lawmakers unanimously pass Linux exemption from age-verification law - software distributed under the GPL, MIT, BSD, and Apache licenses are exempt AB 1856 excludes open-source operating systems from the upcoming Digital Age Assurance Act. California’s legislature has passed Assembly Bill 1856, exempting open-source operating systems from the State’s Digital Age Assurance Act months before the law is due to take effect on January 1, 2027. The Senate amended the Bill on August 21 before passing it on the 26th in a 39-0 vote, with the Assembly then accepting these changes in a concurrence vote the following day. The amendment ends almost a year of uncertainty surrounding whether Linux distributions and SteamOS would be forced to collect user age data during account setup alongside Windows, macOS, iOS, and Android. AB 1856 has now been sent to Governor Gavin Newsom, who signed the original act into law last October. These amendments redefine the term “operating system provider” to exclude any person or entity that distributes an OS or application “under license terms that permit a recipient to copy, redistribute, and modify the software.” Any software distributed under the GPL, MIT, BSD, and Apache licenses satisfies that test, which removes the likes of Debian, Fedora, Ubuntu, Arch, and the BSD family from AB 1856’s scope. A second exclusion removes software components that aren’t “offered to consumers as a stand-alone executable application through a covered application store” from the law’s definition of an application, covering libraries and dependencies distributed through package managers like apt and pacman. AB 1856 doesn’t explicitly say that repos aren’t app stores, but a store’s main obligation under the law is to request an age signal from the user’s OS provider and pass it to developers; an exempt open-source OS produces no signal. A third carve-out excludes storefronts distributing extensions or add-ons that run exclusively inside a host application, which takes browser extension stores out of scope. The amendments to AB 1856 also remove the original definition of “user,” which read, “a child that is the primary user of a device,” and technically classified every device owner in California as a child. The law’s signaling framework depends on adults declaring their age on account setup, so their devices get flagged as 18 and over, but under that definition nobody could ever be flagged as an adult. In addition, lawmakers inserted a new provision prohibiting anyone from requesting an age signal from an OS provider or app store unless required by law. That closes off potential abuse of the age API that could have led to it being used as a general-purpose data collection channel even when age verification wasn’t required. Platforms and developers also gain a good-faith safe harbor against erroneous signals, protecting them from liability when age-gating signals are inaccurate. Windows, macOS, iOS, and Android remain fully in scope, with age collection required at account setup from January 1, 2027. A later July 1, 2027, deadline applies to devices set up before January 1. Whether SteamOS is in scope isn’t yet clear: its Arch-based system components are open source, but Valve distributes the image alongside the proprietary Steam client. GrapheneOS, which in March said it would refuse to comply with age-verification mandates, is distributed under open-source MIT and Apache licenses and now falls outside the law’s scope entirely, though Brazil’s Digital ECA still applies to it. Assemblymember Buffy Wicks, who wrote both the Digital Age Assurance Act and the AB 1856 amendment, introduced the exemption back in February following criticism from Linux developers and the Electronic Frontier Foundation. Get Tom's Hardware's best news and in-depth reviews, straight to your inbox. Follow Tom's Hardware on Google News, or add us as a preferred source, to get our latest news, analysis, & reviews in your feeds. Luke James is a freelance writer and journalist. Although his background is in legal, he has a personal interest in all things tech, especially hardware and microelectronics, and anything regulatory. - Bigshrimp It's interesting that they made those exemptions. I wonder how long it will take for them to take those exemptions away in the future. I know more people will migrate to the exempt platforms after the law goes into effect, so that may accelerate them to removing those exemptions eventually.Reply Plus it seems that a lot of other states and countries are putting age verification on the books to try to pass similar laws. Ageless Linux is a good website to keep track of these laws and what FOSS Linux distros are for or against age verification. https://agelesslinux.org/index.html - USAFRet Reply People have had 2 decades to change to an open source OS.Bigshrimp said:I know more people will migrate to the exempt platforms after the law goes into effect, so that may accelerate them to removing those exemptions eventually. They have not done that in any real numbers. What makes you think they will now? - Bigshrimp Reply Here are some of my thoughts since you asked. SteamOS is around now, more awareness about age verification for at least the people that are paying attention, and those same people wanting privacy for obvious reasons. I can't speak for everyone, and there will always be people that consider losing their privacy as a good thing, because of "think of the kids".USAFRet said:People have had 2 decades to change to an open source OS. They have not done that in any real numbers. What makes you think they will now? - USAFRet Reply My thought is that any age verification thing in Windows or macOS will be so innocuous as to pass right by.Bigshrimp said:Here are some of my thoughts since you asked. SteamOS is around now, more awareness about age verification for at least the people that are paying attention, and those same people wanting privacy for obvious reasons. I can't speak for everyone, and there will always be people that consider losing their privacy as a good thing, because of "think of the kids". People won't notice it happening. Or care. - Bigshrimp Reply For most layman, I agree. We may still see an increased move to FOSS platforms for the non-layman that are still using the Windows and/or Mac platforms. We shall see either way.USAFRet said:My thought is that any age verification thing in Windows or macOS will be so innocuous as to pass right by. People won't notice it happening. Or care. - ifitwasnt4u This is awesome, but the fact that the PRC (peoples repugnant of California) passed a law forcing age verification to log into a computer is complete nonsense!!! This along with the 3D printer changes, this world is coming to an end. Our dystopian future awaits us... We did it to ourselves.Reply - derekullo I actually have this shirt ! :PReply https://m.media-amazon.com/images/I/B1pppR4gVKL.CLa%7C2140%2C2000%7C71Uxm1KqrjL.png%7C0%2C0%2C2140%2C2000%2B0.0%2C0.0%2C2140.0%2C2000.0_AC_UY1000.png - Bigshrimp Democrat and Republican run states are pushing the same laws. It's not a one sides thing at all, it's a whole of government push and it's an international push too. I agree with the basic premise of your statement about losing anonymity though. They are using the whole "think of the kids" to push these laws everywhere.Reply Edit: Hmm, the comment that I was responding to was deleted.