California lawmakers have passed a bill removing operating systems distributed under permissive licences from the state’s incoming requirement that platforms broadcast a user’s age bracket to app stores and developers.
AB 1856 cleared the Senate 39 to 0 and the Assembly concurred in the Senate amendments 69 to 0, sending the measure to engrossing and enrolling. It now awaits the governor.
The bill amends the Digital Age Assurance Act, passed last year as AB 1043, which takes effect on January 1, 2027. Under that law an operating system provider must present an interface at account setup asking the account holder for the birth date or age of the device’s primary user, then emit a signal describing that user’s age bracket.
The brackets are coarse: whether the user is under 13, at least 13 and under 16, at least 16 and under 18, or at least 18. The signal is age bracket data delivered to an application through a real-time secure programming interface or the operating system itself.
The exemption turns on licence terms rather than on the identity of the developer. AB 1856 provides that an operating system provider “does not mean a person or entity that distributes an operating system or application under license terms that permit a recipient to copy, redistribute, and modify the software.” Software released under the GPL, MIT, BSD and Apache licences meets that test, which takes Debian, Fedora, Ubuntu, Arch and the BSD family out of scope.
Assembly Member Buffy Wicks wrote both the Digital Age Assurance Act and this clean-up bill. The open-source carve-out was added by amendment before the bill cleared the Assembly 68 to 1 in May. It followed objections from open-source developers and the Electronic Frontier Foundation, which argued the compliance burden fell disproportionately on the volunteer-maintained projects underpinning much of the web.
The bill also deletes the act’s definition of “user,” specifies that the signal goes to a covered application store or an application developer, and bars anyone from requesting a signal about a particular user unless the act or another law requires it.
The version that passed the Assembly would also have pushed the age-bracketing duty out to web browsers and website operators, an expansion the EFF opposed on speech, privacy and anonymity grounds. The Senate stripped it out. The enrolled text contains no browser provisions, leaving the duty on operating systems and app stores where AB 1043 put it.
US states have diverged on where to place the age-checking duty, with Ohio tightening its rules, Kansas reaching for app stores and South Dakota retreating. California put the obligation on the operating system.
Sources: California Legislative Information, Electronic Frontier Foundation
–
By the ID Tech Editorial Team
