California Legislators Exempt Open-Source Software from Digital Age Assurance Act

In a significant pivot for digital policy, the California state legislature has successfully passed Assembly Bill 1856, a corrective measure that carves out critical exemptions for open-source operating systems from the state’s impending Digital Age Assurance Act. The bill, which moved through the Senate and Assembly with unanimous support in late August, effectively ends a year of intense industry debate regarding whether the open-source community—including distributions like Linux and the BSD family—would be forced to implement invasive age-verification protocols.

As the state prepares for the law’s primary activation on January 1, 2027, this legislative adjustment offers a reprieve for developers and privacy advocates who argued that the original mandate was technically incompatible with the decentralized nature of open-source software.

The Chronology of the Legislative Struggle

The path to AB 1856 was paved by months of mounting friction between lawmakers and the open-source community. The original Digital Age Assurance Act, signed into law by Governor Gavin Newsom last October, was designed to compel operating system providers and app store operators to verify the ages of their users to protect minors from harmful digital environments.

However, the bill’s broad language immediately triggered alarm within the tech sector. By defining "operating system provider" in a way that did not distinguish between proprietary giants like Microsoft or Apple and community-driven projects like Debian or Fedora, the law threatened to impose regulatory burdens on projects that lack the infrastructure, legal departments, or centralized data-collection mechanisms to comply.

• February 2024: Following intense lobbying from organizations like the Electronic Frontier Foundation (EFF) and various Linux kernel contributors, Assemblymember Buffy Wicks—the primary architect of the original act—formally introduced the amendment to carve out open-source software.
• August 21, 2024: The California Senate officially amended the bill to clarify the status of open-source entities.
• August 26, 2024: The Senate passed the amended AB 1856 in a definitive 39-0 vote.
• August 27, 2024: The State Assembly concurred with the Senate’s changes, finalizing the legislative process and sending the bill to Governor Newsom’s desk.

Redefining the Scope: What AB 1856 Changes

The core of the legislative fix lies in a precise redefinition of the term "operating system provider." The amendment explicitly excludes any entity that distributes software "under license terms that permit a recipient to copy, redistribute, and modify the software."

By tethering the exemption to established open-source licenses—such as the GPL, MIT, BSD, and Apache—the legislature has effectively created a "safe harbor" for the most common Linux distributions. Projects such as Arch Linux, Ubuntu, Fedora, and various BSD variants are now officially removed from the purview of the Digital Age Assurance Act.

Technical Exemptions and "Stand-Alone" Software

Beyond the operating system level, the bill addresses the practical reality of how modern software is distributed. A secondary exclusion removes software components that are not offered to consumers as "stand-alone executable applications" through a covered application store. This provision is vital for the Linux ecosystem, as it protects libraries, dependencies, and individual packages distributed via managers like apt or pacman.

Furthermore, the legislation clarifies the status of browser extensions and add-ons. By excluding storefronts that host software running exclusively within a host application, the bill prevents the unnecessary regulation of browser-based plugin repositories, which were previously caught in the ambiguous language of the original act.

Correcting the "Child" Definition

Perhaps the most notable oversight corrected by the new amendment was the original act’s definition of "user." The initial language classified every device owner in California as a "child" by default, effectively creating a catch-22: the law required an age-signaling framework where adults had to declare their age during setup to avoid being flagged as minors, but under the law’s own definitions, no one could ever reach the status of an "adult" user.

AB 1856 eliminates this circular logic, providing a more functional framework that recognizes the distinction between adult users and minors. This change is essential for the law to operate without rendering all devices on the California market effectively non-compliant from the moment of activation.

Safeguarding Data Privacy and API Integrity

A critical, often overlooked aspect of the amendment is a new provision prohibiting any entity from requesting an "age signal" from an OS provider or app store unless explicitly required by law.

In the original drafting, privacy advocates feared that the age-verification API—intended solely to protect minors—would become a goldmine for general-purpose data collection. By restricting the scope of these requests, lawmakers have effectively plugged a potential privacy loophole that could have allowed third-party developers to query a user’s age for commercial advertising or data mining, regardless of whether such information was necessary for safety purposes.

Additionally, the bill introduces a "good-faith safe harbor" clause. This provision shields developers and platforms from liability if the age-gating signals they receive from the OS are technically inaccurate. This offers a necessary layer of legal protection, acknowledging that while the state mandates the signal, the accuracy of that signal cannot always be guaranteed by the application developer.

Implications for Proprietary and Hybrid Ecosystems

While open-source software has found relief, the mandate remains firmly in place for proprietary ecosystems. Windows, macOS, iOS, and Android are fully within the scope of the Digital Age Assurance Act. These providers must prepare for a rigorous implementation schedule:

• January 1, 2027: Mandatory age collection at account setup for all new devices.
• July 1, 2027: Deadline for compliance for devices already in use or set up prior to the January deadline.

The status of hybrid environments remains a point of contention. SteamOS, for example, presents a complex case. While the underlying system components are Arch-based and open-source, the image is bundled with Valve’s proprietary Steam client. The law’s current language does not explicitly clarify where the line is drawn for such "mixed-source" products, leaving a potential gray area that may require future litigation or administrative clarification.

Similarly, privacy-focused mobile OS projects like GrapheneOS, which utilizes open-source licenses (MIT/Apache), now clearly fall outside the scope of the California law. However, as noted by the GrapheneOS development team, this does not grant them total immunity from global regulations, as they remain subject to various international laws, such as Brazil’s Digital ECA.

Conclusion: A Victory for Open Development

The passage of AB 1856 marks a rare and successful instance of legislative course-correction, driven by the persistent advocacy of the open-source community. By acknowledging that open-source development models are fundamentally incompatible with the top-down, centralized gatekeeping required by the Digital Age Assurance Act, California has avoided a scenario that would have effectively criminalized the distribution of free software within the state.

The amendment serves as a blueprint for how future digital regulation can be crafted to protect minors without stifling the decentralized innovation that powers the modern internet. As January 2027 approaches, the tech industry will continue to monitor how these compliance requirements are enforced, but for now, the open-source community can breathe a sigh of relief, knowing that their collaborative ethos remains protected by law.