Abstract:
The California State Assembly recently passed House Bill 1856 (AB 1856), deciding to exclude open source operating systems from the scope of the state’s Digital Age Assurance Act. With only a few months left before the law is scheduled to take effect on January 1, 2027, the uncertainty about whether Linux distributions need to cooperate with age verification and collect user age data has basically been resolved.
The California Senate revised the bill on August 21 and passed it on August 26 with 39 votes in favor and 0 votes against. The California House of Representatives subsequently voted to approve the amendments the next day. Currently, AB 1856 is submitted to Governor Gavin Newsom. Newsom signed the original "Digital Age Safeguards Act" in October last year.
The revised bill redefines "operating system provider" to exclude any person or entity that distributes an operating system or application under a relevant license. These licenses must permit the recipient to copy, redistribute, and modify the software. Software using GPL, MIT, BSD and Apache licenses all meet this condition, so Debian, Fedora, Ubuntu, Arch and BSD series operating systems will no longer be bound by AB 1856.
The bill also excludes another category of software components: any software that is not "available to consumers as a stand-alone executable application through a regulated app store" is not an application within the legal definition. This means that library files and dependent components distributed through package managers such as apt and pacman will also be excluded.
AB 1856 does not explicitly stipulate that software repositories do not belong to app stores, but according to the law, the main obligation of app stores is to request user age signals from operating system providers and pass this signal to developers. Since exempted open source operating systems do not generate such age signals, it is actually difficult for related software repositories to fulfill the legally required procedures.
Additionally, the amendments exclude stores that only distribute extensions or add-ons that can only run inside the host application. This means that browser extension stores are no longer covered by the law.
This revision also deletes the definition of "user" in the original bill. The original definition described a user as "a person whose primary user of a device is a child," which technically would have resulted in all device owners in California being classified as children. The law's age signaling mechanism requires adults to declare their age when creating an account, and the device can then be labeled as "18 years and over"; but according to the original definition, in theory, no device can be labeled as an adult device.
The amendment also adds a provision that prohibits anyone from requesting age signals from operating system providers or app stores without legal requirements. This provision is intended to prevent age verification interfaces from being abused and becoming a general data collection channel when age verification is not required. Platforms and developers will also receive a good-faith immunity protection: if the signals on which age restrictions are based are incorrect, they will not be liable as long as the parties involved act in good faith.
Windows, macOS, iOS and Android will remain fully subject to the law. Starting from January 1, 2027, users must complete age data collection when setting up an account; for devices that have been set up before January 1, 2027, the deadline will be extended to July 1, 2027.
It is still unclear whether SteamOS falls within the scope of the law. SteamOS is based on Arch Linux, and its system components use open source software. However, Valve will distribute the system image together with the proprietary Steam client, so whether it meets the exemption conditions remains to be confirmed.
GrapheneOS fully adopts the open source MIT and Apache licenses. The project said in March this year that it refused to comply with the mandatory age verification requirement, so according to the new regulations of AB 1856, GrapheneOS will not be subject to this California law. However, Brazil’s Digital Children and Adolescents Act (Digital ECA) still applies to GrapheneOS.
AB 1856 was proposed by California Representative Buffy Weeks, who drafted both the Digital Age Safeguards Act and this amendment. She proposed the open-source software exemption in February, after Linux developers and the Electronic Frontier Foundation criticized the original law's potential impact on Linux systems.
Comments