California amended AB 1043 to exempt open-source OSes from age tracking rules, narrowing liability as the bill moves toward a final vote.
California legislators have amended the state’s Digital Age Assurance Act (AB 1043), introducing an amendment under AB-1856 that gives open-source projects, including Linux distros like Debian, Arch, Ubuntu, and Mint, a free pass.
For context, AB 1043 is a law that legislators passed late last year to enforce age checks at the Operating System (OS) level. The law requires your device to collect your age during the initial device setup process, which then generates an “age bracket signal” that the device transmits to websites and applications. The original framework meant that every single operating system in California had to build a centralized tracking system to verify if a user was a minor.
The amended text narrows the scope of liable entities, replacing the previous definition of a “developer,” described as someone who “owns, maintains, or controls an application,” with:
“owns an application, or maintains or controls the hosting of the application in a covered application store.”
The amendment also excludes open-source projects from the definition of an operating system provider by stating:
“Operating system provider” does not mean a person or entity that distributes an operating system or application under license terms that permit a recipient to copy, redistribute, and modify the software.
In addition to that, the text specifies that:
“Application” does not include software components that are not themselves offered to consumers as a stand-alone executable application through a covered application store.
Furthermore, the bill clarifies that verification includes “age information shared with a developer by an account holder regarding the age of a user associated with the account.”
The new amendment comes after massive backlash from open-source advocates who warned that the original language would ruin decentralized developer infrastructure. For example, System76’s CEO, Carl Richell, lobbied lawmakers to secure exemptions for open-source operating systems, arguing that community-driven platforms cannot track user ages without violating basic privacy values.
While the open source world largely avoided the mandate, Big Tech giants accepted the regulation with little fight. Google and Apple are already designing a “Digital Credentials API” for Safari and Chromium to handle these requirements, while Microsoft plans to introduce an age-range API baked directly into the OS. Currently, AB-1856 has passed committee votes and is advancing toward a final assembly vote.
