California age-verification law exempts open-source operating systems from OS-level requirements

California’s AB 1856 establishes a legal framework requiring proprietary operating system providers to integrate age-verification mechanisms. The law mandates that OS vendors offer an interface during account setup to collect the primary user’s birth date or age, then transmit this data as a non-personally identifiable age-bracket signal via API. This requirement applies only to systems that include account setup features, leaving headless or embedded deployments unaffected. The exemption for open-source systems, defined as those allowing copying, redistribution, and modification, removes compliance burdens for Linux distributions and similar projects.

The technical implementation costs fall primarily on proprietary OS vendors, who must design and maintain APIs capable of delivering age signals in real time. App stores and developers are then obligated to request and utilize these signals, creating a dependency chain that could introduce latency or failure points. The law’s focus on account setup means existing devices have a six-month grace period post-enactment to comply, but new deployments after January 1, 2027, must include the feature immediately. Engineers should note that the signal’s age brackets (under 13, 13 to 15, 16 to 17, 18+) are intentionally coarse to limit privacy risks.

Legal risks are concentrated on proprietary vendors and developers, with penalties scaling per affected child. The law’s language restricts age-signal requests to specific statutory requirements, preventing arbitrary data collection. However, the definition of “actual knowledge” extends age signals to developer-operated websites, potentially expanding compliance scope beyond mobile apps. The removal of earlier browser-specific provisions simplifies the framework but leaves ambiguity about how age signals interact with web-based services. Open-source projects remain unaffected, but downstream distributors of proprietary OS components may still face indirect obligations.

The legislative process preserved the open-source carve-out despite amendments, signaling political recognition of the ecosystem’s decentralized nature. For engineers, this means Linux-based systems avoid direct compliance costs, but proprietary OS integrations, such as Android or Windows, will require new infrastructure. The law’s reliance on age brackets rather than precise birth dates reduces some privacy risks but does not eliminate them, as the signal still constitutes regulated data. Developers must audit their data flows to ensure signals are only used for permitted purposes, as unauthorized sharing carries penalties.