California carves open-source OSes out of its 2027 age-verification law

California’s legislature has passed AB 1856, an amendment that pulls open-source operating systems out of the state’s Digital Age Assurance Act before it takes effect on January 1, 2027. The Senate approved the amended bill 39-0 on August 26, the Assembly concurred a day later, and it now awaits Governor Newsom’s signature. The change resolves nearly a year of doubt over whether Linux distributions and similar systems would have to collect user age data at account setup the way Windows, macOS, iOS, and Android will.

The mechanism is a redefinition of “operating system provider” to exclude anything licensed so recipients can copy, redistribute, and modify it — which sweeps in the GPL, MIT, BSD, and Apache licenses and thus Debian, Fedora, Ubuntu, Arch, and the BSDs. Two further carve-outs exempt libraries and dependencies delivered through package managers like apt and pacman, and browser-extension stores whose add-ons run only inside a host app. Lawmakers also fixed a drafting flaw in the original act, whose definition of “user” technically labeled every California device owner a child, making it impossible for anyone to be flagged as an adult.

The amendment adds two safeguards beyond the exemptions: no one may request an age signal from an OS provider or app store unless the law requires it, closing off the age API as a general-purpose data-collection channel, and platforms get a good-faith safe harbor against liability for inaccurate signals. The proprietary platforms stay fully in scope, with age collection mandated from January 1, 2027 (July 1, 2027 for pre-existing devices). SteamOS sits in a gray zone because Valve pairs its open-source Arch base with the proprietary Steam client, while GrapheneOS now falls outside the California law entirely — though Brazil’s rules still reach it.