Illinois' new child-safety law quietly puts every OS on the hook for age-gating

Illinois HB5511, now Public Act 104-0664 and signed by Governor Pritzker on July 31, is being sold as a social-media law: it forces platforms like TikTok, Instagram, and Roblox to default minors into chronological feeds, cut off overnight notifications, and block contact from adult strangers. But buried alongside those provisions is a separate legal category, ‘operating system provider,’ with its own 2028 deadline and civil penalties. By January 1, 2028, anyone shipping an internet-connected OS — commercial or nonprofit — must add an age-declaration step at setup and expose an encrypted API that hands any requesting app an age bracket (under 13, 13–15, 16–17, or 18+). Once an app receives a ‘minor’ bracket, it’s legally deemed to have actual knowledge the user is underage, which triggers all the social-media protections.

The mechanism itself is self-declared rather than biometric, essentially centralizing the birthday prompt apps already use — hence the r/linux jokes about setting install dates to the Nixon era. The real problem is scope. The bill’s definitions of ‘covered manufacturer’ and ‘application store’ are broad enough to sweep in community-run, noncommercial open source projects that have no way to run an age-gated setup wizard, let alone a compliance team. Colorado hit the same issue and fixed it: SB26-051 explicitly exempts open-licensed operating systems, apps, code repositories, and container platforms. California is trying to patch its own AB-1043 gap via AB-1856. Illinois passed HB5511 unanimously (57-0 and 113-0) with no such carve-out.

Opposition was unusually broad. The EFF urged a veto, calling the bill a privacy and free-speech ‘nightmare’ and flagging open source specifically, while NetChoice — the trade group backing Google and Meta — objected on First Amendment grounds. Enforcement rests solely with the Illinois Attorney General, with no private right of action. Notably, the numbers don’t line up: the bill text caps penalties at $2,500 per child for negligent violations and $7,500 for intentional ones (mirroring Colorado’s template), yet the governor’s press release advertises fines of up to $50,000 per violation.