California may let Linux bypass age check

The kids are alright. Open source operating systems like Linux and FreeBSD may soon be exempt from California's app and OS age verification requirements. Last October, California Governor Gavin Newsom signed the Digital Age Assurance Act (AB 1043) into law, which establishes age verification obligations for operating system providers, covered app stores, and application developers. Those distributing operating systems must provide "an accessible interface at account setup" for the user to indicate birth date, age, or both. The act, authored by Assemblymember Buffy Wicks (D-Oakland) and Senator Tom Umberg (D-Santa Ana), aims to protect children from online risks such as cyberbullying, sextortion, and mental health harms. It takes effect January 1, 2027. After AB 1043 was signed, Wicks in February introduced AB 1856 as an amendment to the law. Several changes have been made to the bill since then, the most salient for open source projects being the version published on May 18, 2026. That version includes the following additional language that creates an open source carve-out: (2) "Operating system provider" does not mean a person or entity that distributes an operating system or application under license terms that permit a recipient to copy, redistribute, and modify the software. So if the proposed amendment gets approved, Linux vendors should be off the hook for implementing age checks upon distro installation and launch. Whether that will apply to companies like Valve, which ships its proprietary Steam Client with its Linux-based SteamOS, isn't clear. MidnightBSD in February briefly included a clause in its license that banned California residents from using the operating system. But the following month, project developers set about exploring an age verification mechanism. The Electronic Frontier Foundation has been critical of AB 1043 for outsourcing censorship to app developers. Such rules harm "users' and developers' right to free expression, their digital liberties, privacy, and ability to create and use open platforms," the advocacy group said in March. "It also, perversely, entrenches the dominance of major operating system developers and device makers." At least 25 state age verification laws have already been enacted, and a West Virginia age verification law is scheduled to take effect next month. Colorado lawmakers have approved a state age verification bill that currently awaits approval from the governor. According to Carl Richell, founder and CEO of Linux laptop maker System76, it includes exemptions for open source operating systems, applications, code repos, and containers. In an SSRN paper released earlier this month, George S. Ford, chief economist of the Phoenix Center for Advanced Legal and Economic Public Policy Studies, a free-market think tank, expressed skepticism about the utility and cost of age verification laws. "The effectiveness of these laws at protecting minors is questionable, as motivated teenagers - who already use VPNs to bypass school filters - can easily circumvent age restrictions," he wrote, adding such laws will certainly impinge upon the First Amendment rights of adults by unduly burdening speech. Santa Clara University law professor Eric Goldman on Monday published a blog post looking at the impact age verification has on website traffic - the balk rate or refusal rate. The rate varies but for some sites like Pornhub, it can be as high as 99 percent. Citing the Supreme Court's assertion in Free Speech Coalition v. Paxton that adults have no First Amendment right to avoid age verification," Goldman argued that courts may not treat high balk rates as constitutionally significant, even if credential checks make online movement more constrained and costly. "[W]hoever is doing the centralized authentication won't do it for free," Goldman writes. "A small number of entities are poised to extract monopoly rents by taking a cut of this government mandated process." In 2021, the Age Verification Providers Association estimated that within the next 10-15 years, annual revenues from selling age verification services to OECD countries would reach about $11.4 billion (9.8 billion). And that was before the US states began implementing age verification laws. (R)