California Exempts Linux and Parks Age Checks on Apple

California on September 10, 2026, wrote Linux and other copyable operating systems out of its device-level age-check law. Assembly Bill 1856 was chaptered that day as Chapter 184 of the Statutes of 2026, amending the Digital Age Assurance Act. The age-signal rules still start on January 1, 2027 for Windows, macOS, iOS, and Android.

The birthday prompt remains. Apple, Google, and Microsoft still have to collect an age at account setup and pass a bracket to app stores. What changed is who counts as an “operating system provider” at all.

The Exemption Is Now on the Books

Assemblymember Buffy Wicks wrote both the original Digital Age Assurance Act, signed on October 13, 2025 as AB 1043, and this cleanup bill, introduced on February 11, 2026. The Senate passed AB 1856 39-0 on August 26, 2026. The Assembly concurred 69-0 the next day. The Secretary of State chaptered it on September 10, 2026.

The load-bearing sentence is a definition, not a product list. An operating system provider still means a person or entity that develops, licenses, or controls the operating system on a computer, phone, or other general-purpose device. It does not mean a person or entity that distributes an operating system or application under license terms that permit a recipient to copy, redistribute, and modify the software.

That test matches GPL, MIT, BSD, and Apache terms without naming any of them. Debian, Fedora, Ubuntu, Arch, and the BSD family fall out of the duty because of those three rights. The statute also pulls “application” off package-manager plumbing: software components that are not offered to consumers as a stand-alone executable through a covered application store are not applications under the title.

That language matches the May plan to exempt Linux, now enacted rather than proposed. A later Senate rewrite also dropped a plan to push the same age brackets into browsers and websites. The Electronic Frontier Foundation withdrew its opposition in July after that expansion came out, while still calling AB 1043 itself unconstitutional.

HOW AB 1856 REACHED THE STATUTE BOOK

1. October 13, 2025: Governor Gavin Newsom signs AB 1043 after a 76-0 Assembly vote and a 38-0 Senate vote.
2. February 11, 2026: Wicks introduces AB 1856 as a cleanup of the Digital Age Assurance Act.
3. May 18, 2026: The open-source carve-out is written into the definition of operating system provider.
4. May 28, 2026: The Assembly first passes the bill 68-1.
5. July 1, 2026: The Senate amends the bill; the browser and website expansion does not survive this phase.
6. August 26, 2026: The Senate passes the amended bill 39-0; the Assembly concurs 69-0 on August 27.
7. September 10, 2026: The measure is chaptered as Chapter 184 of the Statutes of 2026.

Newsom had already flagged cleanup work when he signed AB 1043, pointing to multi-user family accounts and profiles that move across devices. AB 1856 is that cleanup, plus the license test the Linux projects had asked for.

Which Operating Systems Still Have to Ask

The carve-out is a license test, not a kernel test. Google’s Android still sits on a Linux kernel, and it is still in. Google develops, licenses, and controls the product that ships on phones, and that product is not handed to users under terms that let them copy, redistribute, and modify the whole stack.

WHO THE AGE PROMPT STILL HITS

The duty only attaches if the operating system runs on a device and has an account setup feature. Covered providers then have to put an accessible interface at that setup that makes the account holder give the birth date, age, or both of the primary user, and they have to feed a digital signal to covered application stores and developers.

Android Is Still a Controlled Product

AOSP can be copied. The Android that arrives with Play services, a locked bootloader policy, and a store is a controlled product. The statute keys off who distributes what, and on what terms, not off whether a Linux kernel is somewhere in the stack. Phone makers that ship Google’s closed build stay in the same bucket as Apple.

The Test Is Three Rights, Not a Distro List

Wicks did not write “Linux” into the Civil Code. She wrote three rights a recipient must have: copy, redistribute, and modify. A vendor that ships a Linux-based image under a license that blocks those rights can still be an operating system provider. That is why a community ISO and a locked commercial image can share a kernel and split under the law.

Valve’s Steam Deck Problem Has No Answer

SteamOS is the commercial Linux product the statute never names. Its base is Arch. Valve ships official images with the proprietary Steam client and storefront on top. The client is not something a recipient may copy, redistribute, and modify as if it were pacman.

Steam is also, in plain reading, a covered application store: a platform that distributes and facilitates downloads of applications from third-party developers. Store duties in the title are separate from the operating-system-provider definition. Even a clean OS exemption would not, by itself, erase those store rules.

WHAT WE KNOW

• The Arch base: Community Arch, like other GPL-licensed distributions, is out of the operating-system-provider definition.
• The store role: A covered application store still has to request a signal from the user’s operating system provider and pass it to a developer on request.
• Valve’s silence: Valve has not said whether it treats SteamOS as exempt, in-scope, or split between the image and the client.

WHAT IS UNCONFIRMED

• The whole image: Whether Valve’s official SteamOS image is “distributed under license terms” that meet the three-rights test.
• The Deck in California: Whether a Steam Deck set up after January 1, 2027 must show a birthday interface.
• A hybrid split: Whether the open base can be exempt while the Steam client still owes store and developer duties.

Until Valve or the Attorney General draws that line, handheld Linux is the product class living in the gap. Bazzite and other community gaming images that ship under ordinary open terms have a cleaner claim to the carve-out than Valve’s own image does.

Colorado Built the Template First

The California sentence did not come from nowhere. System76, the Denver maker of Pop!_OS machines, spent the spring on Colorado SB26-051, the state’s age attestation bill. Founder and CEO Carl Richell has said the firm’s aim was to get a usable exemption into Colorado first, then carry that language west.

Our strategy was to establish an example in Colorado that could influence amendments in California. While I’m a bit in shock, it worked.

Carl Richell, founder and CEO, System76 blog

System76’s account of the exemption fight also notes a smaller, stranger detail: systemd added a birthdate field to user accounts after these bills landed, and Pop!_OS maintainers intend to ignore it. A username plus a birthday is, in their view, enough to identify a person, which is the opposite of what they want to store.

On May 25, 2026, Richell wrote that California had amended AB 1856 “to exclude open source software using the Colorado exemption example.” Colorado’s age attestation law was signed on June 3, 2026, as Chapter 343, with an effective date of July 1, 2028. California’s underlying duties still hit on January 1, 2027. The two states now share a license test and do not share a calendar.

The Age Bracket Follows the App

Exempting the OS author does not exempt the rest of the pipe. Covered application stores still have to request a signal from the user’s operating system provider. Developers still have to request a signal when an application is downloaded onto, and launched from, a particular device. Once they get it, they are deemed to have actual knowledge of that user’s age range, including on a website they own if the same account is used there.

That “actual knowledge” hook is the quiet enforcement engine. It does not ban speech in AB 1856 itself. It tells a developer that other laws, including child-privacy rules, now treat the age range as known even if the developer would rather not know.

DUTIES THAT SURVIVED THE CARVE-OUT

• The setup screen: A covered operating system with an account setup feature must take birth date, age, or both from the account holder.
• The four brackets: The signal must say whether the primary user is under 13, at least 13 and under 16, at least 16 and under 18, or at least 18.
• The store request: A covered application store must ask the operating system for that signal and hand it to a developer who asks.
• The developer request: A developer must ask at download and launch, treat the signal as the primary age indicator, and must not prompt the user to change the age.
• The extra-ask ban: A person shall not request a signal for a particular user unless this title or another law requires it.

Violations are civil, and only the California Attorney General can sue. The cap is $2,500 per affected child for each negligent violation and $7,500 per affected child for each intentional violation, plus an injunction. There is a good-faith safe harbor for an erroneous signal when the provider or developer is working within available technology and reasonable outages.

Devices that already finished account setup before January 1, 2027 get a second clock. Covered operating system providers have until July 1, 2027 to offer an interface that lets the account holder add the age data. Developers of apps last updated on or after January 1, 2026 that were downloaded before the new year, and that have not yet asked for a signal, also have until July 1, 2027 to ask.

GrapheneOS Gets a Clean Exit

Before the carve-out was real, several projects said they would not build the prompt. GrapheneOS said it would not collect personal information to satisfy age-check laws. MidnightBSD briefly banned California residents rather than ship a birthday screen, then looked at building one. Ageless Linux launched as a protest distribution, calling itself in “full, knowing, and intentional noncompliance” with AB 1043.

GrapheneOS ships under MIT and Apache terms, which meet the three-rights test. In California, that project no longer has to choose between a prompt and a refusal. Brazil’s Digital ECA is a separate problem and still applies to it. Community Linux on a PC or a phone that the user flashes themselves is now on the same California footing as Debian.

More than 400 computer scientists had signed an open letter against this class of law, arguing it builds surveillance gear without stopping minors from reaching restricted content. The letter did not move AB 1043. The volunteer-maintainer revolt, plus the Colorado draft, did move the definition of who has to comply.

A Free ISO Becomes the Legal Off-Ramp

A teenager with an iPhone still meets the prompt, because iOS is in. A teenager who downloads an Ubuntu ISO does not, because Canonical distributes that system under terms the statute itself treats as beyond its reach. The same split applies to a parent who reinstalls a used PC. The law now follows the lock on the software, not the presence of a child in the house.

That is a lawful bypass the text creates. It is also a narrow one. Most children in California will still set up a phone that Apple or Google controls. The people who can walk around the gate are the people who can install an operating system, which is a smaller group with a louder privacy habit. Closed platforms absorb the compliance cost. Copyable systems absorb the users who refuse the cost.

SteamOS is the leftover commercial case, and January 1, 2027 is still the day Windows, macOS, iOS, and Android have to show the screen. Linux installers will not. The statute is finished. The hole it cut is the product.

Frequently Asked Questions

Does California’s age signal law require a photo ID?

No. AB 1856 and the Digital Age Assurance Act ask an account holder to type a birth date, an age, or both at setup. They do not require a government ID, a selfie, or a face scan. Developers are also told not to prompt the user to change the age information once it is in.

Does California exempt GitHub, GitLab, and containers the way Colorado does?

Not in the same words. Colorado’s signed SB26-051, after talks led by System76, was described as carving out open-source operating systems and apps, public code repositories such as GitHub and GitLab, and containers such as Docker and Podman. California’s chaptered text uses the three-rights license test and the stand-alone-app definition. It does not name repositories or containers.

Are browser extensions treated as apps under AB 1856?

A covered application store does not include an online service or platform that distributes extensions, plug-ins, add-ons, or other software that runs exclusively inside a separate host application. A browser add-on that never leaves the browser is outside that store definition. A stand-alone executable offered through a public store is not.

Can a company ask for an age signal if no law requires it?

No. Civil Code section 1798.501(e) says a person shall not request a signal for a particular user from an operating system provider or a covered application store if this title or another applicable law does not require it. The same title also tells providers to send only the minimum information needed to comply.

When do apps installed before 2027 have to catch up?

If an application last updated on or after January 1, 2026 was downloaded before January 1, 2027, and the developer has not yet requested a signal for that user, the developer must request one from a covered application store or an operating system provider before July 1, 2027. That catch-up is separate from the July 1, 2027 interface deadline for devices whose accounts were already set up.

Disclaimer: This article is news reporting on California civil statutes and related state bills. It is for information only and is not legal advice, a compliance manual, or an opinion on whether any specific product, image, or store meets the license test in Civil Code section 1798.500. Operating system projects, device makers, and store operators should consult a California-licensed attorney before changing setup flows, licenses, or distribution terms. Vote counts, effective dates, penalty caps, and bill status reflect the enrolled text and legislative trackers cited here and can change if a later statute or court order amends them.