California's Digital Age Assurance Act (AB 1043) was never supposed to reach a Debian install running on a decade-old ThinkPad. But as written and signed by Governor Newsom on October 13, 2025, the law's definition of "operating system provider" was broad enough to sweep in exactly that. Any entity distributing an OS that collects age data at account setup and transmits an age signal to app developers by January 1, 2027 qualified — and nothing in the statute distinguished a commercial platform with a single controlling vendor from a community-maintained kernel distributed under a copyleft license with no "account setup" step at all.
AB 1856 fixes that. It passed the Senate 40-0 on August 26, 2026 and cleared Assembly concurrence 69-0 the next day, per Phoronix, sending it to the Governor's desk. The fix is structural, not a carve-out list: any OS "distributed under license terms that permit a recipient to copy, redistribute, and modify the software" — GPL, MIT, BSD, Apache — falls outside the "OS provider" definition entirely. Debian, Fedora, Ubuntu, Arch, the BSD family and GrapheneOS are examples of that test being met, not a statutory roster Sacramento will need to update every time a new distro appears. Package managers like apt and pacman, plus browser extension stores, are separately excluded from the definition of "application." The bill also quietly fixes a drafting error EFF and others had flagged: AB 1043's original "user" definition — "a child that is the primary user of a device" — read literally as classifying every device owner in California as a minor.
The Case for the Original Mandate
It's worth taking the underlying law seriously before praising its retreat from Linux. AB 1043's actual design, as EFF has acknowledged, is more careful than most state age-verification statutes: it pushes age signals — a coarse bracket set once at the OS level — rather than mandating that every app or website individually collect a government ID or run facial-age-estimation software. That's a real improvement over Texas- or Louisiana-style app-store verification mandates, and it reflects a plausible policy instinct: if a device already knows roughly how old its user is, re-litigating that fact at every app install is redundant friction that pushes companies toward more invasive checks, not fewer. Legislators pursuing this framework can fairly argue they were trying to reduce, not expand, the total amount of identity data floating around the internet.
Why the Exemption Still Matters
That argument only holds if the signal stays confined to the OS layer and stays optional in practice — and AB 1043's liability structure never guaranteed either. A general-purpose definition that doesn't distinguish a vendor-controlled platform from a community-governed kernel imposes obligations that simply don't map onto how open development works: there is no single "provider" to fine, no central account-setup screen to instrument, and often no commercial entity at all standing behind a distribution. Applying a vendor-compliance framework to volunteer-maintained software would have meant either mass noncompliance the law couldn't sensibly enforce, or downstream commercial distributors and device makers absorbing costs never designed for them. AB 1856's fix is the correct one, and it's structural rather than a political favor to any single project — which matters, because the open-source ecosystem is exactly where over-broad definitions in tech statutes tend to land hardest and get noticed least.
The harder question is what's left standing. Windows, macOS, iOS and Android — the four platforms through which the overwhelming majority of Americans, including minors, actually access the internet — remain squarely in scope, with the same January 1, 2027 deadline. EFF's May 2026 review of the bill, while welcoming the open-source fix as "a definite win," maintained its broader objection to AB 1043's design: an age-bracketing mandate still pressures companies toward the kind of biometric and identity-verification infrastructure it was ostensibly meant to avoid, still burdens anonymous and pseudonymous use of the internet by adults, and still creates a single point of failure — the OS-level age signal — that didn't exist before. EFF's earlier draft review also flagged language extending signal-transmission duties to browsers and site operators; whether that specific provision survives in the enrolled text isn't clear from the bill's public language, but it illustrates the pattern critics are watching for: narrowing scope at the edges while the underlying architecture keeps room to grow.
The Actual Lesson
AB 1856 is a genuine, unanimous, bipartisan correction — the kind state legislatures should make more often when a statute's plain text outruns its intent. But it corrects a drafting error, not a policy debate. The real test of AB 1043 isn't whether Fedora needs an age gate; obviously it shouldn't, and now it doesn't. The test is what happens on the four platforms still facing a hard deadline in four months: whether an OS-level age signal stays a lightweight bracket, or becomes the precedent every future age-verification bill cites as the floor rather than the ceiling. California got the easy call right. The hard one is still pending.