What Changed
In mid-July 2026, the California Legislature removed a provision from AB 1856 that would have extended the state's age-verification regime to web browsers and individual websites. The clause, added to AB 1856 as it moved through the Assembly earlier this year, would have required browser makers to request age-bracket signals from operating system providers and pass them along to any website that asked — effectively turning every browser into an age-checkpoint for the open web. The Electronic Frontier Foundation, which had opposed the expansion, confirmed the removal on July 15, writing that it "appreciate[s] that the Legislature has abandoned its plan to expand this problematic age-gating framework to browsers and websites," and dropped its opposition to the bill as a result.
What survives is the original law AB 1856 was amending: AB 1043, the Digital Age Assurance Act, authored by Assemblymember Buffy Wicks and signed by Governor Newsom on October 13, 2025. Under the statute's text, starting January 1, 2027, Apple and Google (and any other "covered" operating system provider) must present an interface at device account setup asking for the user's birth date or age, then expose that information to app developers as a real-time, four-bracket signal — under 13, 13-15, 16-17, or 18-plus — whenever an app requests it.
Steelmanning the Push for Age Signals
California lawmakers didn't invent this problem. State legislatures across the country have spent two years responding to genuine, well-documented harms: minors accessing pornography, gambling-adjacent apps, and predatory social features with no friction at all. Device-level age signals are, on paper, a more privacy-conscious answer than website-by-website identity checks — the phone or tablet already knows roughly how old its owner is, and routing a coarse bracket (not a birthdate, not a government ID) to an app is less invasive than uploading a driver's license to every service a teenager wants to use. Pushing the checkpoint to the OS layer, rather than to each of millions of individual sites, is a real attempt at proportionality, and the Legislature's decision to strip the browser clause shows it is capable of listening to that critique.
Why the Retreat Is the Right Call
That said, the browser-and-website expansion Sacramento just abandoned would have been a categorically different intervention than app-store gating. As EFF laid out when the clause first appeared, requiring every browser to relay age signals to every website on request would have made it "nearly impossible for regular internet users to avoid AB 1043's age gates" — collapsing the distinction between an app store, which can meaningfully gate access to a curated catalog, and the web itself, which is the default medium for speech, research, and commerce. Age-gating the browser is age-gating reading. Stripping that provision keeps California's law inside a defensible perimeter: it regulates commercial app distribution, not the open internet.
What Still Ships in 2027 — and Its Own Problems
The part of the law that remains is not without friction of its own. As Privacy Guides detailed on July 16, AB 1043 holds developers liable if they ignore "clear and convincing information" suggesting a user's real age differs from the OS-provided bracket — while civil penalties run up to $2,500 per affected child for a negligent violation and $7,500 for an intentional one, enforced by the state Attorney General. That liability structure sits awkwardly next to the law's own data-minimization language, which tells providers to collect only what's necessary. A platform facing five-figure exposure per mischaracterized minor has every incentive to gather more behavioral and identity signals than the bracket system requires, not less — the opposite of what the statute claims to want.
The Practical Reality
Apple and Google are unlikely to build a California-only onboarding flow; as with the CCPA before it, the more probable outcome is that AB 1043's birth-date prompt becomes a default step in device setup nationwide, whatever a user's actual state of residence. That gives California's Legislature outsized leverage over a national product decision through a state-specific liability threat — a dynamic worth watching independent of whether this particular bracket system is well-designed.
The Bottom Line
Removing the browser and website mandate from AB 1856 is a genuine, if narrow, win for an open web that doesn't require a login to read a news article or search a forum. But AB 1043's underlying liability architecture still nudges the two companies that control mobile computing for most of the country toward collecting more identity data than a privacy-protective age-bracket system should need. California got the harder call — browsers versus apps — right. It has not yet gotten the easier one — proportionate liability — right, and January 1, 2027 is five months closer than it sounds.