The California State Senate and Assembly have officially approved the open source software amendments known as AB-1856 to California’s age verification law. These amendments, which can be viewed at https://legiscan.com/CA/bill/AB1856/2025, now include an exception for projects under open licenses. This exception allows for the copying, distribution, and modification of the code, a significant step towards promoting open source software development.
The new version of the law also brings about changes to the definitions of “operating system provider” and “application” to which age verification requirements apply. Individuals and legal entities distributing operating systems or applications under open licenses are now excluded from the law, providing some relief for open source developers and distributors.
Further exceptions have been approved for distributors of software that is not offered as separate executable files through application catalog stores, as well as for platforms distributing add-ons for applications. This means that browser add-on directories and packages distributed through repositories like apt, dnf, and pacman are now outside the scope of the law.
Under these new requirements, open source application developers and distributions like Fedora, Ubuntu, Arch Linux, and Debian are no longer obligated to comply with age verification regulations. However, the status of distributions like SteamOS, which may contain proprietary components, remains unclear under the amended law.
The California Age Verification Act now mandates that operating systems have the capability to indicate the user’s age during account registration, and that applications have a way to determine the age of the current user. Applications must be able to receive age information from the operating system in four categories: under 13, 13-16, 16-18, and 18 and older.
Developers are required to use this age information to adhere to child online protection laws, with penalties of up to $2,500 for unintentional violations and up to $7,500 for willful violations per affected child. The law will take effect in California on January 1, 2027, and in Colorado on July 1, 2028.
Furthermore, on March 17 in Brazil, the law 15.211/2025 was also passed, signaling a global effort towards regulating age verification practices in software development. More information on this law can be found at https://www.planalto.gov.br/ccivil_03/_ato2023-2026/2025/Lei/L15211.htm.