California Exempts Open Source but Expands Age-Gating#
California’s AB 1856 moves to relieve open-source operating systems from mandatory age-bracketing rules, but simultaneously expands the regime to browsers and websites. The Assembly passed the amendment nearly unanimously, easing the compliance burden on open-source developers while leaving broader privacy and speech risks intact.
What Changed#
AB 1856 amends last year’s AB 1043, which required operating systems and app stores to segment users by age. The update now exempts open-source operating systems from collecting or transmitting users’ age data. This means projects that anyone can copy, redistribute, or modify are less likely to face legal pressure to implement invasive age verification.
At the same time, AB 1856 extends age-gating obligations to all web browsers and websites. While the open-source exemption is a relief, the overall framework now pulls more services and users into a system that incentivizes age verification, data collection, and potentially biometric checks.
Why It Matters#
Mandated age-gating risks users’ speech, privacy, and anonymity. Even without explicit age verification requirements, liability structures in AB 1043 and 1856 push companies toward intrusive checks. Expansion to browsers and websites increases exposure, making it harder for users to avoid invasive data collection and adding operational burdens for developers.
Open-source projects are partially shielded, but commercial products incorporating open-source components may still face uncertainty. The law’s wording leaves gaps in defining which entities qualify for exemptions.
What to Check#
- If you maintain or use open-source operating systems, confirm whether your project falls under the “operating system provider” exemption.
- For web services and browser providers, evaluate potential obligations to collect age data and the operational risk of storing sensitive user information.
- Monitor AB 1856 as it moves through the Senate; final text could clarify or further shift compliance requirements.
What Not to Overclaim#
The exemption does not remove all privacy or operational concerns. It relieves only open-source operating systems from the age data collection mandate. The broader age-gating expansion still carries significant implications for user privacy and developer liability.