California's Open-Source Exemption in Age Verification Law Sets Global Test Case

The California Exception

California’s Legislature has passed AB-1856, amending the Digital Age Assurance Act to carve out open-source software from its age-verification mandates. The bill, which cleared the Assembly with a unanimous 69-0 vote, redefines “operating system provider” and “application” to exclude software distributed under licenses that permit copying, redistribution, and modification.

The exemption covers Linux distributions, BSD variants, and similar platforms. It also shields package managers from being classified as standalone applications subject to age checks. For non-exempt software, the law takes effect January 1, 2027, requiring age collection at device setup and age-bracket signals for applications.

The vote follows months of concern that the original law could have swept up most Linux distributions, forcing developers to implement age gates on freely available code. AB-1856’s text draws a clear line: if your license lets users modify and redistribute, you’re not a regulated provider.

Who Wins, Who Loses

Open-source advocates win. The exemption preserves the foundational principle that software freedom includes the right to modify and redistribute without gating behind identity checks. Developers of Linux distros, BSD systems, and independent package managers can continue their work without building age-verification infrastructure. Projects like Ubuntu, Fedora, and Arch Linux avoid a compliance burden that would have disrupted their distribution models.

Commercial app stores and closed-source developers lose a degree of regulatory uniformity. They will still face age-verification requirements, potentially creating a compliance asymmetry between open-source and proprietary ecosystems. Apple’s App Store, Google Play, and Microsoft Store must implement age checks; open-source alternatives like Flathub or the Arch User Repository do not. This divergence could push some users toward open-source channels precisely because they bypass the new friction.

Consumers benefit indirectly: those who choose open-source platforms avoid the friction of age checks at device setup. However, the broader public may see increased scrutiny on non-exempt software as regulators seek to enforce the law. Parents, educators, and policymakers who support age verification will view the exemption as a loophole that undermines the law’s intent.

The Global Test Case

California’s move is more than a state-level adjustment; it’s a preview of how open-source principles collide with emerging regulatory frameworks worldwide. Countries grappling with digital age-gating—whether in the EU, UK, or Asia—will watch closely.

The exemption hinges on license terms that permit modification and redistribution. This creates a binary: software under permissive licenses (MIT, Apache, GPL) qualifies; software under restrictive licenses does not. Regulators elsewhere may adopt similar language, forcing a global classification of what counts as “open source” for legal purposes. That classification is already contested. The Open Source Initiative’s definition, the Free Software Foundation’s criteria, and the European Union’s own taxonomy all differ in subtle ways. California’s law adopts a functional test focused on distribution rights, not philosophical purity.

AI models pose the next frontier. Unlike Linux kernels, many AI models are distributed under licenses that allow use but restrict modification. Would they fall outside the exemption? California’s law currently targets operating systems and applications, but as AI integration deepens, lawmakers will confront whether foundation models are “software” or “services”—and whether open-source AI should receive the same carve-out. The EU’s AI Act, for instance, distinguishes between open-source and proprietary models but does not explicitly exempt them from age-related provisions.

The tension between regulatory compliance and open-source ethics is not new. Past conflicts over encryption exports, net neutrality, and data localization all tested the boundaries of software freedom. AB-1856 adds a new dimension: age verification as a gatekeeper for access, with open-source as the escape hatch. The exemption acknowledges that source-available software can serve public interests better when it remains unencumbered by identity checks.

What Happens Next

Legal challenges are likely. Critics may argue that the exemption creates an uneven playing field or that “open source” is too vague to serve as a legal definition. Courts will need to interpret whether a distribution that bundles proprietary code still qualifies. If a Linux distro includes closed-source drivers or firmware, does it lose its exemption? The bill’s text does not address hybrid distributions, leaving room for litigation.

The implementation timeline matters. With the law taking effect in January 2027, developers have roughly two years to adapt. Open-source projects may need to document their license terms clearly to avoid ambiguity. Package maintainers should ensure their packaging policies align with the exemption’s criteria—components that are not offered as stand-alone executables through covered app stores remain exempt, but boundary cases will require scrutiny.

Internationally, the European Union’s Digital Services Act and similar regimes may incorporate exemptions for open-source, or they may reject them outright. California’s decision could tip the balance toward recognizing software freedom as a legitimate policy consideration. Alternatively, other jurisdictions might narrow exemptions to protect their own regulatory agendas.

For now, the open-source community has secured a foothold. But the precedent is fragile. If regulators decide that age verification is essential enough to override license distinctions, the exemption could be narrowed or overturned. The battle lines are drawn: compliance versus openness, with California’s vote a decisive but not final chapter.

The Bigger Picture

California’s exemption is a tactical win, but the strategic war over digital regulation continues. As governments expand age-verification, data-collection, and content-moderation rules, open-source remains a flashpoint. Its decentralized nature makes it both hard to regulate and hard to exempt.

The open-source movement has long argued that software freedom is a public good. AB-1856 reflects that argument in legislative form, carving out a space where code can flow without identity gates. Whether that space holds will depend on how courts, regulators, and developers interpret the boundaries of the exemption. For now, Linux and its siblings have a shield. The question is how long it lasts.