California's AB 1043: The Age Verification Law That Could Kill

TL;DR

On October 13, 2025, Governor Newsom signed AB 1043, the "Digital Age Assurance Act." Starting January 1, 2027, every operating system (Windows, macOS, Android, iOS, every Linux distro, SteamOS) must collect users' age at account setup and provide a real-time API broadcasting that age bracket to any app developer who asks. The law passed 76-0 in the Assembly, 38-0 in the Senate. Google and Meta backed it. Not a single open-source organization testified against it. MidnightBSD has already modified its license to exclude California residents entirely. And the bill's definition of "application" is so broad it could cover apt install.

What the Law Actually Says

AB 1043, authored by Assemblymember Buffy Wicks (D-Oakland) and Senator Tom Umberg (D-Santa Ana), defines "operating system provider" as anyone who "develops, licenses, or controls the operating system software on a computer, mobile device, or any other general purpose computing device." ^[1]

Read that again. Anyone who develops an operating system for any general purpose computing device.

That's Canonical (Ubuntu). Red Hat (Fedora). The Debian Project. Arch Linux. Gentoo. Valve (SteamOS). The lone developer maintaining your favorite niche distro from a basement in Portland. All of them.

Here's what the law requires these "providers" to do:

Collect age information: Present an "accessible interface at account setup" requiring the account holder to indicate the birth date, age, or both, of the device's primary user
Build and maintain a real-time API (Provide a "reasonably consistent real-time application programming interface" that sorts users into four age brackets) under 13, 13 to under 16, 16 to under 18, and 18 or older
Broadcast that signal to every developer who asks: When any app is downloaded and launched, the developer can request the age bracket signal, and the OS must hand it over

The penalties? Up to $2,500 per affected child for negligent violations. Up to $7,500 for intentional ones. Enforced by the California Attorney General. ^[2]

One enforcement action against a volunteer-run Linux project could destroy it overnight.

The "Application" Problem

The law's definition of "application" makes things worse. AB 1043 defines it as software "that may be run or directed by a user on a computer, a mobile device, or any other general purpose computing device that can access a covered application store or download an application." ^[1]

On a Linux system running apt, flatpak, or snap (all of which are package managers that download applications) that language sweeps in everything. The Assembly Privacy Committee itself flagged this overbreadth risk during hearings. They recommended narrower definitions. ^[3]

Nobody listened. The bill passed unanimously anyway.

The "covered application store" definition excludes browser extensions and plug-ins, but says nothing about package managers, package repositories, or the command line. So when a Debian user runs apt install firefox, does apt need to query an age API first? The law doesn't say. And that ambiguity isn't academic: it comes with $7,500 fines attached.

How Linux Actually Works (And Why This Law Doesn't)

Here's the thing California's legislature apparently didn't consider: Linux distributions don't work like Windows or macOS.

There is no unified "account setup" on most Linux installs. You download an ISO from a mirror (one of thousands worldwide) burn it to a USB stick, and boot. The installer asks for a username and password. That's it. There's no "account" with a central authority. No registration server. No cloud portal. The whole point of many Linux distributions is that they don't phone home.

Building a "reasonably consistent real-time API" requires infrastructure. Servers. Maintenance. An always-on connection between every Linux device and some central system that stores and serves age bracket data. For volunteer projects running on donated server time and personal credit cards, that's not a technical challenge: it's a fantasy.

Consider what compliance actually requires:

Centralized account infrastructure: Something most Linux distros deliberately avoid
Real-time API servers: Paid for and maintained by... whom?
Age data storage: With all the security and privacy obligations that implies
Legal and compliance teams: Volunteers writing kernel patches don't have lawyers on retainer
Enforcement across global mirrors: Linux ISOs are downloaded freely from servers in every country on Earth

The Debian Project has about 1,000 volunteer developers worldwide. Their annual budget wouldn't cover a single compliance lawyer's retainer. But under AB 1043, they're subject to the same requirements as Apple and Google.

MidnightBSD's Answer: Ban California

MidnightBSD, an open-source BSD operating system, didn't wait around to see how this plays out. In early 2026, the project announced it would modify its license to exclude California residents from desktop use entirely, effective January 1, 2027: the same day AB 1043 takes effect. ^[4]

The reasoning was blunt: a volunteer project with no budget and no legal team cannot afford the risk of massive fines. So instead of building age-tracking infrastructure it can't afford, MidnightBSD chose to simply bar an entire state from using its software.

That decision raises its own problems. The Open Source Definition explicitly prohibits discrimination against persons or groups of persons. A geographic exclusion arguably violates that principle. MidnightBSD chose legal survival over open-source orthodoxy. ^[3]

And they won't be the last. On FreeBSD forums, users are already asking whether FreeBSD will be available in California come 2027. ^[5] The question is spreading across the open-source world.

Google and Meta Loved It

Here's where this gets uncomfortable. AB 1043 didn't pass despite tech industry opposition. It passed with their enthusiastic support.

In September 2025, Assemblymember Wicks announced that Google and Meta were among the bill's loudest cheerleaders. Google called it "one of the most thoughtful approaches we've seen thus far to the challenges of keeping kids safe." Meta "applauded" Wicks for advancing the bill. ^[6]

Think about why. Google already has your age. Meta already has your age. Apple already has your age. They collect it when you create your Google account, your Facebook account, your Apple ID. AB 1043 costs them almost nothing to implement: they just formalize data they already possess into a standardized API.

But for their competitors? For the small app stores, alternative operating systems, and open-source projects that offer people a way to use computers without handing Google or Apple their personal data? Those projects now face ruinous compliance costs or legal risk.

AB 1043 is a moat. The tech giants backed it because it raises the drawbridge on anyone trying to offer alternatives to their ecosystem.

The Surveillance Layer Nobody's Talking About

Supporters will tell you AB 1043 is "privacy-preserving" because it only uses self-declared age: no government ID required, no facial recognition, no biometric scans. Wicks herself claimed the bill "avoids constitutional concerns by focusing strictly on age assurance, not content moderation." ^[7]

That framing is misleading.

Yes, the initial age declaration is self-reported. But what AB 1043 actually creates is a persistent age-signaling layer embedded in every device. Your age bracket follows you from app to app, from session to session, broadcasting to every developer who requests it for the life of that device. You don't re-consent each time. The API just hands it over. ^[8]

And once a developer receives that signal, they're deemed to have "actual knowledge" of the user's age range: across all platforms and all points of access for that application, even if the user accesses it elsewhere without any age signal. That triggers obligations under COPPA, the CCPA, and California's Age-Appropriate Design Code Act. ^[2]

This is the real game. Today it's a self-reported age bracket. But once the infrastructure exists (once every operating system has a standardized API that broadcasts user categorization data to any developer who asks) what stops the next bill from requiring actual verification? Government ID. Biometric checks. Real identity, not just age.

We've seen this playbook before. The UK's Online Safety Act started with age verification for adult content. It ended with facial scans and government ID uploads, and then a vendor breach exposed over 70,000 identification images. Discord's compliance with UK requirements led to compromised ID photos and partial credit card details when a third-party verification vendor was hacked. ^[9]

AB 1043's self-declaration today is the onramp to identity verification tomorrow. The infrastructure is the point.

The Supreme Court Made It Worse

On June 27, 2025, the Supreme Court ruled 6-3 in Free Speech Coalition, Inc. v. Paxton that Texas's age verification law for adult websites passed constitutional muster. Justice Thomas, writing for the majority, held that the law "only incidentally burdens the protected speech of adults." ^[10]

The EFF didn't mince words. They called the ruling a decision that "tramples free speech and undermines privacy," arguing that online age verification fundamentally differs from showing an ID at a store because it requires users to "upload and submit (not just momentarily display) a data-rich government-issued ID." ^[11]

The ACLU echoed those concerns, noting that the decision could open the door to broader age verification mandates. ^[12]

That ruling changed the legal calculus for AB 1043. Before Paxton, age verification laws faced serious First Amendment challenges. After it, the constitutional ground shifted. California's bill (which only requires self-declaration, not ID uploads) is almost certainly on safer constitutional footing than the Texas law the Supreme Court just upheld.

Which means the courts probably aren't going to save Linux users from this one.

Where Were the Open-Source Defenders?

AB 1043 moved through the California legislature with zero formal opposition from the organizations that exist specifically to protect open-source software.

The legislative record shows no testimony from the Open Source Initiative. No submission from the Free Software Foundation. Nothing from the Software Freedom Conservancy. Silence from the Linux Foundation. ^[3]

The bill passed the Assembly 76-0 in June 2025. It passed the Senate 38-0 in September. Governor Newsom signed it on October 13, 2025. At every stage, the groups that should have been sounding alarms were absent. ^[1]

Why? Probably because the bill was framed as child safety legislation targeting app stores and big tech. The downstream impact on decentralized, volunteer-run open-source distribution wasn't part of the floor debate. Legislators were voting to "protect children": not to regulate whether a BSD developer in New Zealand can let Californians use their operating system.

But that's exactly what they did.

NetChoice, a tech industry trade group, did ask Newsom to veto AB 1043, arguing the state can't force platforms to become "roving online censors." The Chamber of Progress sent a similar veto request letter in September 2025. ^[13] ^[14]

But those organizations were fighting for Big Tech's interests, not for the Arch Linux maintainer or the Gentoo developer. The people most likely to be crushed by this law had no representation in the process that created it.

Newsom Knows It's Broken

Even Newsom's signing message acknowledged the problems. Despite approving the bill, the Governor explicitly called for follow-up amendments in the 2026 legislative session, citing concerns from streaming services and game developers about "complexities such as multi-user accounts shared by a family member and user profiles utilized across multiple devices." ^[15]

He signed a law he knew needed fixing. Assemblymember Wicks has signaled she's open to working on amendments in 2026. But as of March 2026 (with ten months until the law takes effect) no amendments have been introduced that would address the open-source problem. ^[15]

The window for the open-source community to engage California lawmakers and push for exclusions for decentralized, volunteer-run software is closing fast. The law takes effect January 1, 2027, with device compliance deadlines by July 2027. ^[3]

The Pattern: Age Verification as Identity Infrastructure

AB 1043 doesn't exist in a vacuum. It's part of a global push to build identity verification into every layer of the internet.

Texas HB 1181: Requires "commercially reasonable" age verification (meaning government ID) for adult websites. Upheld by the Supreme Court in June 2025. ^[10]
Utah and Louisiana: Passed similar app store accountability acts targeting mobile applications. Both require more invasive verification than California. ^[2]
UK Online Safety Act: Mandates age checks using facial scans, government IDs, or credit card digits. Already produced data breaches. ^[9]
KOSA (Kids Online Safety Act): The federal version, which directs agencies to study device-level age verification but hasn't passed Congress. ^[16]
Colorado: Introduced its own device-level age restriction bill in 2026, modeled on AB 1043. ^[17]

The direction is clear. Age verification at the website level. Age verification at the app store level. Age verification at the operating system level. Each step normalizes mandatory identity signaling and pushes it deeper into the technology stack.

And each step makes it harder to use a computer anonymously.

What Happens If You Just Lie?

Since AB 1043 relies on self-reported age (just typing in your birthday during setup) the obvious question is: why not just say you're 18?

Kids have been lying about their age on the internet since the internet existed. A birthday field during OS setup won't stop that. Supporters know this. The point isn't to actually verify anyone's age. It's to build the infrastructure.

Once the API exists, once every OS has a standardized age-signaling layer, the next bill can require real verification. ID uploads. Face scans. Third-party verification services. The pipes are already in place. You just change what flows through them.

That's why the "it's just self-declaration" argument misses the point entirely. The verification method can always be tightened later. The infrastructure, once built, stays.

What SteamOS and Gaming Face

Valve's SteamOS (the Linux-based operating system powering the Steam Deck) falls squarely under AB 1043's definition of "operating system provider." The Steam Deck is sold in California stores. Valve operates in the US. There's no jurisdictional escape here.

Valve already has Steam accounts with age information. So compliance might seem straightforward. But SteamOS can also be installed independently, on any PC, without a Steam account. And the law requires age collection "at account setup" for the operating system: not just for the app store. ^[1]

For gaming, this creates a strange dynamic. The Steam Deck running SteamOS would need OS-level age gating, even though Steam the store already has its own age checks. Two layers of age verification on the same device. And if SteamOS is installed on a regular PC by a California user who doesn't create a Steam account? That PC now needs an age-signaling API that doesn't exist.

The Dormant Commerce Clause Question

There's a constitutional angle that hasn't been tested yet. The Dormant Commerce Clause restricts individual states from regulating interstate (and by extension, international) commerce. ^[3]

Linux distributions are developed globally and distributed via worldwide mirror networks. A single-state law that effectively forces global development projects to either build compliance infrastructure or ban an entire state's residents arguably imposes an undue burden on interstate and international commerce.

There's also a compelled speech argument: source code has been recognized as protected expression, and forcing developers to build age-tracking infrastructure compels them to embed government-mandated speech into their software. ^[3]

But after Free Speech Coalition v. Paxton, courts are applying intermediate scrutiny rather than strict scrutiny to age verification laws. That's a lower bar for the government to clear. These challenges might fail.

Protect Yourself

If you're a Linux user in California (or anywhere) here's what you can do:

Contact Your State Legislators

AB 1043 amendments are still possible in the 2026 session. Push for exclusions covering volunteer-run, decentralized open-source projects. The law was drafted for Apple and Google: make them carve out the rest of us.

Support Open-Source Legal Defense

Organizations like the Software Freedom Law Center and the EFF will likely be involved if enforcement actions target open-source projects. Support them now.

Document the Problem

If you maintain an open-source project, publicly document why AB 1043 compliance is technically infeasible for your project. Create a paper trail. Legislators need to see concrete examples, not abstract arguments.

Don't Abandon Privacy-Respecting Tools

The worst outcome would be users giving up on Linux and open-source alternatives because a badly drafted law made them legally risky. The answer is fixing the law, not surrendering to the surveillance ecosystem.

The Bottom Line

California passed a law to protect kids from harmful apps. That's a goal worth pursuing. But AB 1043 doesn't just regulate Apple's App Store and Google Play. It pulls in every operating system on Earth, demands real-time age-tracking APIs from volunteer developers who can barely afford server costs, and creates infrastructure that will inevitably be expanded into full identity verification.

The open-source community was asleep when this passed. Google and Meta cheered it on because it cements their dominance. MidnightBSD banned an entire state rather than comply. And the clock is ticking: January 1, 2027 is ten months away.

If you think the right to use a computer without declaring your identity to an API is worth protecting, this is the fight. And it's already half over.

References

Internet ID Requirements: The Global Push. The worldwide movement toward mandatory online identification
Trump's AI Executive Order: When AI Investors Write AI Policy. How the federal government tries to override state tech regulations
State Privacy Laws 2025-2026 Guide. The patchwork of state laws shaping digital rights
Biometric Surveillance and Digital Identity. How biometric data feeds identity infrastructure
AI Surveillance: The Algorithmic Panopticon. How automated systems enable mass surveillance

California's AB 1043: The Age Verification Law That Could Kill Linux in America's Biggest State