California Exempts Linux From Age Verification Law

California's Senate just closed out a fight that Linux maintainers and the EFF have been pushing since February. AB 1856 passed the Senate 39 to 0 on August 26, 2026, and the Assembly signed off on the changes the next day, sending the bill to Governor Newsom's desk with open source carved out of the state's age verification mandate.

This isn't a new law. It's a patch on one that already exists. California's Digital Age Assurance Act, AB 1043, was signed back in October 2025 and would have forced every "operating system provider" to collect a user's age bracket at setup. Nobody wrote that with Debian ISOs or Arch installs in mind, and once developers noticed, the pushback was loud enough that Assemblymember Buffy Wicks, the same lawmaker who wrote the original bill, introduced the fix herself. What's still unsettled is how the exemption handles hybrid cases like SteamOS, and that ambiguity hasn't gone away just because the bill passed.

What the Senate Actually Voted On

The amendment doesn't repeal AB 1043. It rewrites the definition of who counts as an "operating system provider." Under the new language, that term no longer applies to anyone distributing software under a license that lets recipients copy, redistribute, and modify it. That single clause is why Debian, Fedora, Ubuntu, Rocky Linux, and the BSD family fall outside the law's reach, along with GrapheneOS.

The bill also cleans up a drafting error in the original law's definition of "user," and it adds a rule blocking companies from requesting an age signal unless they're actually required to under the law. That closes off a path where the age API could have turned into a general data collection tool that had nothing to do with age checks at all.

Which Distros Are Covered, and Which Aren't

For anyone running a mainstream distro at home or in production, the practical answer is simple: nothing changes. You won't see an age prompt during install, and you won't need to patch anything. Where it gets messier is at the edges, particularly for projects that blend open and closed components.

The Grey Areas Nobody Has Fully Answered

SteamOS is the case everyone keeps bringing up, and for good reason. Its base is Arch, which is squarely covered by the exemption, but Valve ships it with the proprietary Steam client bolted on. Whether that combination still counts as "distributed under a qualifying license" hasn't been tested, and neither the bill text nor Valve has said anything definitive about it.

Exempts open source operating systems from the requirement to collect and transmit users' age-bracket data.

- Electronic Frontier Foundation, May 2026

The EFF's read is worth remembering because it also flagged the other side of this bill. AB 1856 doesn't just carve out Linux, it expands age-gating obligations onto browsers and websites elsewhere in the same law. The open source fix landed, but it landed inside a bill that grew in scope while it moved through committee.

Why This Matters for Sysadmins and Package Maintainers

If you're maintaining packages or running enterprise Linux deployments in California, the exemption means you don't need to build age collection into an installer or a first-boot wizard. Dependencies pulled through apt or pacman are excluded too, provided they're not sold as standalone apps through something like a covered storefront. That distinction matters for anyone bundling Linux components into a commercial product, since the app store side of the law still applies to those.

Beginner-friendly projects like Zorin OS, along with gaming-focused builds like Bazzite, are the ones that had the most riding on this outcome. A mandatory age gate baked into an installer would have been a real maintenance burden for volunteer-run projects that never asked for it.

How Linux Users Are Reacting

The reaction from the Linux community has been more skeptical than celebratory. A lot of the discussion around the story circles back to one basic question: how would California actually enforce an age check on an operating system nobody controls once it's installed? Since root access lets anyone remove or bypass code they don't want, several people pointed out that a mandatory age-signal API would have been trivial to strip out or fork around, which made the whole requirement look unworkable from the start.

There's also a legal angle getting more attention than the exemption itself. Several commenters noted that the part of the law still binding on Windows, macOS, iOS, and Android looks a lot like compelled speech, and that Microsoft, Apple, and Google have far more resources to challenge it in court than any volunteer-run distro ever would. A few pointed out that going after a nonprofit project with a handful of maintainers and almost no assets, the kind of thing Linux Mint or similar community distros look like on paper, was never a fight the state was going to win anyway.

The other recurring thread is confusion over exactly which licenses qualify. While mainstream options like GPL, MIT, BSD, and Apache meet the statutory definition, the bill defines the exemption by specific redistribution terms rather than an explicit list of approved licenses. That has left community members asking where other licenses like ISC, Mozilla Public License (MPL), or CDDL land[cite: 3]. Distro maintainers on less common licenses may want official clarity before assuming they're automatically covered[cite: 3].

What Happens Next

Governor Newsom hasn't signed AB 1856 yet, and until he does, none of this is locked in. If he signs it, the exemption takes effect alongside the rest of the Digital Age Assurance Act on January 1, 2027. If you're weighing which distro to run next year and want something outside the uncertainty entirely, our 2026 distro picks and Fedora 44 overview are a good place to start, both squarely in exempt territory under the new language.