Recently, a new California law signed by Governor Gavin Newsom caught my attention due to its potential impact on the open-source community, specifically Linux users. The legislation mandates that operating systems for PCs and other general computing devices like tablets and phones must implement a form of age verification during the initial account setup process.
I take a look at the implications of this law in my latest video.
While California is not the only state pursuing such measures—Texas recently faced legal hurdles over a similar law—this development raises questions about how open-source organizations, rather than traditional corporate entities, will comply.
The text of the California bill, which was signed on October 13, 2025, and takes effect on January 1, 2027, calls for an interface that requires the account holder to provide their birth date or age. This information generates a signal regarding the user’s age bracket—categorized as under 13, 13 to 16, 16 to 18, or over 18—to be read and enforced by applications within a covered app store.
The legislation defines an operating system provider broadly enough to include independent developers creating Linux distributions. Furthermore, a covered application store is defined as a publicly available online service, which could encompass command-line package managers used daily by Linux administrators.
From a practical standpoint, the current requirement relies entirely on self-reporting. Users are asked to volunteer their age, meaning anyone could input inaccurate information to bypass restrictions. Despite this, the penalties for non-compliance are clearly defined. Operating system makers face civil penalties ranging from $2,500 for negligent violations to $7,500 for intentional violations per “affected child.” If a developer has internal data showing a user’s actual age differs from the self-reported signal, they are legally obligated to act on that information or face action from the California Attorney General.
The implications for Linux distributions are notable. Commercial entities with a business nexus in California, such as the organizations behind Ubuntu and Fedora, will likely implement the necessary prompts to comply.
However, smaller projects face a different reality. Many distributions are maintained by volunteer groups without the financial resources or organizational structures to shield them from liability. Midnight BSD has already modified its software license to exclude California residents, but this legal maneuver may not satisfy California regulators if the software remains accessible for download within the state’s borders.
This legislative push is not confined to the West Coast. My home state of Connecticut is currently evaluating controls for minors on the internet, and Colorado is exploring operating system-level age verification. Texas attempted to regulate app stores before a federal court blocked the law, citing First Amendment concerns regarding its broad application. The absence of a unified federal privacy law has resulted in a fragmented regulatory landscape across different regions.
Historically, some internet users have responded to localized regulations by migrating to decentralized platforms. When Discord faced scrutiny over its age verification methods that included video selfies and government IDs, users began exploring open-source alternatives like Revolt and Matrix. These self-hosted and federated platforms demonstrate how technical communities can circumvent centralized data collection and restrictive legal mandates.
As the 2027 deadline approaches, it is likely that many Linux distributions will simply integrate a birth date or age prompt into their installation screens to mitigate legal risks. The technical challenge of passing that age signal consistently to various package managers and standalone applications remains a logistical hurdle. The coming months will test how far state authorities are willing to go in enforcing these mandates on the broader open-source software ecosystem.
