Loading story…
California lawmakers unanimously passed AB 1856, exempting qualifying open-source operating systems, applications, software components, and extension storefronts from the state’s Digital Age Assurance Act. Sent to Governor Gavin Newsom, the measure would remove uncertainty over whether Linux distributions and package-management ecosystems would have to collect or transmit users’ age information; software under GPL, MIT, BSD, and Apache licenses is covered by the exemption.
The underlying age-assurance requirements are due to apply to proprietary platforms including Windows, macOS, iOS, and Android from January 1, 2027. AB 1856 also narrows the definition of a user, limits unnecessary age-signal requests, and creates a good-faith safe harbor for inaccurate signals. The exemption addresses concerns that broadly drafted child-safety and app-store laws—including Colorado SB51 and Brazil’s Digital ECA—could otherwise extend to Linux repositories and package managers such as apt, dnf, and pacman, creating compliance and privacy burdens for distributions including Debian, Ubuntu, Fedora, and Arch Linux.
See the reporting duties and controls this puts on the clock.
6 events from the most recent confirmed update back to the earliest known activity.
Following legislative passage, AB 1856 was sent to Governor Gavin Newsom for consideration.
The California Assembly accepted the Senate's amendments to AB 1856 in a concurrence vote, completing legislative passage of the open-source exemption measure.
The California Senate passed AB 1856 by a 39-0 vote. The measure exempts qualifying open-source operating systems, applications, components, and extension stores from the state's age-assurance requirements.
The California Senate amended AB 1856, adding exclusions for software distributed under terms permitting copying, redistribution, and modification, along with exclusions for certain software components and extension storefronts.
Assemblymember Buffy Wicks introduced AB 1856 to exempt qualifying open-source software from the Digital Age Assurance Act following criticism from Linux developers and the Electronic Frontier Foundation.
Governor Gavin Newsom signed California's original Digital Age Assurance Act into law. The law establishes age-signaling obligations for covered operating-system providers and application stores.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
opennet.ru
Open sourcetomshardware.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
California’s **Digital Age Assurance Act (DAAA)** will require covered operating-system providers to collect a user’s age during device setup and transmit a non-identifying age-bracket signal to application developers. The mandate begins **January 1, 2027** for devices newly configured in California, with devices configured before that date coming into scope on **July 1, 2027**. California legislators have passed **AB 1856**, pending the governor’s decision, to exempt qualifying open-source operating-system providers. The measure has prompted privacy and implementation concerns, including from the Electronic Frontier Foundation and open-source projects; Colorado has enacted related age-attestation requirements with open-source exemptions, while Illinois and New York are considering comparable legislation.
Sep 3, 2026
California’s **Digital Age Assurance Act (AB 1043)** establishes a statewide requirement for *operating system providers* to collect a user’s age information during OS account setup and expose an age-range signal to application developers through a “reasonably consistent” real-time API when an app is downloaded or launched. The law’s definition of OS provider is broad enough to include major commercial platforms (**Windows, macOS, Android, iOS**) as well as **Linux distributions** and **Valve’s SteamOS**, and it specifies four age brackets: *under 13*, *13 to under 16*, *16 to under 18*, and *18+*. Developers who request and receive the signal are treated as having “actual knowledge” of the user’s age range, shifting compliance and content-suitability liability toward app providers; enforcement is assigned to the California Attorney General with penalties up to **$2,500 per affected child** for negligent violations and **$7,500** for intentional violations. Separate reporting highlights broader **age/identity verification** pressure across consumer platforms, including Discord’s planned move to require age verification in 2026, which has triggered privacy concerns about submitting government IDs or face scans and renewed scrutiny following a prior breach that exposed IDs for roughly **70,000 users**. Other items in the set are not about AB 1043 or OS-level age signaling and instead cover general security roundups, interviews, conference write-ups, exam prep material, and unrelated policy or industry commentary; they do not add substantiated details about the California OS age-verification mandate or its implementation requirements.
Jun 29, 2026
Apple introduced expanded *age assurance* capabilities for the App Store to support compliance with new or emerging regulations in multiple jurisdictions, including Brazil, Australia, Singapore, Utah, and Louisiana. As of **Feb. 24, 2026**, Apple began blocking downloads of **18+ rated apps** in Brazil, Australia, and Singapore unless the user is confirmed to be an adult, using what Apple describes as “reasonable methods” for age confirmation. Apple also expanded the **Declared Age Range API** (iOS/iPadOS/macOS) and related platform components (including PermissionKit’s *Significant Change API*, a new StoreKit age-rating property type, and App Store Server Notifications) to provide developers with an age category plus signals about the assurance method and whether regulatory requirements apply; in Brazil, certain disclosures (e.g., loot boxes) can drive an app’s rating to **18+**. Broader policy debate continues around online age assurance in the U.S. and internationally, with jurisdictions adopting or considering stricter mandates and platforms preparing new verification requirements. Public skepticism remains elevated due to backlash against age-gating (including reported VPN usage spikes in response to the UK’s requirements) and concerns about data security following breaches at age-verification providers (e.g., **Sumsub** disclosing a previously undetected 2024 compromise). The policy environment is also being shaped by U.S. state laws and litigation, including the Supreme Court’s decision in *Free Speech Coalition v. Paxton* upholding Texas’s age verification law, while proponents argue that privacy-preserving age assurance approaches are becoming more technically mature and scalable.
Jun 29, 2026