Loading story…
California Assembly Bill AB 1709 is awaiting Governor Gavin Newsom’s decision and, if enacted, would require covered social-media platforms to verify users’ ages beginning January 1, 2027. The measure also establishes an e-Safety Advisory Commission and could affect how platforms provide features associated with compulsive use, including algorithmic feeds, autoplay, infinite scrolling, and push notifications.
The Electronic Frontier Foundation has urged Newsom to veto the bill, warning that compliance could drive platforms to collect government-issued identification or biometric data. EFF says the resulting concentration of sensitive identity information would raise breach and identity-fraud risks, while potentially limiting minors’ access to online communities and creating First Amendment concerns.
See the reporting duties and controls this puts on the clock.
1 event from the most recent confirmed update back to the earliest known activity.
The Electronic Frontier Foundation published an open letter asking Governor Gavin Newsom to veto AB 1709, a pending bill that would require social-media platforms to conduct age checks. EFF warned that likely compliance mechanisms, such as government-ID uploads or biometric checks, could expand sensitive-data collection and create privacy and constitutional risks.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
tomshardware.com
Open sourceleginfo.legislature.ca.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
California’s **Digital Age Assurance Act (AB 1043)** establishes a statewide requirement for *operating system providers* to collect a user’s age information during OS account setup and expose an age-range signal to application developers through a “reasonably consistent” real-time API when an app is downloaded or launched. The law’s definition of OS provider is broad enough to include major commercial platforms (**Windows, macOS, Android, iOS**) as well as **Linux distributions** and **Valve’s SteamOS**, and it specifies four age brackets: *under 13*, *13 to under 16*, *16 to under 18*, and *18+*. Developers who request and receive the signal are treated as having “actual knowledge” of the user’s age range, shifting compliance and content-suitability liability toward app providers; enforcement is assigned to the California Attorney General with penalties up to **$2,500 per affected child** for negligent violations and **$7,500** for intentional violations. Separate reporting highlights broader **age/identity verification** pressure across consumer platforms, including Discord’s planned move to require age verification in 2026, which has triggered privacy concerns about submitting government IDs or face scans and renewed scrutiny following a prior breach that exposed IDs for roughly **70,000 users**. Other items in the set are not about AB 1043 or OS-level age signaling and instead cover general security roundups, interviews, conference write-ups, exam prep material, and unrelated policy or industry commentary; they do not add substantiated details about the California OS age-verification mandate or its implementation requirements.
Jun 29, 2026
California’s **Digital Age Assurance Act (DAAA)** will require covered operating-system providers to collect a user’s age during device setup and transmit a non-identifying age-bracket signal to application developers. The mandate begins **January 1, 2027** for devices newly configured in California, with devices configured before that date coming into scope on **July 1, 2027**. California legislators have passed **AB 1856**, pending the governor’s decision, to exempt qualifying open-source operating-system providers. The measure has prompted privacy and implementation concerns, including from the Electronic Frontier Foundation and open-source projects; Colorado has enacted related age-attestation requirements with open-source exemptions, while Illinois and New York are considering comparable legislation.
Sep 3, 2026
Policymakers in multiple jurisdictions are advancing **child online safety** rules that would restrict minors’ access to social media, “addictive” product features, and certain content (including pornography), increasing pressure on platforms to implement **age assurance/age verification** to determine users’ ages before allowing access. The Lawfare analysis highlights that while protecting children online is a widely shared goal, enforcing age-based restrictions at scale effectively requires collecting and validating age signals for *all* users—raising significant implementation, privacy, and governance challenges as governments consider measures such as the **Kids Online Safety Act (KOSA)**, the **Kids Off Social Media Act**, and the **App Store Accountability Act**.
Jun 30, 2026