Loading story…
California’s Digital Age Assurance Act (DAAA) will require covered operating-system providers to collect a user’s age during device setup and transmit a non-identifying age-bracket signal to application developers. The mandate begins January 1, 2027 for devices newly configured in California, with devices configured before that date coming into scope on July 1, 2027.
California legislators have passed AB 1856, pending the governor’s decision, to exempt qualifying open-source operating-system providers. The measure has prompted privacy and implementation concerns, including from the Electronic Frontier Foundation and open-source projects; Colorado has enacted related age-attestation requirements with open-source exemptions, while Illinois and New York are considering comparable legislation.
See the reporting duties and controls this puts on the clock.
9 events from the most recent confirmed update back to the earliest known activity.
California signed the Digital Age Assurance Act (DAAA) into law. The law requires operating-system providers to collect a user’s age during initial setup and permits them to provide developers with a non-identifying age-bracket signal.
Fedora was reported to be planning age-assurance implementation despite potential open-source exemptions.
New York has an age-assurance bill under consideration.
California lawmakers passed AB1856, which would amend the DAAA to exempt qualifying open-source operating-system providers. No California lawmaker voted against the bill, which was awaiting the governor’s decision.
Illinois passed legislation imposing age-assurance requirements.
Colorado legislators added exemptions for open-source software to SB26-051 after lobbying by Linux hardware maker System76.
Colorado enacted SB26-051, establishing age-assurance requirements similar to California’s DAAA.
GrapheneOS said it would not implement age verification and might stop selling devices in jurisdictions that impose such requirements.
California Assemblymember Buffy Wicks introduced the original Digital Age Assurance Act, establishing proposed operating-system-level age-assurance requirements.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
6 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcemalwarebytes.com
Open sourceeff.org
Open sourceleginfo.legislature.ca.gov
Open sourceleg.colorado.gov
Open sourceleginfo.legislature.ca.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
California’s **Digital Age Assurance Act (AB 1043)** establishes a statewide requirement for *operating system providers* to collect a user’s age information during OS account setup and expose an age-range signal to application developers through a “reasonably consistent” real-time API when an app is downloaded or launched. The law’s definition of OS provider is broad enough to include major commercial platforms (**Windows, macOS, Android, iOS**) as well as **Linux distributions** and **Valve’s SteamOS**, and it specifies four age brackets: *under 13*, *13 to under 16*, *16 to under 18*, and *18+*. Developers who request and receive the signal are treated as having “actual knowledge” of the user’s age range, shifting compliance and content-suitability liability toward app providers; enforcement is assigned to the California Attorney General with penalties up to **$2,500 per affected child** for negligent violations and **$7,500** for intentional violations. Separate reporting highlights broader **age/identity verification** pressure across consumer platforms, including Discord’s planned move to require age verification in 2026, which has triggered privacy concerns about submitting government IDs or face scans and renewed scrutiny following a prior breach that exposed IDs for roughly **70,000 users**. Other items in the set are not about AB 1043 or OS-level age signaling and instead cover general security roundups, interviews, conference write-ups, exam prep material, and unrelated policy or industry commentary; they do not add substantiated details about the California OS age-verification mandate or its implementation requirements.
Jun 29, 2026
California lawmakers unanimously passed **AB 1856**, exempting qualifying open-source operating systems, applications, software components, and extension storefronts from the state’s Digital Age Assurance Act. Sent to Governor Gavin Newsom, the measure would remove uncertainty over whether Linux distributions and package-management ecosystems would have to collect or transmit users’ age information; software under GPL, MIT, BSD, and Apache licenses is covered by the exemption. The underlying age-assurance requirements are due to apply to proprietary platforms including Windows, macOS, iOS, and Android from January 1, 2027. AB 1856 also narrows the definition of a user, limits unnecessary age-signal requests, and creates a good-faith safe harbor for inaccurate signals. The exemption addresses concerns that broadly drafted child-safety and app-store laws—including Colorado SB51 and Brazil’s Digital ECA—could otherwise extend to Linux repositories and package managers such as `apt`, `dnf`, and `pacman`, creating compliance and privacy burdens for distributions including Debian, Ubuntu, Fedora, and Arch Linux.
Aug 30, 2026
California Assembly Bill **AB 1709** is awaiting Governor Gavin Newsom’s decision and, if enacted, would require covered social-media platforms to verify users’ ages beginning January 1, 2027. The measure also establishes an e-Safety Advisory Commission and could affect how platforms provide features associated with compulsive use, including algorithmic feeds, autoplay, infinite scrolling, and push notifications. The Electronic Frontier Foundation has urged Newsom to veto the bill, warning that compliance could drive platforms to collect government-issued identification or biometric data. EFF says the resulting concentration of sensitive identity information would raise breach and identity-fraud risks, while potentially limiting minors’ access to online communities and creating First Amendment concerns.
Sep 3, 2026