news
California's Digital Age Assurance Act and Linux distributions
A recently enacted law in California imposes an age-verification requirement on operating-system providers beginning next year. The language of the Digital Age Assurance Act does not restrict its requirements to proprietary or commercial operating systems; projects like Debian, FreeBSD, Fedora, and others seem to be on the hook just as much as Apple or Microsoft. There is some hope that the law will be amended, but there is no guarantee that it will be. This means that the developer communities behind Linux distributions are having to discuss whether and how to comply with the law with little time and even less legal guidance.
The law requires operating-system providers to provide a form of age verification that can be queried by any web site, application, or online service "that distributes and facilitates the download of applications from third-party developers
" for computers, mobile devices, or other general-purpose computing devices. The law goes into effect on January 1, 2027, which leaves less than ten months for distributions to determine if the law applies to them and then implement a solution if it does.
The law was introduced in February 2025 and passed into law in October 2025. Unlike other legislation, such as the European Union's Cyber Resilience Act (CRA), it seems to have slipped in under the radar without raising any real protest from the open-source projects it affects. It seems to have gathered widespread attention in the Linux community after Aaron Rainbolt started a discussion about the new law by cross-posting a message about "the unfortunate need for an 'age verification' API
" to Debian, Fedora, and Ubuntu mailing lists on March 1. He provided a pointer to the California law as well as a similar bill that is working its way through the Colorado legislature.