On August 26, the California Senate voted 39-0 to pass Assembly Bill 1856, exempting operating systems distributed under the GPL, MIT, BSD, and Apache licenses from the state’s Digital Age Assurance Act. The Assembly concurred the next day, 69-0. Starting January 1, 2027, Windows, macOS, iOS, and Android will require age collection at account setup. Linux will not.

The open-source world is celebrating. “Finally, some good news,” read the top comment on one forum. The nerds won one.

They didn’t win. They got a carve-out. And the carve-out is the most honest thing the California legislature has said about age verification since it started writing these laws.

Here’s what AB 1856 actually does. It doesn’t say “Linux is exempt.” It says software distributed under four specific copyright licenses is exempt. GPL. MIT. BSD. Apache. Those aren’t technical categories. They’re legal instruments. The legislature didn’t ask whether a child can access inappropriate content on a Linux machine — obviously they can. It asked whether there’s a registered agent to serve with a compliance order.

You can’t subpoena a GitHub repository. You can’t fine a mailing list. The open-source ecosystem is, by design, a diffuse network of volunteers and foundations with no central authority to hold accountable. So the legislature did the only thing a legislature can do with a target it can’t hit: it stopped aiming.

The commercial platforms — Microsoft, Apple, Google — have compliance departments, outside counsel, and registered agents in Sacramento. They can absorb the cost of age verification. They can build the identity infrastructure. They can lobby for the precise wording of the regulations. The law was always going to land on them. The Linux exemption just makes that explicit.

The Compliance Moat

A compliance officer at a mid-sized software company put it to me in a Slack DM this week: “We’re not worried about the age-verification requirement itself. We’re worried about the fact that our competitors who ship under Apache don’t have to do any of it.”

That’s the part the celebration misses. The exemption doesn’t level the playing field. It tilts it. A company that distributes its operating system under a permissive license now has a regulatory advantage over one that doesn’t. The law has created a market incentive to choose a license — not for technical reasons, not for philosophical reasons, but for compliance reasons.

That’s not a victory for open source. That’s open source being used as a regulatory loophole. And loopholes close. The next time a legislator notices that a commercial product is shipping under Apache to dodge age verification, the exemption gets narrowed. The carve-out is only as durable as the political indifference that produced it.

What the Law Was Actually For

The Digital Age Assurance Act was sold as a child-safety measure. The Linux exemption reveals what it actually is: a compliance tax on commercial software distribution. If the law were about protecting children, the exemption would be incoherent. A child using a Linux laptop has the same access to the internet as a child using a Windows laptop. The browser doesn’t care about the kernel’s license.

What the law is about is creating a regulatory burden that only certain kinds of organizations can bear. The open-source community got exempted not because lawmakers love freedom, but because the community is too diffuse to regulate. The commercial platforms got included not because they’re more dangerous, but because they’re easier to find.

That’s the uncomfortable truth the open-source celebration papers over. The exemption isn’t a recognition that open source is good. It’s a recognition that open source is ungovernable. And being ungovernable is not the same as being free.

The Precedent Nobody’s Talking About

The exemption takes effect January 1, 2027. Between now and then, the commercial platforms will build their age-verification infrastructure. The open-source community will keep shipping. And the legislature will move on to the next thing.

But the precedent is set. California has now written into statute the principle that regulatory burdens should fall on organizations with legal departments, not on software itself. That’s a principle with consequences far beyond age verification. It’s a principle that says: if you want to avoid regulation, don’t organize. Don’t incorporate. Don’t have a registered agent.

That’s not a principle the open-source community should be celebrating. It’s a principle that should make everyone uncomfortable.

Sources