California Digital Age Assurance Act (AB 1043)
What it does
From January 1, 2027, operating systems must ask for the user's age or birth date during device setup and pass an age-bracket signal to apps. Penalties run to $2,500 per affected child for negligent violations and $7,500 for intentional ones. Apple, Google, and Meta all backed the bill. The open-source world then pointed out that community-built systems cannot run a compliance regime, and a follow-up bill, AB 1856, passed the Assembly 68 to 1 in May to exempt operating systems distributed under open-source licenses. AB 1856 originally also extended age signals to every browser and website; that expansion was stripped in July after backlash.
Why it matters
Age verification keeps moving down the stack: first individual websites, then app stores, now the operating system itself. When the device you bought attests your age bracket to every app you open, identity infrastructure ships by default in every phone and laptop sold in the state.
Our take
This is sold as the privacy-friendly option because no ID gets uploaded. What it actually does is normalize the device vouching for who you are, system-wide, forever. Big Tech supported it for a simple reason: they would rather run the checkpoint than stand in line at one.
Votes
- Assembly — Final passage (76 to 0) · June 2, 2025
- Senate — Final passage (38 to 0) · September 12, 2025
Timeline
- October 13, 2025Signed by Governor Newsom
- May 28, 2026AB 1856 passed the Assembly 68 to 1, exempting open-source operating systems
- July 1, 2026AB 1856's expansion of age signals to browsers and websites stripped after backlash
Our coverage: all age-verification stories