California AB-1856 exempts open source from age signals

California just made a software license into a compliance boundary. AB-1856 cleared both chambers this week with zero opposing votes and is on its way to the governor. It carves open-source-licensed operating systems and applications out of the Digital Age Assurance Act — the law that, from January 1, 2027, turns your OS into an age-signal broker. If you ship anything through an app store, the exemption text tells you exactly where the line now sits.

What actually happened

AB-1856 (Wicks) amends Civil Code sections 1798.500 through 1798.504. The Senate passed it 39-0 on August 26, 2026, and the Assembly concurred 69-0 on August 27. It is enrolled and awaiting signature.

Two definitional edits do the work. "Operating system provider" now excludes an entity that distributes an operating system or application "under license terms that permit a recipient to copy, redistribute, and modify the software" — which takes GPL, MIT, BSD, and Apache-licensed distributions out of scope. And "application" now excludes software components that are not themselves offered to consumers as a stand-alone executable application through a covered application store. Phoronix has the exemption language as amended.

The underlying law is AB 1043, signed October 13, 2025. From January 1, 2027, an operating system provider must collect a birth date or age at account setup and expose a real-time API that tells apps in a covered store which bracket the user falls into: under 13, 13 to under 16, 16 to under 18, or 18 and over. Penalties run to $2,500 per affected child for negligent violations and $7,500 for intentional ones.

Why AB-1856 matters for your software business

Read the second carve-out again, because it's the one aimed at you. Your SDK is not an application. Your embedded widget is not an application. The thing you shipped to the App Store is.

That distinction is worth writing down before December 2026, because most teams cannot cleanly answer "which of our artifacts is a stand-alone consumer app in a covered store, and which is a component inside someone else's?" A React Native library, a white-labeled build you compile for four clients, and a PWA that never touches a store are three different answers.

Then there's the consumption side, which no exemption saves you from. If you do ship a consumer app in a covered store, in sixteen months an age-bracket signal starts arriving through a platform API, and you are expected to do something with it. That is a product decision — what changes for a 13-year-old versus an adult — not a checkbox, and it needs a place to live in your data model. Age bracket is now a user attribute your app receives rather than one it asks for.

The broader read: this is the second California bill in a month where the obligation lands on platform providers and the practical work lands on the people building on top of them. The license you chose years ago is now a regulatory input. Know what yours is.

Sources: California AB-1856 (leginfo), California AB 1043 (leginfo), Phoronix.