Software Distributed Under The GPL, MIT, BSD, And Apache Licenses Are Exempt
These amendments redefine the term “operating system provider” to exclude any person or entity that distributes an OS or application “under license terms that permit a recipient to copy, redistribute, and modify the software.” Any software distributed under the GPL, MIT, BSD, and Apache licenses satisfies that test, which removes the likes of Debian, Fedora, Ubuntu, Arch, and the BSD family from AB 1856’s scope.
The amendments to AB 1856 also remove the original definition of “user,” which read, “a child that is the primary user of a device,” and technically classified every device owner in California as a child. The law’s signaling framework depends on adults declaring their age on account setup, so their devices get flagged as 18 and over, but under that definition nobody could ever be flagged as an adult.
In addition, lawmakers inserted a new provision prohibiting anyone from requesting an age signal from an OS provider or app store unless required by law. That closes off potential abuse of the age API that could have led to it being used as a general-purpose data collection channel even when age verification wasn’t required. Platforms and developers also gain a good-faith safe harbor against erroneous signals, protecting them from liability when age-gating signals are inaccurate.
Windows, macOS, iOS, and Android remain fully in scope, with age collection required at account setup from January 1, 2027. A later July 1, 2027, deadline applies to devices set up before January 1. Whether SteamOS is in scope isn’t yet clear: its Arch-based system components are open source, but Valve distributes the image alongside the proprietary Steam client. GrapheneOS, which in March said it would refuse to comply with age-verification mandates, is distributed under open-source MIT and Apache licenses and now falls outside the law’s scope entirely, though Brazil’s Digital ECA still applies to it.
Assemblymember Buffy Wicks, who wrote both the Digital Age Assurance Act and the AB 1856 amendment, introduced the exemption back in February following criticism from Linux developers and the Electronic Frontier Foundation.
(Score: 5, Insightful) by canopic jug on Thursday September 03, @06:48AM (1 child)
This whole thing is not about having social control media companies protect kids in any way shape or form. It is about the offloading of that responsibility from social control media companies onto the makers of operating systems, or at least trying to do so legislatively.
It also feeds the surveillance state, which means more money for the social control media companies because a primary side effect is the massively increased surveillance capabilities which give increased revenue. They obviously see that as a very desirable side effect. A secondary side effect, also seen as desirable by the social control media companies and the major OS makers, will be the complete ban of "circumvention technologies" like GNU/Linux, the BSDs, HaikuOS, GrapheneOS, and anything else which is Free and Open Source software.
Money is not free speech. Elections should not be auctions.
(Score: 3, Interesting) by Reziac on Sunday September 06, @12:49AM
They could have solved the whole thing the same way cell phone companies do -- all accounts must go through a responsible adult. (Kids on desktops are pretty much edge cases.)
And there is no Alkibiades to come back and save us from ourselves.
(Score: 5, Interesting) by jb on Thursday September 03, @07:03AM (1 child)
Indeed, any software distributed under any licence that provides Freedoms 2 & 3 (or satisfies criteria 1 & 3 of the OSD, if that's more your thing) satisfies that test, not just the four licences listed.
(Score: 3, Interesting) by Bentonite on Thursday September 03, @10:48AM
The issue is that the kernel, Linux doesn't qualify for the exception.
While 75% of Linux is composed of proprietary software, without source code, under proprietary licenses that grant only freedom 2 at best.
(Score: 5, Funny) by jb on Thursday September 03, @07:07AM
Given that the lawmakers are themselves Californians, perhaps this constitutes some sort of admission that they self-identify as children?
(Score: 5, Funny) by oldeschool on Thursday September 03, @11:29AM
As Steam can attest, I was born 01/01/1900
(Score: 4, Insightful) by ledow on Thursday September 03, @11:41AM (1 child)
Pretty much a case of have-to, though, because of the ill-thought-out idea.
If you couldn't - then Linux wouldn't be legal in California without a module to do the age verification (the rest of the world would just ignore that).
But equally... anyone could then get the source code from elsewhere, remove that module, and use it anyway.
You can't ban them modifying the source code, because that then means a rather radical effect to all current operating systems, including the proprietary ones that use open-source code.
You can't ban them distributing the source code, because California isn't the only place in the world that distributes open-source, and again it would impact on all kinds of things.
You can't mandate that the rest of the world bundles California's preferred age-verification module.
The module would have to be an open-source shim at minimum anyway, which means it would be bypassed or fooled in time, and if it was fully open-source it's methods and algorithms would become known.
You can't even start imposing licencing exceptions for it, e.g. nVidia modules, because that would cause all kinds of hell if you're then force-bundling it with open-source code.
And so on.
It was always a ridiculous idea, they've just saved face by pretending they're making an exception.
(Score: 1, Touché) by Anonymous Coward on Thursday September 03, @09:23PM
"Never give an order you know won't be obeyed."
- Every decent leadership guide.
...
Not sure how "decent leadership" applies in California though.
(Score: 2, Insightful) by Anonymous Coward on Thursday September 03, @01:48PM (5 children)
The companies under the gun for age^H^H^H KYC regulations will simply ban machines running linux. You already have this problem with nonstandard browsers and VPN.
(Score: 3, Interesting) by number11 on Thursday September 03, @06:39PM (4 children)
How they gonna know? I run Linux (a computer I mostly don't use is W10) and currently have 3 different browsers open (FF, Brave, Librewolf). There are a couple other browsers installed, but those 3 are the ones I mostly use. My browsers send random user agent strings. which at the moment are:
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.7727.56 Safari/537.36
Mozilla/5.0 (X11; Linux x86_64; rv:155.0) Gecko/20100101 Firefox/155.0
Mozilla/5.0 (Macintosh; Intel Mac OS X 11; rv:134.0esr) Gecko/20010101 Firefox/134.0esr
Sure, there are probably more accurate ways to determine the UA than just asking, but that's the easy way. Once in a great while I have to change the string for a website, but geolocation/VPN issues (which often can be resolved by changing the particular VPN or server) are way more frequent.
(Score: 3, Funny) by Reziac on Friday September 04, @03:03AM (3 children)
I'm on Starlink, and I geolocate as a datacenter in Utah. Won't that confuse 'em...
And there is no Alkibiades to come back and save us from ourselves.
(Score: 2, Interesting) by Anonymous Coward on Friday September 04, @02:03PM (2 children)
I'm surprised you ask this. My phone has a datacenter IP and constantly gets rejected by overzealous gatekeeper scripts. I've used corporate networks where "sign in to prove you're not a bot" decorates every youtube video. Maybe starlink gets a pass, maybe it doesn't. I've never used it.
Changing UA strings was able to be defeated using iframes on most chromium based browsers even years ago. There's plenty of JS scripts that try to guess if your browser is lying. Sites now use IP reputation and quite advanced fingerprinting. When you fight back you simply get treated as an undesirable.
(Score: 3, Interesting) by Reziac on Sunday September 06, @12:45AM
Rhetorical question... I switched to Starlink a year ago (it was either that or suffer on spotty DSL that was down to 2.3Mbps and rapidly declining) and since then I run into a lot of "Your IP address is forbidden because it's a bot or datacenter". Nice of them to actually TELL me this.
And there is no Alkibiades to come back and save us from ourselves.
(Score: 2) by number11 on Sunday September 06, @04:17PM
Changing UA strings isn't the only defensive thing I do. There's also some protection against fingerprinting & trackers, and of course adblocking. And pretty much always VPN with the server & VPN company changing occasionally, and adding & removing fonts that I don't actually use). They'd be right, I am an undersirable, but TBH there are only a few sites that block me (and some of those can be beaten by turning JS off with a single click), I switch protections off for my financial institutions. No, it's not perfect protection, but ya do what ya can to improve the odds.