California's Digital Age Assurance Act (AB 1043), signed by Governor Gavin Newsom in October 2025, requires every operating system provider in California to collect age information from users at account setup and transmit that data to app developers via a real-time API, with the law taking effect on January 1, 2027.

The law's broad definition of an "operating system provider" — anyone who "develops, licenses, or controls the operating system software on a computer, mobile device, or any other general purpose computing device" — pulls in not just Windows, macOS, Android, and iOS, but Linux distributions and Valve's SteamOS.

According to AB 1043, OS providers must maintain a "reasonably consistent real-time application programming interface" that categorizes users into four age brackets — under 13, 13 to under 16, 16 to under 18, and 18 or older — and hand that signal to any developer who requests it when their app is downloaded or launched.

Developers who receive the signal are "deemed to have actual knowledge" of their users' age range under the law, which shifts legal liability for age-appropriate content decisions onto them. Penalties for non-compliance run up to $2,500 per affected child for negligent violations and $7,500 for intentional ones, enforced by the California Attorney General.

The law does not require photo ID uploads or facial recognition, with users instead simply self-reporting their age, setting AB 1043 apart from similar laws passed in Texas and Utah that require "commercially reasonable" verification methods, such as government-issued ID checks. Assemblymember Buffy Wicks, who authored the bill, said this "avoids constitutional concerns by focusing strictly on age assurance, not content moderation," in a press release. The bill passed both chambers unanimously, 76-0 in the Assembly and 38-0 in the Senate."

Despite signing it, Newsom issued a statement urging the legislature to amend the law before its effective date, citing concerns from streaming services and game developers about "complexities such as multi-user accounts shared by a family member and user profiles utilized across multiple devices." Whether amendments will materialize before January 2027 remains to be seen.

Enforcement against Linux distributions, however, is likely to be problematic. Distros like Arch, Ubuntu, Debian, and Gentoo have no centralized account infrastructure, with users downloading ISOs from mirrors worldwide, and can modify source code freely. These small distros lack legal teams or resources to implement the required API, so a more realistic outcome for non-compliant distros is a disclaimer that the software is not intended for use in California.

Follow Tom's Hardware on Google News, or add us as a preferred source, to get our latest news, analysis, & reviews in your feeds.