California’s legislature has passed a change to its age-check law that pulls open-source operating systems out of scope entirely — which means a de-Googled Android build such as GrapheneOS will not have to ask for your age, while the stock Android on a Pixel or a Galaxy still will. Assembly Bill 1856 cleared its final vote on 27 August and is on its way to Governor Gavin Newsom.
What California’s age check law does to Android
The underlying law here is the Digital Age Assurance Act, which Newsom signed last October and which takes effect on 1 January 2027. From that date, an operating system provider has to put an interface in front of the account holder during device setup asking for the primary user’s birth date or age, and then hand a signal about that person’s age bracket to apps in the device’s app store. Phones set up before 2027 are not exempt — the statute gives operating system providers until 1 July 2027 to offer the same interface to existing account holders.
AB 1856 does not create that requirement and does not remove it from Android. What it does is redraw the boundary of who counts as an “operating system provider” in the first place. The bill’s text says that the term:
does not mean a person or entity that distributes an operating system or application under license terms that permit a recipient to copy, redistribute, and modify the software.
That is a licence test, not a brand test, and it is why the coverage of this bill has been about Linux. But it applies just as cleanly to Android forks. GrapheneOS ships under the MIT and Apache licences and said in March that it would refuse to comply with age-verification mandates; on this wording it is now outside the law’s scope, as Tom’s Hardware notes. Google’s Android as it arrives on a retail phone is not distributed on those terms, so Android, iOS, Windows and macOS all stay fully in.
The provision that matters most for your phone
Buried further down is a change that deserves more attention than the open-source carve-out. Lawmakers added a line barring any person from requesting an age signal about a particular user, from either an operating system provider or an app store, unless the act itself or some other applicable law requires them to.
That is a real guardrail, and it lands on machinery that already exists. Google’s Play Age Signals API went global in July, letting any Play developer ask Google Play what age bracket a user falls into. An age-bracket API with no restriction on who may query it is a general-purpose profiling channel wearing a child-safety label; a rule that a developer may only ask when a statute obliges them to is the difference between a compliance tool and a data tap. It is also the sort of limit that was missing from Google’s own framing of the API, which left the decision of what to do with the signal — and how often to ask for it — entirely to developers.
The rest of the changes
- Package managers are out. The bill excludes software components that are not themselves offered to consumers as stand-alone executable applications through a covered app store, which covers libraries and dependencies pulled through tools like apt.
- The definition of “user” is gone. The original act defined a user as a child who is the primary user of a device, which, as Tom’s Hardware points out, left no way for an adult to ever be flagged as an adult. AB 1856 deletes it.
- Developers get a safe harbour. Platforms and developers are protected from liability when an age signal turns out to be wrong.
- The vote was not close. The Assembly concurred in the Senate’s amendments 69-0 on 27 August, after the Senate passed the amended bill 39-0 on 26 August, per the Legislature’s own bill history.
What happens next
The bill’s last recorded action on the Legislature’s own history page is engrossing and enrolling, the procedural step before it reaches the Governor’s desk, with no signature recorded as of 30 August. Assuming he does, the practical effect for most people in California is unchanged: from January 2027 the setup flow on a new Android phone will include an age question, and existing phones get the same prompt before July 2027. The people who gain something are the small minority running an open-source Android build, plus anyone who was worried that a bracket API would become a standing invitation for every app on the phone to ask how old you are.
Two caveats worth keeping in view. This is one state, and the direction of travel elsewhere is toward more of these signals rather than fewer — Google’s own documentation cites Brazil’s Digital ECA and Texas SB2420 as reasons the API exists at all. And an exemption granted can be narrowed later: the carve-out holds only for as long as the legislature leaves it alone.
Sources: Tom’s Hardware, Phoronix
