California Assembly Bill 1856 is getting friendly press coverage because it now exempts Linux from the state’s age-tracking mandate. The part nobody’s talking about is that it simultaneously expands the surveillance to your web browser.
AB 1856, authored by the same lawmaker who wrote the original Digital Age Assurance Act, amends the law to exclude open-source operating systems from its definition of “operating system provider.”
Any software distributed under a license that lets users “copy, redistribute, and modify the software” would no longer be covered. Debian, Ubuntu, Fedora, Arch Linux, and Mint all walk free. That sounds like a win and tech outlets are reporting it as one. It’s also a distraction from what the bill adds.
The original law, AB 1043, required operating systems to harvest users’ ages during device setup and feed that data to app stores and app developers through a real-time API.
AB 1856 keeps all of that and extends the data pipeline to browser providers and website operators. Browsers would now be required to collect age signal data from the OS and pass it along to any website subject to online age verification laws.
We obtained a copy of the amended bill for you here.
Those websites, in turn, would have to request the age signal when you visit them. Your age bracket, declared once during OS setup, would follow you from app to app and now from site to site, broadcast to every developer and website operator who asks.
This is how a law originally limited to apps and app stores becomes an age-tracking system for the entire internet.
The Expanding Universe of “Covered” Websites
The category of websites subject to age verification laws started narrow as the earliest mandates targeted pornography sites. It has since expanded to social media platforms and a growing list of sites legislators consider likely to “harm” children in loosely defined ways. That list keeps getting longer and AB 1856 doesn’t define its own boundary. It piggybacks on whatever other laws exist, meaning every future expansion of age verification requirements automatically expands the reach of AB 1856’s browser-based data pipeline, too.
California has actually built an age-tracking infrastructure that scales itself.
Hellbound and Down 