California AB 1043 Pushes Age Verification Into the Operating System in 2027
California’s Digital Age Assurance Act takes effect January 1, 2027, and it moves age verification from individual apps down to the device itself. Under the law, operating systems sold in the state will collect a user’s age during setup and broadcast a standardized age-bracket signal to every app and app store on the device. The brackets are four: under 13, 13 to 15, 16 to 17, and 18 plus. A recent amendment carves out open-source operating systems, but it does nothing to slow the requirement on the commercial platforms where most users actually are.
For two decades, age verification has been an app-level problem. TikTok asked. Instagram asked. Ad networks took what they were given and moved on. California is now pushing that responsibility one layer down, to the operating system, which changes who is responsible and how reliably the signal reaches the rest of the software stack.
What Does AB 1043 Actually Require?
Assembly Bill 1043 passed in late 2025 and was scheduled to apply to all operating systems, including community-maintained Linux distributions. That created an immediate problem: no one was going to require the volunteer maintainers of Debian or Arch Linux to build a centralized age-collection pipeline on the side.
The Open-Source Carve-Out in AB 1856
Assembly Member Buffy Wicks introduced Assembly Bill 1856 on February 11, 2026 to narrow the definition of operating system provider. The carve-out exempts anyone who distributes an operating system under license terms that permit a recipient to copy, redistribute, and modify the software. That phrasing maps cleanly onto standard open-source licenses, which puts Ubuntu, Fedora, Mint, and the rest of the mainstream Linux ecosystem outside the requirement.
Commercial platforms remain in scope: iOS, Android, Windows, and ChromeOS. Valve’s SteamOS sits in a gray zone, because its base is open source but the Steam storefront layered on top is proprietary. The Electronic Frontier Foundation and other privacy groups continue to push back on the broader framework even with the Linux exemption, arguing that OS-level age collection creates infrastructure that could later be repurposed to collect other identity attributes.
What Is the Legislative Timeline?
- AB 1043, the original law: passed late 2025, effective January 1, 2027.
- Age brackets defined: under 13, 13 to 15, 16 to 17, and 18 plus.
- AB 1856, the amendment: introduced February 11, 2026 by Assembly Member Buffy Wicks.
- Latest revision date: May 18, 2026.
- Status as of May 19, 2026: read a second time, ordered to third reading.
- Effective date if AB 1856 passes: January 1, 2027, alongside the original law.
The exemption rests on a single license-language test, taken verbatim from the amendment:
Operating system provider does not mean a person or entity that distributes an operating system or application under license terms that permit a recipient to copy, redistribute, and modify the software. Assembly Bill 1856, California State Legislature.
What Happens After the Law Takes Effect?
AB 1856 still has to clear committee reviews in June 2026 and pass a third reading before reaching the governor’s desk. Even if the amendment passes cleanly, the underlying age-assurance requirements still apply to Apple, Google, Microsoft, and any other commercial OS vendor serving California users.
Downstream, the signal lands in app stores first. Apple and Google will almost certainly require apps to acknowledge the bracket and behave accordingly. Major ad networks follow, filtering inventory and updating targeting interfaces. Platforms then gate features and content surfaces, in some cases more aggressively than the law strictly requires, because no platform wants to be the test case for the first enforcement action.
Other states are likely to copy the framework. Texas, New York, and Utah have already debated similar bills, and California’s market size means most platforms will ship a national age-signal posture rather than maintain a California-only product. The open-source carve-out is likely to travel with the framework, because the argument behind it is clean: a regulator cannot meaningfully compel something that is not centrally controlled.
What Is the Practical Takeaway for Product and Ad Teams?
This is a planning problem rather than a panic problem, but the planning window is short. Any product, campaign, or analytics pipeline that consumes audience data from commercial app stores in California should assume the age-bracket signal is coming, whether or not the team has opted into it.
Three moves make sense now. First, expect audience and ad data to partition by bracket automatically, so any segmentation that assumes an undifferentiated audience should be revisited before the signal goes live. Second, audit any consumer-facing destinations, since downstream regulation will likely treat linked apps and landing pages as subject to the same age-aware throttling, and centralized control of those destinations makes future changes far easier. Third, organizations that operate across multiple brands or audience profiles should separate their compliance posture per brand now, because a product aimed at teens carries a very different risk profile than one aimed at adults, and mixing them in a single workflow invites exactly the kind of failure enforcement will catch first.
The age-signal infrastructure is now part of the consumer-OS roadmap regardless of how AB 1856 settles. Open-source maintainers won an exemption because their argument was airtight. Commercial platforms did not, and every product distributed through them inherits the rules.
FAQ
When does California’s Digital Age Assurance Act take effect?
The law, Assembly Bill 1043, takes effect on January 1, 2027, and would take effect on the same date if Assembly Bill 1856 also passes.
Which operating systems are covered by AB 1043?
iOS, Android, Windows, and ChromeOS are in scope. AB 1856 exempts operating systems distributed under licenses that permit copying, redistribution, and modification, which covers mainstream Linux distributions such as Ubuntu, Fedora, and Mint.
What are the four age brackets defined by the law?
The brackets are under 13, 13 to 15, 16 to 17, and 18 plus.