AB 1043 passed the California Assembly 76–0 and the Senate 38–0. Not a single legislator voted against it. Laws do not pass unanimously by accident. They pass unanimously because the interests that benefit from them have done enough work to eliminate opposition before the vote. This page documents who did that work.
AB 1043 was not written in isolation. It is a template. ICMEC published the model text as a ready-to-introduce statutory draft, and its Global Head of Policy presented it directly to Virginia’s Joint Commission on Technology and Science. The same organizations that drafted the model bill are now deploying it in state legislatures across the country. The companies that benefit from the compliance moat fund the advocacy organizations that draft the bills that create the compliance moat.
Colorado Senator Matt Ball (D) stated publicly that SB 26-051 was “based on California’s bill AB 1043.” Michigan Representative Paquette called HB 4429 and SB 284 “model legislation.” The template is not hidden. It is the strategy.
Every company listed below already collects user age data as part of its existing business operations. For each of them, AB 1043 compliance costs approximately nothing. For the 600+ volunteer Linux distributions, it costs everything.
NetChoice—the tech industry trade association—filed a formal veto request opposing AB 1043 on September 29, 2025. NetChoice’s members include Google and Meta, both of which endorsed the bill individually. The trade group filed a veto request opposing the law its own members support. This is not confusion. This is positioning.
The organizations that draft and promote age verification legislation receive their funding from the companies that benefit from it.
The funding flows in a circle. Tech companies fund advocacy organizations. Advocacy organizations draft model bills. Model bills create compliance requirements. The compliance requirements cost nothing for the tech companies that funded the advocacy organizations. The cost falls on everyone else.
AB 1043 does not merely create a compliance moat. It creates a compliance moat that authorizes more data collection about children.
Under COPPA, the federal children’s privacy law, companies are subject to strict obligations when they have “actual knowledge” that a user is under 13. For two decades, Big Tech exploited a simple loophole: don’t ask, don’t know. If you never collect age data, you never have actual knowledge, and COPPA never triggers.
AB 1043 closes that loophole—but in a way that also works for Big Tech. Once an operating system sends an age bracket signal indicating a user is under 13, every application developer who receives that signal has “deemed actual knowledge” and is locked into full COPPA obligations. The burden of generating the signal falls on OS providers, not on Meta or Google. The platforms get to claim they are “protecting children” while the operating system does the data collection that triggers the legal framework.
In February 2026, the FTC issued a COPPA Policy Statement essentially admitting that age verification and data minimization are in fundamental conflict. The federal regulator acknowledges the contradiction. The California legislature encoded it into law.
AB 1043 requires only self-declared age—a birthdate field, not government ID or biometrics. Industry analysts have described this as “an initial implementation designed to get the door open.” Self-declaration today. Biometric verification tomorrow. The infrastructure is the same; only the input changes. Once every operating system has an age collection interface and a real-time API for transmitting age data to applications, upgrading from a text field to a face scan is a configuration change, not a new law.
The connection between ICMEC’s model bill and the state legislative pipeline was first documented by /u/aaronsb on r/linux, building on prior bill text comparison research.
ALEC—the American Legislative Exchange Council, the organization most commonly associated with model legislation campaigns—is not driving these bills. ALEC favors parental-control solutions over government mandates and has not adopted OS-level age verification as a model policy.
This matters because it preempts the easiest dismissal: that age verification mandates are a right-wing culture war project. They are not. The actual coalition is Big Tech companies and centrist child-safety nonprofits funded by Big Tech, opposed by civil libertarians on both sides. The EFF and the ACLU oppose these laws. So does NetChoice, a tech-industry trade group led by former Google lobbyists. The coalition that wrote AB 1043 is bipartisan, well-funded, and weirder than any simple political narrative can contain.
The companies that benefit from this law funded the organizations that drafted it. The legislator who authored it brokered a quarter-billion-dollar deal with the company whose products it protects. The platforms it ostensibly regulates endorsed it.
This is not a child safety law. It is a market protection statute with children’s names on it.