State Law Tracker

Laws We Are Violating

A running inventory of US state laws that require operating system providers to collect age data from users — plus adjacent laws that close evasion vectors and so reshape the same compliance landscape — along with Ageless Linux's status for each. Every entry used to read the same way.

Two of them no longer do. Colorado and California have both adopted exemptions for software distributed under licenses that let recipients copy, redistribute, and modify it. California's passed both houses on August 27, 2026 and is awaiting the Governor's signature. Illinois enacted the same age-signal architecture on July 31, 2026 with no exemption at all, which is the more instructive fact about where this is going.

Signed Law
Enjoined / Awaiting Signature
Active Bill
Withdrawn
No Action

Enacted Laws

States Where Ageless Linux Is Noncompliant

California
AB 1043 — Digital Age Assurance Act
Requires OS providers to collect age at account setup, provide real-time age bracket API to developers. Self-declaration only — no ID verification. Signed by Gov. Newsom Oct 13, 2025. Passed 76-0 (Assembly), 38-0 (Senate).
Ageless Linux: NONCOMPLIANT
LAW
Effective
Jan 1, 2027
Texas
SB 2420 — App Store Accountability Act
Requires app stores to verify age using "commercially reasonable methods" — potentially including government ID. Requires parental consent for minors. Signed May 27, 2025. Preliminarily enjoined Dec 23, 2025 — but the Fifth Circuit stayed that injunction on June 4, 2026, and the law took effect the same day. Apple and Google began rolling out Texas age-assurance flows immediately. CCIA (No. 25A1390) and two teen app users (Students Engaged in Advancing Texas, No. 25A1389) filed emergency applications at the U.S. Supreme Court on June 15, 2026 to restore the injunction; Justice Alito ordered Texas to respond by June 22. The Supreme Court denied both applications on July 6, 2026 — no explanation, no noted dissents, and no ruling on the merits. SB 2420 remains in force. The First Amendment question — whether requiring adults to prove identity to download constitutionally protected applications survives strict scrutiny — is now before the Fifth Circuit on the merits.
Ageless Linux: NONCOMPLIANT
LAW
In effect Jun 4, 2026
SCOTUS pending
Utah
SB 142 — App Store Accountability Act
Requires "commercially reasonable" age verification by app stores. Private right of action — parents and minors can sue for $1,000 per violation. The only state where individuals (not just the AG) can enforce. Amended by HB 498 (signed Mar 18, 2026), making Utah the first state to revise its App Store Accountability Act. The May 6, 2026 compliance deadline passed and the law is now in effect — Apple and Google rolled out age-category signals and parental-consent flows. CCIA voluntarily dismissed its suit (~Apr 21, 2026) after the state reaffirmed that SB 142 creates only a private right of action, with no government enforcement — undercutting CCIA's pre-enforcement standing. No injunction issued. Private enforcement phases in toward Dec 31, 2026.
Ageless Linux: NONCOMPLIANT
LAW
In effect
May 6, 2026
Utah
SB 73 — Online Age Verification Amendments
Network-layer companion to SB 142. First US law to explicitly target VPN circumvention of age verification. Deems a user "located in the state" for compliance purposes "regardless of whether the individual is using a virtual private network." Also prohibits covered websites from publishing instructions on how to use a VPN to bypass age gates — a content-based speech restriction. Sponsored by Sen. Calvin R. Musselman, signed by Gov. Cox Mar 19, 2026. Enforced by Utah's Division of Consumer Protection; introduced version set $1,000/day for failure to provide required notification. Closes the network-layer escape hatch and increases pressure on sites to rely on OS-attested age signals — exactly the surface Ageless Linux strips. EFF and NordVPN call reliable VPN detection "technically impossible." Took effect May 6, 2026, but Utah agreed on April 27 to suspend enforcement of the VPN provisions until Sept 3, 2026 under a litigation standstill after Aylo (Pornhub's parent) sued in federal court. That standstill expires within days of this update and we have found no reporting of an extension, a preliminary-injunction ruling, or a settlement. If it lapses without one, Utah becomes the first US state actively enforcing a VPN-location mandate.
Ageless Linux: ADJACENT TARGET
LAW
In effect May 6, 2026
Enforcement → Sep 3
Louisiana
HB 570 — App Store Accountability Act
Similar to Texas/Utah model — app store focused, "commercially reasonable" verification. Requires developers to associate minor accounts with parent accounts. AG enforcement only, no private right of action. $10,000/violation after 45-day cure. HB 977 (signed May 15, 2026) pushed the effective date back a full year to July 1, 2027 and amended the act to let developers rely on app-store-supplied age and parental-consent signals, adding a "family account" exception.
Ageless Linux: NONCOMPLIANT
LAW
Effective
Jul 1, 2027
Alabama
HB 161 — App Store Accountability Act
The fourth state to enact an App Store Accountability Act. App-store-focused, "commercially reasonable" age verification with parental consent for minors, following the Texas / Utah / Louisiana template. Signed Feb 17, 2026.
Ageless Linux: NONCOMPLIANT
LAW
Effective
Jan 1, 2027
Colorado
SB 26-051 — Age Attestation on Computing Devices
Near-identical copy of California's AB 1043 — OS-level age collection, real-time API, self-declaration. The House passed it 40-23 on Apr 30, 2026; Gov. Polis signed it June 3, 2026. Effective July 1, 2028. Unlike AB 1043 as enacted, the text carries an open-source exemption — added in House committee after lobbying by System76 founder Carl Richell — excluding any provider or developer that distributes "under license terms that permit a recipient to copy, redistribute, and modify the software without restriction from the provider or developer, including any technical or contractual restrictions on installing all modified versions," plus public code repositories and container images. Correction (Aug 30, 2026): this card previously described the exemption's reach over copyleft as unsettled. On a closer read of the enacted text against California's, that was wrong. The trailing clause restricts what the provider may do, not what the license may condition — it is an anti-tivoization test, not an anti-copyleft one, and GPL-licensed distributions clear it comfortably. Colorado's is the better-drafted of the two exemptions: it reaches repositories and containers, which California's does not, and it denies the carve-out to a vendor who ships a locked bootloader over free software, which California's appears to permit.
Ageless Linux: EXEMPT (anti-tivoization test)
LAW
Signed Jun 3, 2026
Effective Jul 1, 2028
Illinois
HB 5511 — Children's Social Media Safety Act (Public Act 104-0664)
Signed by Gov. Pritzker July 31, 2026. Reported almost universally as a social media bill — algorithmic feeds, overnight notification curfews, default privacy settings for minors — and it is that. It is also a full OS-level age assurance mandate. By January 1, 2028 an operating system provider must provide an accessible interface at account setup requiring the account holder to indicate a birth date or age, return to any requesting operator a signal identifying the user's age category — under 13, 13–15, 16–17, 18 and up — and transmit only the minimum information necessary. That is AB 1043's architecture, enacted verbatim in a second state. It contains no open-source exemption of any kind — no license test, no repository carve-out, nothing. Sponsored by Rep. Jennifer Gong-Gershowitz and Sen. Willie Preston. Passed the House 82-27 (Apr 16), the Senate 57-0 (Jun 1), and House concurrence 113-0 (Jun 1). EFF urged a veto in June; NetChoice urged a veto; the Governor signed it anyway. Signed nine weeks after California's exemption first appeared in print and three weeks before California passed it.
Ageless Linux: NONCOMPLIANT
LAW
Signed Jul 31, 2026
Effective Jan 1, 2028

Passed — Awaiting Signature

The Bill That Would Exempt Us

California
AB 1856 — Digital Age Assurance Act amendments
Follow-on bill from AB 1043's own author, Asm. Buffy Wicks. It adds a new § 1798.500(g)(2): "'Operating system provider' does not mean a person or entity that distributes an operating system or application under license terms that permit a recipient to copy, redistribute, and modify the software." The statute names no licenses — GPL, MIT, BSD, Apache, "open source," and "free software" appear nowhere in it. The test is functional: copy, redistribute, modify. Earlier versions also expanded age-gating to browsers and website operators; that expansion was stripped in July 2026, after which EFF withdrew its opposition.

Passed the Assembly 68-1 (May 26), the Senate with zero no votes (Aug 26 — the daily history records 39-0, the roll call 40-0), and Assembly concurrence 69-0 (Aug 27). Sent to Engrossing and Enrolling Aug 27. Not signed. Gov. Newsom has until Sept 30, 2026 to act.

Note the limit of the carve-out: it amends the definition of "operating system provider" in subdivision (g) only. There is no equivalent exclusion in (e) for "covered application store" or in (f) for "developer." Contrary to widespread reporting, it does not cover code repositories or containers — that language is Colorado's, not California's.
Ageless Linux: EXEMPTION PASSED — UNSIGNED
ENROLLED
Passed Aug 27, 2026
Sign-by Sep 30, 2026

Active Bills

States Working on Becoming Noncompliant

New York
S8102A — Age Assurance on Internet-Enabled Devices
Requires device manufacturers, OS providers, and app stores to conduct "age assurance" at device activation. Stricter than California — requires "commercially reasonable" methods that "reasonably prevent against circumvention," not just self-declaration. $10,000 per violation. AG Letitia James gets rulemaking and enforcement authority. Effective one year after signing if passed.
Ageless Linux: PREEMPTIVELY NONCOMPLIANT
BILL
In Committee
2026
Federal
H.R. 8250 — Parents Decide Act
First federal bill to adopt California's OS-level model directly. Requires every operating system provider to collect a date of birth from every user at account setup, require parental verification for users under 18, and expose an API that hands that date of birth to every app developer. Defines "operating system provider" as "a person that develops, licenses, or controls the operating system" — no exemption for open source, non-commercial, or hobbyist maintainers. The phrase "general purpose computing device" is undefined and punted to FTC rulemaking. Introduced April 13, 2026 by Rep. Josh Gottheimer (D-NJ-5) with original cosponsor Rep. Elise Stefanik (R-NY); Rep. Brian Fitzpatrick (R-PA) joined as a second cosponsor April 22, 2026. Referred to House Energy & Commerce — no hearing or markup scheduled, no Senate companion. Enforced by the FTC as an unfair or deceptive act or practice. FTC regulations due within 180 days of enactment; effective one year after enactment. The sponsor's press release named "Apple and Google" as the targets; the statutory text catches every Linux distribution maintainer in the country.
Ageless Linux: PREEMPTIVELY NONCOMPLIANT
BILL
Introduced
Apr 13, 2026
Federal
KIDS Act (H.R. 7757) + GUARD Act (S.3062)
The KIDS Act has become the consolidated House children's-online-safety vehicle. A bipartisan Energy & Commerce deal announced June 24, 2026 folds in KOSA, COPPA 2.0, Sammy's Law, and the federal App Store Accountability Act (Lee S.1586 / James H.R.3149). The House passed it 267-117 on June 29, 2026 under suspension of the rules. It was received in the Senate, read twice, and referred to the Senate Commerce Committee on July 13, 2026, where it now sits. The GUARD Act (AI companion chatbots) was reported out of the Senate Judiciary Committee unanimously on Apr 30, 2026 and awaits a Senate floor vote. The federal app-store mandate is advancing inside KIDS rather than standing alone.
WATCHING
IN SENATE
Passed House
Jun 29, 2026

Withdrawn

States That Blinked

Michigan
HB 4429 / SB 284 — Digital Age Assurance Act
Identical bipartisan bills (Rep. Brad Paquette, R-Niles; Sen. John Cherry, D-Flint) based on Digital Childhood Alliance model legislation. Would have required device manufacturers and operating systems to estimate user age at activation and transmit a continuous "digital age signal" to apps and websites. Critics — including the Michigan Fair Elections Institute and University of Michigan privacy researchers — identified that the bills lacked limits on data use, had no restrictions on combining data with other personal information, and contained no data deletion requirements. Pulled by sponsors April 6, 2026 after advocacy outreach beginning April 4.
WITHDRAWN
DEAD
Pulled
Apr 6, 2026

International

It's Not Just the United States

Brazil
Lei 15.211 — Estatuto Digital da Criança e do Adolescente (Digital ECA)
Scope: operating systems, app stores, social media, games, and "any software likely to be accessed by minors." Explicitly bans self-declaration (Art. 9) — requires "proportional, auditable, and technically secure" age verification methods. Simultaneously bans "mass, generic, or indiscriminate surveillance" (Art. 37). The law demands real verification, forbids asking users their age, and forbids surveillance. The ANPD has not yet issued implementing regulations defining what methods are acceptable. Penalties up to 10% of Brazilian gross revenue or R$50M (~$9.4M USD) per violation. Foreign providers must maintain a legal representative in Brazil. Enforced by the ANPD (Autoridade Nacional de Proteção de Dados).
Ageless Linux: NONCOMPLIANT
LAW
Effective
Mar 17, 2026

Analysis

Two Models, Same Problem

These laws follow two distinct models, but both create the same compliance moat for open-source operating systems (see Goldman, "Segregate-and-Suppress").

Model A: App Store Accountability (TX, UT, LA)

Focuses on app stores. Requires "commercially reasonable" age verification — which could mean government ID checks. Requires parental consent for minors. Texas was preliminarily enjoined as likely unconstitutional under the First Amendment, but the Fifth Circuit stayed that injunction, the law took effect June 4, 2026, and the Supreme Court declined to re-block it on July 6, 2026 without reaching the merits. Utah is the only state with a private right of action (individuals can sue, not just the AG).

Linux impact: Primarily affects app store operators. If apt, Flathub, or Snap Store are "covered application stores," their maintainers have obligations. Individual distro maintainers face less direct liability, but the definition is broad enough to sweep them in.

Model B: OS-Level Age Assurance (CA, CO, IL; MI withdrawn)

Focuses on operating system providers. Requires age collection at account setup, real-time API for age signals. California, Colorado, and Illinois accept self-declaration; the federal Parents Decide Act (H.R. 8250) adds parental verification for minors. This is the model that directly targets Linux distributions, because it requires the OS itself to collect and transmit age data.

Linux impact: Colorado and California have now carved free-software distributors out of the definition of "operating system provider." Illinois, enacting the same architecture eight weeks later, did not. The model does not exempt Linux; two of the three legislatures that adopted it chose to, one after direct lobbying by a hardware vendor and one after a year of public argument. That is a lobbying outcome, not a property of the statute, and it has to be won again in every jurisdiction.

Both Models Share One Feature

Apple and Google already comply. The 600+ volunteer Linux distributions cannot. The compliance cost is zero for trillion-dollar platform companies and prohibitive for community projects. Both models passed with overwhelming bipartisan support. Both were supported by the major platform companies.

This is not a coincidence. This is a compliance moat.

The EFF calls this pattern "a windfall for Big Tech and a death sentence for smaller platforms."

Enforcement Timeline

When Things Become Illegal

Oct 13, 2025
California AB 1043 signed
Passed 76-0 / 38-0. Effective Jan 1, 2027.
Dec 23, 2025
Texas SB 2420 enjoined
Federal judge blocks enforcement pending litigation.
Feb 5, 2026
CCIA sues Utah over SB 142
First Amendment, parental autonomy, interstate commerce. Motion for preliminary injunction filed.
Feb 17, 2026
Alabama HB 161 signed
Fourth state to enact an App Store Accountability Act. Effective Jan 1, 2027.
Mar 3, 2026
Colorado SB 26-051 passes Senate 28-7
Heading to House. Would take effect Jul 1, 2028.
Mar 17, 2026
Brazil Lei 15.211 takes effect
First international OS-level age verification law. Bans self-declaration. Penalties up to ~$9.4M USD.
Apr 6, 2026
Michigan HB 4429 / SB 284 withdrawn
Digital Age Assurance Act pulled by sponsors after privacy advocates identified critical gaps. First state bills based on this model to be withdrawn.
Apr 13, 2026
Federal H.R. 8250 "Parents Decide Act" introduced
Rep. Josh Gottheimer (D-NJ) and Rep. Elise Stefanik (R-NY) introduce the first federal bill to require OS-level age verification. Scope: every "operating system provider." FTC enforcement as an unfair or deceptive practice. Referred to House Energy & Commerce.
Apr 21, 2026
CCIA drops its Utah SB 142 suit
Voluntary dismissal after the state confirms SB 142 has no government enforcement — only a private right of action. The PI motion is never decided; the law stands.
Apr 30, 2026
Colorado House passes SB 26-051 40-23; GUARD Act clears Senate Judiciary
Colorado's House adopts an open-source exemption. The same week, the federal GUARD Act is reported out of the Senate Judiciary Committee unanimously.
May 6, 2026
Utah SB 142 in effect; SB 73 takes effect
First US App Store Accountability Act compliance date passes. SB 73 (the VPN/network-layer law) takes effect the same day, though Utah agrees to pause its enforcement until Sept 3.
May 15, 2026
Louisiana delays HB 570 to 2027
HB 977 pushes the effective date back a full year and lets developers rely on app-store age signals.
May 26, 2026
California AB 1856 passes Assembly 68-1
Adds an open-source exemption to AB 1043 while also expanding age-gating to browsers and website operators. EFF: "one step forward, two steps back." To the Senate.
Jun 3, 2026
Colorado SB 26-051 signed
Gov. Polis signs the second US OS-level age law — with an open-source exemption. Effective Jul 1, 2028.
Jun 4, 2026
Texas SB 2420 takes effect
The Fifth Circuit stays the December injunction; the App Store Accountability Act goes live. Apple and Google begin Texas age-assurance flows.
Jun 15, 2026
CCIA and teen users ask SCOTUS to re-block Texas
Emergency applications (Nos. 25A1389 / 25A1390). Justice Alito orders Texas to respond by June 22. First Supreme Court test of an app-store age mandate since FSC v. Paxton.
Jun 29, 2026
KIDS Act (H.R. 7757) passes the House 267-117
Consolidated KOSA + COPPA 2.0 + App Store Accountability Act package clears under suspension of the rules. Referred to Senate Commerce July 13, 2026.
Jul 6, 2026
SCOTUS declines to re-block Texas SB 2420
Both emergency applications denied without explanation and without noted dissent. No merits ruling. The law stays in force; the First Amendment challenge proceeds in the Fifth Circuit.
~Jul 2026
Browser and website expansion stripped from AB 1856
The provisions extending age-gating beyond operating systems and app stores are removed. EFF withdraws its opposition, while maintaining that the underlying regime still threatens anonymity, privacy, and security.
Jul 31, 2026
Illinois HB 5511 signed — Public Act 104-0664
Gov. Pritzker signs the third US OS-level age assurance law, with no open-source exemption. Same four age brackets, same account-setup interface, same real-time signal. Compliance date Jan 1, 2028. Covered by national press as a social media bill.
Aug 26–27, 2026
California AB 1856 passes both houses
Senate passes with zero no votes Aug 26; Assembly concurs 69-0 Aug 27. Adds § 1798.500(g)(2), excluding anyone distributing under license terms permitting a recipient to copy, redistribute, and modify. To Engrossing and Enrolling.
Sep 3, 2026
Utah SB 73 enforcement standstill ends
The VPN provisions become enforceable unless the Aylo litigation extends the pause.
Sep 30, 2026
Deadline for Gov. Newsom to sign or veto AB 1856
Until he acts, § 1798.500(g) is unamended and every Linux distribution maintainer remains an operating system provider in California.
Dec 31, 2026
Utah enforcement begins
Private right of action active. Individuals can sue.
Jan 1, 2027
California AB 1043 + Alabama HB 161 take effect
Ageless Linux becomes officially noncompliant. We begin distributing devices.
Jul 1, 2027
California retrofit deadline; Louisiana HB 570 takes effect
Existing California devices must have an age collection interface added. Louisiana's delayed App Store Accountability Act goes live.
Jul 1, 2028
Colorado SB 26-051 takes effect
Second state with OS-level requirements — subject to its open-source exemption.

Ageless Linux compliance status across all jurisdictions, all dates:

NONCOMPLIANT

Penalty Comparison

Cost of Giving a Child a Computer

$7,500
California / Colorado
per child, intentional
$10,000
Louisiana
per violation, after cure
$10,000
Texas
per violation (DTPA)
$10,000
New York
per violation (if passed)
$1,000
Utah
per violation + attorney fees
Private right of action
~$9.4M
Brazil
per violation or 10% of Brazilian revenue
R$50M cap

Cost of one Ageless Linux device: $12-18
Maximum combined US penalty for one device given to one child: $46,000

US penalty-to-cost ratio: 3,067:1
Brazil penalty for one violation: up to 522,222:1