California and Colorado, those bastions of progressive tech regulation, have been busy. They’ve been rolling out these age verification laws like confetti, and frankly, most of us in the trenches expected Linux distributions, the unsung heroes of the internet, to get caught in the crossfire.
And for a hot minute, they were. The original texts of California’s AB 1043 and Colorado’s SB26-051? Not a single concession for open source. This would have been a nightmare for anyone distributing an OS under terms that allow, you know, copying, modifying, and generally being free. It’s the bedrock of open source, and suddenly it was under threat from legislation designed for, well, who knows what they were really thinking. Probably something about kids seeing R-rated movies online, but the broad strokes were threatening.
But here’s the thing: they blinked. Both states, after some considerable… persuasion, have modified their laws to carve out specific exemptions for open-source software.
California’s Legislative Acrobatics
California’s AB 1043, signed into law in October 2025, originally demanded OS providers collect user age or birth dates at account setup and beam that data to apps via a real-time API come January 1, 2027. When the open-source community rightfully freaked out (and yes, I’m paraphrasing their internal memos here), Assembly Member Buffy Wicks, the bill’s author, stepped up. Or rather, AB 1856 did, which she introduced in February.
After a few rounds of edits – four, to be precise – the bill now defines “operating system provider” to explicitly exclude anyone distributing an OS under licenses that permit recipients to copy, redistribute, and modify the software. Most Linux distros, bless their permissive or copyleft hearts, fall squarely into this category. On top of that, they’ve tweaked the definition of “application” so that software not offered as a standalone executable through a covered app store is no longer ensnared by the law. The bill sailed through the Appropriations Committee (11-0, no less) and is now just awaiting an assembly vote. Funny how that works when the chair of the committee is the bill’s author, isn’t it?
Colorado’s Community Comeback
Colorado’s win is a bit more of a grassroots victory, and it highlights the power of direct engagement. Carl Richell, the founder of System76 – a company that actually makes Linux-powered laptops, imagine that – spent a good chunk of time jawboning with Senator Matt Ball, one of SB26-051’s co-authors. The result? Exemptions for OS providers and developers who distribute software under terms allowing for copying, redistribution, and modification.
They even added a clause: exempt software must have no platform-imposed technical or contractual restrictions blocking modified versions. This is a direct jab at tivoization, that insidious practice of locking down hardware to prevent custom software, even when the source code is out in the open. Beyond that, code repository providers, containerized distributions, and apps from free, public repositories are explicitly off the hook. Furthermore, Colorado’s law is much narrower in scope, only applying to OS providers who run or pre-install a “covered app store.” If you’re an OS provider without app store involvement, you’re not even in their sights.
Colorado’s law is slated to kick in July 1, 2028. Plenty of time for more legislative theatre, I’m sure.
The Bigger Picture: Who’s Actually Benefiting?
It’s easy to dismiss these legislative wins as mere technicalities, but that would be missing the point. These exemptions didn’t appear out of thin air. They were the result of sustained community pressure and direct outreach to lawmakers. This isn’t just about keeping Linux users from having to enter their birthdate to boot up their machines. It’s a template. When lawmakers, often swayed by the lobbying might of Big Tech companies who want to control the digital frontier, overlook the foundational elements of the internet – like open-source software – the only recourse is often disruption and direct advocacy.
This struggle, this pushback, is what keeps the digital world from becoming a fully privatized, walled garden. It’s a reminder that the people who build and maintain these systems have a voice, and sometimes, that voice can actually get heard above the din of corporate interests.
The real question for those in the software industry is this: how many more of these battles will have to be fought before policymakers truly understand the value and architecture of open-source development? Probably too many. But at least for now, a significant chunk of the open-source world can breathe a little easier.
