In a rare moment of unanimous agreement, California's legislature has carved out a protected space for open-source software within its new age-verification law, recognizing that the tools built by volunteer communities under GPL, MIT, BSD, and Apache licenses cannot be governed by frameworks designed for centralized commercial platforms. AB-1856 reflects a growing legislative awareness that not all digital infrastructure is the same — that some of it belongs, in a meaningful sense, to everyone. The exemption raises a quiet but important question for the rest of the country: when we reach for r
California Exempts Open-Source Software from Age Verification Law
Open-source software operates on a fundamentally different model
Mark
So California passed a law requiring age verification for digital services, but carved out open-source software. Why does that distinction matter?
Mimi
Open-source software is distributed differently than commercial platforms. There's no central company checking IDs at the gate. A developer in California might maintain code that's downloaded by thousands of people worldwide. Imposing age verification on that would be like requiring a librarian at every photocopy machine.
Luke
But the bill text itself—do we know what triggered the exemption? Was it lobbying from the tech community, or did legislators independently recognize the problem?
Mimi
The reporting doesn't specify the legislative history. We know it passed unanimously, which suggests there was consensus, but the source material doesn't detail who pushed for the exemption or what arguments won the day.
Mark
The four licenses mentioned—GPL, MIT, BSD, Apache—do those cover most open-source projects?
Mimi
They're the dominant ones, yes. GPL is the most widely used copyleft license. MIT and BSD are permissive. Apache is enterprise-friendly. Together they probably account for the vast majority of publicly available open-source code.
Luke
Probably. But the bill only exempts those four licenses. What about projects under other open-source licenses? There are dozens of them—AGPL, MPL, ISC, others. Are they covered or not?
Mimi
That's a real gap in the reporting. We don't know if the exemption is narrow or broad, or whether other open-source licenses are treated as non-exempt.
Mark
And practically speaking, how would age verification even work for open-source software?
Mimi
That's the core problem. You can't verify the age of someone downloading code from GitHub. There's no transaction, no login, no point of control. The exemption sidesteps the impossibility.
Luke
But does the bill define what counts as "distributed under" these licenses? If I take MIT-licensed code and redistribute it commercially, am I still exempt? The source material doesn't say.
Mimi
No, it doesn't. Those are the kinds of implementation questions that will probably get worked out in regulation or litigation.
Il Polso
- Age-verification mandates have been spreading across states, placing compliance burdens on digital platforms that must confirm users' ages before granting access to restricted content.
- Open-source projects — often maintained by volunteers with no central business entity — faced an impossible friction: no mechanism, no budget, and no clear legal responsibility to verify who downloads their code.
- California's AB-1856 resolved this tension with a targeted exemption, explicitly naming the four dominant open-source licenses and shielding their distributions from the mandate's reach.
- The bill passed unanimously, a signal that lawmakers across the political spectrum recognized open-source software as foundational infrastructure rather than a regulatory target.
- The exemption now stands as a potential template — or a cautionary contrast — for other states drafting age-verification legislation of their own.
In a rare moment of unanimous agreement, California's legislature has carved out a protected space for open-source software within its new age-verification law, recognizing that the tools built by volunteer communities under GPL, MIT, BSD, and Apache licenses cannot be governed by frameworks designed for centralized commercial platforms. AB-1856 reflects a growing legislative awareness that not all digital infrastructure is the same — that some of it belongs, in a meaningful sense, to everyone. The exemption raises a quiet but important question for the rest of the country: when we reach for regulation, do we understand what we are reaching for?
California has passed AB-1856, a digital age-verification law with a significant and unanimous carve-out: software distributed under the GPL, MIT, BSD, and Apache licenses is explicitly exempt from its requirements. The unanimous vote is itself remarkable, suggesting that legislators across the political divide agreed the state's regulatory framework should not reach into the open-source ecosystem.
The reason is structural. Age-verification laws are designed for centralized commercial platforms — entities with legal teams, compliance budgets, and the ability to implement verification systems at scale. Open-source software operates differently. Code is freely distributed, often maintained by volunteers or small teams with no central organization to absorb compliance costs. Asking a volunteer maintainer to verify the age of every person downloading their software is not merely burdensome — it is incoherent.
By naming the four dominant open-source licenses specifically, California demonstrated that it understands the landscape it is legislating around. The GPL, MIT, BSD, and Apache frameworks together govern the vast majority of publicly available open-source code, from individual tools to enterprise infrastructure used by governments and schools alike. Exempting them does not weaken the bill's core purpose; it simply acknowledges that the regulatory instrument was not built for this terrain.
What happens next is an open question. As age-verification laws continue to spread, other states will face the same dilemma. California's approach — explicit exemption, clearly named licenses, unanimous passage — offers one answer. Whether it becomes a national template or a lonely outlier will depend on how well other legislatures understand what they are regulating when they reach for open-source code.
California's legislature has passed AB-1856, a bill that imposes age-verification requirements on digital platforms and services—but with a significant carve-out: open-source software distributed under the GPL, MIT, BSD, and Apache licenses is exempt from the mandate. The passage was unanimous, a rarity in contemporary legislative politics, suggesting broad agreement that the state's age-verification framework should not entangle the open-source ecosystem.
The bill itself represents California's latest attempt to regulate how minors access certain digital content and services. Age-verification laws have proliferated across states in recent years, typically requiring platforms to confirm a user's age before granting access to age-restricted material. The compliance burden falls on the platforms themselves, which must implement verification systems, manage data, and ensure accuracy. For most commercial services, this is a manageable operational cost. For open-source projects, however, the calculus is different.
Open-source software operates on a fundamentally different model than proprietary platforms. Code is distributed freely, often maintained by volunteers or small teams with no centralized business entity to shoulder compliance costs. A developer in California might contribute to a project hosted on a server in another country, with users worldwide. Imposing age-verification requirements on such distributed, community-driven work would create impossible friction: How would a volunteer maintainer verify the age of every person downloading their software? Who bears the legal liability? The exemption sidesteps these questions by recognizing that open-source distribution does not fit the regulatory framework designed for centralized digital platforms.
The four licenses explicitly protected—GPL, MIT, BSD, and Apache—represent the dominant legal frameworks governing open-source development. The GPL, in particular, is the most widely used copyleft license, requiring that derivative works remain open-source. MIT and BSD are permissive licenses that allow broad reuse with minimal restrictions. Apache is similarly permissive and widely adopted in enterprise open-source projects. Together, they cover the vast majority of publicly available open-source code. By naming these licenses specifically, California's legislature signaled that it understands the open-source landscape and is willing to accommodate its unique characteristics.
The unanimous passage is noteworthy. In an era of partisan division, a bill that passes without dissent suggests either broad consensus or careful negotiation that addressed the concerns of all parties. In this case, it likely reflects recognition across the political spectrum that open-source software is foundational infrastructure—used by government agencies, schools, businesses, and individuals—and that regulatory overreach could harm innovation and accessibility. Exempting open-source code from age verification does not undermine the bill's core purpose; it simply acknowledges that the regulatory tool is not suited to all digital contexts.
The exemption may also signal how other states will approach similar legislation. As age-verification bills spread, lawmakers will face the same question: How do we regulate digital access without strangling open-source development? California's answer—explicit exemption for major open-source licenses—provides a template. Other states considering age-verification laws may adopt similar carve-outs, or they may ignore the precedent and impose compliance requirements that open-source communities will have to navigate or challenge in court. The coming months will reveal whether California's approach becomes a model or remains an outlier.
Vuoi la storia completa?
Leggi l'originale su Google News ↗
Politics & Governance