California Digital Age Assurance Act (AB 1043)

Requires operating system providers to collect a user age bracket at device setup and expose it to app developers through an API; effective 1 January 2027 with full compliance by 1 July 2027.

JurisdictionCalifornia
CategoryPrivacy & Data Protection
StatusUpcoming
Effective date
Latest development

Analysis

The California Digital Age Assurance Act (AB 1043) is a California statute that requires operating system providers to collect a user’s age or age bracket at device account setup and expose a non-identifying age-bracket signal to app and online service developers, with obligations starting January 1, 2027 and full deployment requirements by July 1, 2027.California AB 1043 bill text (LegiScan) California Digital Age Assurance Act – overview Operating-System Age Verification Requirements – analysis California Age Verification Law tracker

Below is a structured, regulation-focused analysis.

Key Requirements

  • Scope and covered entities
  • Age collection at device/account setup
  • Defined age brackets
  • Age signal transmission to apps and online services
  • Non-identifying and privacy-oriented design
  • Effective dates and phased compliance
  • Enforcement and penalties

Compliance Challenges

  • Technical integration across diverse operating systems and app ecosystems
  • User experience and parental controls
  • Privacy, civil liberties, and risk of over-blocking
  • Alignment with other child-protection and privacy laws
  • Example challenges and cases

Implementation Best Practices

These are practical, but organizations should always cross-check against legal counsel and official statutory language.

  • Establish a structured age-bracket collection flow
  • Implement a robust age-bracket API and governance
  • Align with recognized privacy and child-protection frameworks
  • Tools, resources, and reference materials

Recent Updates

  • AB 1043 enactment and status
  • AB 1856 – amendment and expansion of the regime
  • AB 1856 (Wicks) is an amendment bill referencing and building on AB 1043, further addressing California’s age verification system and expanding age-g

Recent developments

  • — AB 1856, passed in late August 2026, amends the California Digital Age Assurance Act (AB 1043) to exempt open‑source operating systems like Linux from age‑verification obligations, while keeping major commercial platforms such as Windows, macOS, iOS, and Android fully in scope and reaffirming the January 1, 2027 implementation date for age prompts on new and existing devices.[9][1] (source)
  • — The Electronic Frontier Foundation reports that California has stepped back from a proposed expansion of AB 1043’s age‑gating rules, but emphasizes that the core law—requiring operating systems and app stores to collect user ages, assign age brackets, and restrict young people’s access to lawful online speech and services—still goes into effect in January 2027.[6][13] (source)
  • — EFF analyzes AB 1856 as a mixed development, noting that while it carves out open‑source software from AB 1043’s definition of “operating system provider,” it simultaneously broadens the age‑gating framework by reinforcing requirements for age‑bracketing systems across commercial platforms and potentially deepening compliance burdens and speech restrictions.[5][1] (source)
  • — The Register reports that lawmakers are revising AB 1043 to add an open‑source carve‑out so that distributors of Linux and similar software are no longer treated as “operating system providers,” responding to concerns that the Digital Age Assurance Act would otherwise force community projects to build complex age‑verification infrastructure under penalty of fines.[1][12] (source)
  • — A Russian‑language report highlights that AB 1043, effective January 1, 2027, will require operating system providers to integrate age‑tracking tools and a specialized API for age signals, warning that open‑source projects such as Debian and SteamOS initially faced significant compliance risks and fines of up to $7,500 per child before exemptions were advanced.[2][15] (source)
  • — EFF’s March 2026 analysis argues that AB 1043’s requirement that operating systems and app stores create age‑bracketing systems, collect users’ birthdates or ages, and share age‑bracket signals with application developers will harm privacy and online freedoms for all users, not just minors, by normalizing age‑gated access to lawful services.[13][15] (source)
  • — EFF also discusses industry and civil‑society reactions, noting that developers, privacy advocates, and digital rights groups are worried that AB 1043’s mandated age‑gating infrastructure will increase compliance costs, incentivize pervasive age data collection, and limit minors’ access to lawful information and services, prompting calls for exemptions and legislative revisions such as AB 1856.[13][5] (source)
  • — Hackaday criticizes AB 1043 as a problematic attempt to add age verification to software, explaining that OS providers must implement an age‑selection interface during account setup, categorize users into four brackets (under 13, 13–15, 16–17, 18+), expose an API to app developers and app stores, and face penalties up to $7,500 per affected child for intentional violations.[15][8] (source)
  • — Gigazine reports that AB 1043 will require operating systems to collect users’ age information at account setup and provide that data to applications via an API to protect minors online starting in January 2027, while also noting Governor Newsom’s caution and calls for reconsideration of the law despite having signed it in October 2025.[10][8] (source)
  • — A technical commentary warns that AB 1043’s statewide age‑assurance framework, mandating age or date‑of‑birth declarations during OS account setup and an age‑bracket API for apps, could effectively regulate every command or application on Linux systems, raising broad concerns about privacy, implementation complexity, and unintended impacts on general‑purpose computing.[12][1] (source)

Related regulations

Put it into practice

Browse all regulations · Compliance deadlines · Latest updates