Age verification laws have moved beyond social media and porn. Three US states have passed laws requiring operating systems to collect users' ages, and the EFF's Aaron Mackey says he expects Apple, Google, and Microsoft to mandate age verification nationwide. Congress is discussing a federal law to this end, too. Come 2027, you might even have to scan your face or upload a photo ID to prove you're a legal adult before you can use your computer.

This new front in the age verification battle comes after more than two dozen states passed laws targeting adult websites like PornHub, and Utah started cracking down on VPNs. Major OS developers aren't pushing back, but the open-source community has been vocal about the risks to your online privacy and the future of the web.

The California Ripple Effect: How One State Law Controls the Globe

Starting in 2027, California's Digital Age Assurance Act will require operating systems, including Windows, macOS, Android, and ChromeOS, to ask users for their age during device setup and share an age range with apps. California's amended law now exempts Linux distributions, in a win for the open-source community. Depending on how future laws evolve, that process could eventually involve government IDs, credit cards, or biometric verification.

Aaron Mackey, deputy legal director at the Electronic Frontier Foundation, warns the effects won't stop at California’s borders. Because tech companies rarely build separate operating systems for different states, he says these systems will likely be rolled out "for everyone who uses [operating systems], including the billions of folks outside of California."

Colorado followed California by passing a similar law, and Illinois did as well. The three states are unlikely to remain alone for long. Similar bills are advancing in other states, while the proposed federal Parents Decide Act would, if passed, expand age verification at the operating-system level nationwide. At WWDC 2026, Apple discussed age-based content restrictions across apps and websites for child accounts, which are mandatory for users aged 13 and under. You might have to prove your age to avoid this requirement, too. Apple recently introduced mandatory age verification for new accounts in Texas, and more states are likely to follow.

"The open-source community was rightly anxious about how they would ever comply with this," comments Mackey on the amendment. However, that isn't the end of the story. "At the end of the day, this sort of age-gating regime will go into effect in January," he says, pointing out the requirement still applies to macOS and Windows computers, as well as phones and tablets. He says Apple, Google, and Microsoft likely won't implement different age verification systems in each state, but rather a single national system for practicality.

Privacy advocates, open-source developers, and lawmakers are now battling over a question that could reshape the future of computing: Should your computer know your age before you can use it? Here's what you need to know so far.

Where You Live (or Don't) Matters: The 3 States Leading the Push

As of this writing, three states have OS age verification laws:

- California has the Digital Age Assurance Act (AB 1043), which takes effect on Jan. 1, 2027. It applies to closed-source operating systems such as macOS and Windows. California's law no longer applies to Linux and other open-source operating systems after AB-1856 passed in September, 2026.

- Colorado has bill SB26-051, which takes effect on July 1, 2028. It exempts open-source operating systems, such as Linux.

- Illinois has the Children's Online Social Media Safety Act (HB5511), which takes effect on Jan. 1, 2028. Illinois' law applies to Linux and other open-source operating systems, unlike the laws in California and Colorado.

California’s law is the first and serves as a model for other states. It requires that operating systems ask for your age when you set them up. Your OS must then share an age bracket signal with the applications running on your computer. Applications will see one of the following age ranges: under 13, 13-16, 16-18, or over 18.

Application developers are then “deemed to have actual knowledge of the age range of the user.” They would have a legal duty to comply with any laws requiring different treatment of minors and could not plead ignorance of the device user's age. An application might need to restrict access or features for users under 18, in accordance with other laws, including the federal Children's Online Privacy Protection Act of 1998 (COPPA), which requires online services to handle the personal information of users under the age of 13 differently. This could affect dating, gaming, and social media apps, for example. California’s law doesn’t affect websites. However, a proposed California law would extend the age signal to the web.

Face Scans, Passports, or Honor System? How Age Verification Will Work

Under California’s law, as written, your operating system must ask for your age during the device setup process. Your operating system will accept that age without requiring identification. Attestation—in other words, simply declaring your age—is sufficient proof.

Nichole Rocha, a data privacy attorney who represents Children Now, a California-based organization that backs the law, tells me that California’s bill was designed to protect privacy. “There’s no requirement for the uploading of a government ID, and that was intentional on the part of the author, [California state assembly member] Buffy Wicks,” she says.

“I think the bill strikes an appropriate balance. You see other states requiring the uploading of government IDs, and that’s incredibly invasive,” says Rocha. She argues that research shows parents set up devices for minors and will enter a child's age accurately at that time.

However, the EFF believes that operating system providers such as Apple, Google, and Microsoft will require more personal information. “While the law on paper doesn’t require strict age verification, I think in practice compliance will look a lot more like age verification,” Mackey says.

He points out that there are fines and legal consequences if minors bypass age checks, and that companies will want to prevent minors from lying. “That involves more invasive forms of age verification that adult websites implement,” he says. That could mean providing a credit card, a facial scan, or a government ID during OS setup to verify that an adult was involved in the process. Microsoft's age verification system will cover both unverified and verified ages, with the latter requiring a facial scan or government document.

Beyond California: The Federal Push to Track OS Users

On the federal level, the Parents Decide Act, introduced in Congress in April, would require OS-level age checks in all states if it passes. Specifically, the proposed law says operating system providers must "require any user of the operating system to provide the date of birth of the user" to set up an account or use the OS. Adults would also have to provide their date of birth. The Federal Trade Commission (FTC) would also need to “issue regulations on how operating system providers can… verify the date of birth of a parent or legal guardian” if a minor is setting up a device. This could include government identification checks during device setup; implementation details would be up to the FTC.

Similar language appears in other proposed bills. The Kids Online Safety Act, introduced in the Senate in 2025, would require the Secretary of Commerce to "conduct a study evaluating the most technologically feasible methods... to verify age at the device or operating system level."

Rocha doesn’t expect the federal government to take action. “Every year, things pop up in Congress that never get signed, right?” she says. “We just haven’t seen anything meaningful happen at the federal level in this space since the mid-1990s.” The EFF is concerned about the current legislative environment, however. "This is a trend we're seeing," says Mackey. "Lawmakers don't understand the technology, and they don't understand that these proposals are unpopular."

Other states followed California and Colorado. As mentioned, Illinois legislators passed the Children’s Online Social Media Safety Act, HB5511. It requires the person setting up a device to declare only an age, without requiring proof of identity.

“I hope that by doing privacy-protective and nuanced legislation in California, we’re serving as a model for the rest of the states,” says Rocha.

Some states might require more personal identification. New York’s senate, for example, is discussing Bill 8102, which will require operating systems to determine user ages via “commercially reasonable age assurance methods.”

Behind the Code: How Apps Will Silently Request Your Age

Apps will get your age range from your operating system using an application programming interface (API). In other words, they’ll ask the operating system for your age range and get a response.

Major operating system vendors are already implementing compliant APIs. Google offers the Play Age Signals API for Android apps on Google Play, while Apple offers the Declared Age Range API for iOS and macOS. Microsoft is adding a Windows Age API to Windows 11. The system software used by many Linux distributions now includes an age field for user accounts, too.

Moving the Gatekeeper From Websites to Your Operating System

The legislation discussed above moves age verification from the application or website layer to the device or operating system level. PornHub has urged Apple, Google, and Microsoft to implement OS-level age verification. With OS-level age verification, adult online services like PornHub would not need to confirm visitors' ages by collecting documentation themselves. Instead, the operating system would have that obligation. PornHub is already using Apple's iOS signals to verify visitors' ages in the UK.

However, as mentioned, California law does not require the operating system to relay page signals from the web browser to a website. That’s surprising, given that age-verification laws in many states have targeted adult websites. Rocha says California’s lawmakers were trying to address the web in the original law, but “ran out of time.” California's Bill AB 1856 extended the age verification requirement to internet websites owned by application developers. For example, the law would apply to both Facebook's app and website.

Web browser developers are already working on age-verification standards. Google’s Chromium and Apple’s Safari both support the Digital Credentials API to share government identification information with websites. If you save a driver's license or other government ID to Apple Wallet or Google Wallet on your phone, you can securely share your credentials with websites. Theoretically, you could use the same process to share an age you provided to your desktop operating system with a website, too.

Why Open-Source Developers Are Fighting State Legislatures

In addition to affecting Apple’s iOS and macOS, Google’s Android and ChromeOS, and Microsoft's Windows, some of these laws impact smaller open-source community operating systems, including Linux distributions.

The open-source community is discussing age verification laws, and some projects have already commented publicly. GrapheneOS, a privacy-focused Android fork, has announced its intention to “remain usable by anyone around the world without requiring personal information, identification, or an account.” The project adds, “If GrapheneOS devices can't be sold in a region due to their regulations, so be it."

“I think the open-source community is rightly very concerned about what’s happening here,” Mackey says of these laws. He points out that many open-source operating systems prioritize privacy and don’t want to collect user data or engage in surveillance. California now exempts operating systems distributed "under license terms that permit a recipient to copy, redistribute, and modify the software" after the passage of AB-1856. The EFF is pleased with this change, writing that "The bill is narrower now than it was before, and lawmakers clearly responded to concerns raised by EFF and the broader open-source community." It still takes issue with the concept of age-gating, however.

Colorado's bill SB26-051, signed into law on June 4, 2026, exempts Linux distributions and other open-source software. Specifically, the law says it doesn't apply to "an operating system provider... that distributes an operating system... under license terms that permit a recipient to copy, redistribute, and modify the software."

The Illinois age verification law, however, applies to Linux distributions and other open-source operating systems.

Could VPNs Be Forced to Block Unverified Devices?

California’s law doesn’t mention VPNs. However, under other laws or regulations, a VPN application might need to block access based on OS-level age signals. Or applications and websites might legally need to check the OS-level age signal to confirm user ages.

A New Era of Hardware Tracking

Although I spoke to lawyers for this piece, I’m not a lawyer. I’m a tech geek who’s been using computers and operating systems for decades. As far as I can see, there are two types of laws under discussion: those that ask for your age and those that require proof of your age.

California’s law, as well as the laws passed in Colorado and Illinois, accept whatever you provide during device setup. This imposes additional legal requirements on operating system providers, including open-source communities, to design interfaces that collect users' ages. Rocha summarizes the California law’s approach: “We are going to try and protect as many children as possible in the most privacy-protecting way possible. And there will probably be some kids who get around the system, but the vast majority of kids will be protected by this.”

Mackey is skeptical that you'll just be able to enter an age without any proof, however. He expects many companies will require more information to protect themselves from legal liability, despite good-faith exemptions in the amended bill. "I think it will be more invasive," he says. "We'll just have to see."

Legislation like the proposed bill in New York could require you to prove your age with a credit card, facial scan, government ID, or another method when setting up your device. A federal law could enforce this nationwide, depending on what the FTC requires. Future operating systems may require biometrics or identity document verification during device setup.

I’m not a fan of either type of law. I don’t believe governments should require operating systems—especially small, open-source projects—to verify their users' personal information, or risk legal liability. I want privacy-centric operating systems that don’t collect any user data to continue existing.

“The open internet as we know it allows people to access information anonymously, privately, and securely,” says Mackey. “It’s in danger by lawmakers who have good intentions but are writing broad laws.”

Mackey doesn’t think these laws are inevitable, though. “My hope is that people are energized by this [debate] and recognize the opportunity that we can push back,” he says.