Why Age Verification Laws Matter to Developers

Age assurance is a broad concept encompassing self-declaration, ID verification, and face/behavior-based estimation. Proposals in various countries aim to either restrict minors' access to specific services or content, or require devices, operating systems, and app stores to collect age information and pass signals to apps and websites. It is also important to recognize that online communities and open source development participation can be part of education and social life.

If the scope is misdefined, obligations may spill over into areas with entirely different risk profiles, such as open source operating systems and developer infrastructure. The biggest issue is how far the law defines app stores and applications. If code collaboration platforms, package managers, and open source indexing services are interpreted as app stores, downloading source code, libraries, frameworks, and models would be treated the same as using consumer marketplaces.

• California AB 1043 and the 2026 amendment AB 1856 require operating system providers to collect self-declared age during account setup and pass age-band signals to apps via a real-time API.
• Colorado SB 26-051 requires operating systems and app stores to generate and share age-band signals, with the definitions of covered application and covered application store determining the scope. At the April 23, 2026 committee hearing, it became clearer that software downloaded from public repositories is excluded.
• Illinois HB 4140 mirrors the California model, requiring operating system providers to collect age data and transmit age category signals.
• New York S 8102 / A 8893 requires commercially reasonable age verification upon device activation and the transmission of verified age signals to apps and websites.
• In the US, there are also other app store-related bills such as Texas SB 2420, Louisiana HB 570, and Utah SB 142.

Brazil's Digital ECA, effective from March 2026, targets all digital services that children and adolescents may access. Brazil's National Data Protection Authority (ANPD) has set initial regulatory priorities on app stores and proprietary operating systems, and has not yet clarified the application to free and open source software (FOSS). The draft currently under public comment suggests that collaborative models and free software should not bear the same obligations as proprietary services.

Precedents exist in countries like Australia and France, which exclude open source code collaboration sites and online encyclopedias, highlighting the importance of exemption provisions in actual design. Open source is core infrastructure for education, innovation, and security, and is an ecosystem based on collaboration, reuse, and transparency. Developers can provide input to legislators in California, Colorado, Illinois, and New York, as well as to Brazil's public consultations, the Open Source Initiative, FreeBSD Foundation, and Debian. GitHub emphasizes that such participation is the most realistic way to refine definitions and scope to fit reality.