A mandate needs a mandatee

California's Digital Age Assurance Act takes effect January 1. For most of the past year it technically required Debian to card you. Last week the Senate passed AB 1856 39–0, the Assembly concurred the next day, and open-source operating systems are now exempt from the age-verification regime that still binds Windows, macOS, iOS, and Android.

Read the test the legislature chose. Not "noncommercial." Not "community-developed." The exemption turns on license terms:

That is the whole architecture of the law admitting what it actually regulates. The act's mechanism is an age signal collected at account setup and passed down a chain: OS provider to app store to developer. Every link assumes a party who controls the product and can be ordered to change it. Microsoft controls Windows account setup, so Microsoft can be compelled. Nobody controls Debian in that sense — the license guarantees that anyone who receives it can copy it, change it, and hand it on. Faced with software that has no gatekeeper, the state didn't invent one. It conceded the category. The law was never about software. It was about chokepoints.

The drafting history says the concession was overdue. The original act defined "user" as "a child that is the primary user of a device" — which classified every device owner in California as a child and made it impossible for the signaling framework to ever flag an adult. A statute that gets its own noun wrong is not a statute that was going to reason carefully about whether apt is an app store. Assemblymember Buffy Wicks wrote the original law, then wrote the exemption herself after the EFF and Linux developers spent the fall explaining the problem.

Faced with software that has no gatekeeper, the state didn't invent one. It conceded the category.

The obvious objection: this is a loophole. If the concern is minors reaching unfiltered platforms, exempting the OS anyone can install without an account leaves the back door open, and the carve-out guts the law. Grant the mechanics — a teenager with a Ventoy stick is outside the regime entirely. But the concession costs the law almost nothing, and the 39–0 vote shows the legislature knew it. The population that installs Arch is not the population the act is trying to protect; the users the law cares about live behind exactly four corporate account screens, and those remain fully in scope. The exemption was cheap for the same reason the law exists at all: gatekeepers are where the people are.

What's left unresolved proves the frame. SteamOS sits in limbo — Arch-based and open underneath, but Valve ships it fused to a proprietary client. GrapheneOS, which said in March it would refuse to comply with age-verification mandates, is MIT- and Apache-licensed and now simply outside the law. Its defiance was never tested, because the statute couldn't locate a party to defy it. The hard cases all reduce to one question — is there someone here to order around? — and the license answers it.

The GPL's core terms were written in 1989 to keep software free from proprietary capture. Nobody drafting them was thinking about age-assurance statutes. But a mandate needs a mandatee, and a license that dissolves the controlling party turns out to dissolve the state's point of leverage with it. Copyleft was built as a defense against companies. This year it worked, verbatim, as a defense against a government.