California Digital Age Assurance Act

The Digital Age Assurance Act (DAAA) is a California statute codified at Civil Code sections 1798.500 through 1798.504 and operative from 1 January 2027. It places age assurance at the operating-system layer rather than at the individual service: an operating system provider collects the user's age at account setup and supplies an age-bracket signal to application stores and developers, who must request it and are then deemed to have actual knowledge of the user's age range (Source: leginfo.legislature.ca.gov).

The design contrasts with per-service age verification of the kind at issue in COPPA enforcement and in the companion-chatbot rules of SB 243, in that the verification burden and the personal data sit with the device platform while downstream services receive only a bracket.

Mechanism

Age bracket data is defined as non-personally-identifiable data derived from a user's birth date or age, indicating at minimum whether the user is under 13; at least 13 and under 16; at least 16 and under 18; or at least 18.

An operating system provider that operates on a device and has an account setup feature must provide an accessible interface at setup requiring an account holder — an individual at least 18, or the parent or legal guardian of a user under 18 — to indicate the birth date or age of the device's primary user, and must supply the resulting signal, through "a reasonably consistent real-time application programming interface," to a covered application store or a developer that requests it. Only "the minimum amount of information necessary to comply" may be sent, and the signal may not be shared with third parties for purposes the title does not require.

A covered application store must request the signal from the user's operating system provider and pass it to a developer on request. A developer must request the signal when its application is downloaded onto and launched from a device, and may not prompt the user to change their age information.

Actual knowledge. A developer that receives a signal is deemed to have actual knowledge of the user's age range "even if the developer willfully disregards the signal," and that knowledge extends across any platform of the application through which the user may create an account, and any point of access including a developer-controlled website used to create or log into an account. The signal is the primary indicator of age unless the developer holds "internal clear and convincing information" that the age differs, in which case that information governs and carries the same actual-knowledge consequence.

Penalties. Violations carry an injunction and a civil penalty of up to $2,500 per affected child for each negligent violation and up to $7,500 per affected child for each intentional violation, recoverable only in a civil action brought by the Attorney General in the name of the people of California.

Safe harbours. An operating system or covered application store making a good-faith compliance effort, accounting for available technology and reasonable technical limitations or outages, is not liable for an erroneous signal or for a developer's conduct on receiving one.

Non-discrimination. An operating system provider or covered application store must apply at least the same restrictions and obligations to its own applications and distribution as to third parties, and may not use data collected from a third party in the course of compliance to compete against that third party, to prefer its own services, or otherwise anticompetitively. The title also states that it does not modify, impair or supersede any antitrust law.

Exclusions. The title does not apply to broadband internet access service, to telecommunications service as defined in 47 U.S.C. § 153, or to the delivery or use of a physical product, and imposes no liability arising from use of a shared device by someone other than the user the signal pertains to. Its protections are stated to be additional to other law including the California Age-Appropriate Design Code Act.

The open-source carve-out

The definition of "operating system provider" excludes "a person or entity that distributes an operating system or application under license terms that permit a recipient to copy, redistribute, and modify the software" (Civil Code § 1798.500(g)(2)) (Source: leginfo.legislature.ca.gov).

The exclusion is drawn by license characteristics — permission to copy, redistribute and modify — rather than by naming particular licences. Reporting on the bill's passage described it as exempting software "distributed under the GPL, MIT, BSD and Apache licenses" (Source: tomshardware.com); the statutory text names none of them, and the functional test would reach or exclude a licence on its terms rather than on its name. The carve-out also operates by removing an entity from the definition of operating system provider, so it lifts the setup-interface and signal obligations rather than exempting such software from the title altogether.

Whether the exclusion originated in AB 1856 is not established from the version read here: the Legislative Counsel's Digest for the bill lists its changes as deleting the definition of "user," adjusting the condition under which the accessible-interface requirement applies, requiring the signal to be provided to a covered application store or application developer, and prohibiting a person from requesting a signal where not required by the DAAA or other law — and does not name the open-source exclusion among them.

AB 1856 (2026)

Assembly Bill 1856, introduced by Assembly Member Buffy Wicks on 11 February 2026 and titled "Age verification signals: software applications," amends all five sections of the title. Per the Legislative Counsel's Digest it deletes the existing definition of "user" as a child who is the primary user of a device; specifies that the accessible-interface requirement applies where an operating system "operates on a device and has an account setup feature"; requires the signal to be provided to a covered application store or application developer; and prohibits any person from requesting a signal from an operating system provider or covered application store where not required to do so by the DAAA or other applicable law. It also adds a good-faith safe harbour for developers mirroring the one operating systems and application stores already held, and clarifies that a compliant developer need not request a signal at every login after account creation while remaining free to request one periodically (Source: leginfo.legislature.ca.gov).

Section 1798.502 carries the transition: for devices whose account setup completed before 1 January 2027, the operating system provider must supply the accessible interface before 1 July 2027, and for applications last updated on or after 1 January 2026 and downloaded before 1 January 2027, the developer must request a signal before the same date.

Legislative history

Both floor votes were unanimous among members voting (Source: leginfo.legislature.ca.gov). As of 31 August 2026 the bill is recorded as an active bill, passed, awaiting engrossing and enrolling.

Relationships

• related: California SB 243 — Companion Chatbots — California's companion-chatbot statute, which places age-related duties on the service rather than the platform.
• related: Children's Online Privacy Protection Act (COPPA) — the federal actual-knowledge standard the DAAA's signal mechanism interacts with.
• related: AI and Children — the policy area.
• related: Open-Source AI / Open-Weight Models — the licence-based exclusion.
• related: State-Level AI Regulation — California as a state-level regulator of platform conduct.