A new Illinois law treats a Linux distribution and a closed-source mobile OS as legally equivalent actors in the age-signal chain. That is the headline. The details are duller and more interesting.
The Children’s Online Social Media Safety Act, signed by Governor JB Pritzker as HB5511, is the third U.S. state law to push age verification down into the operating system layer. Colorado and California got there first, and both have since been amended to handle an awkward case the original drafts missed. Illinois did not amend. As of signing, Illinois is the only state of the three that still treats an open source distribution the same way it treats a vendor that ships a closed mobile platform with a captive app store.
This piece is a closer read of how the gap happened and what it actually means in practice. The honest answer is that the gap probably matters less than the open source community fears, and more than the bill’s drafters appear to have considered.
What the law actually requires
The structure of the Illinois framework is the same shape as the Colorado and California frameworks. The bill draws a circle around three kinds of companies and tells them to build a piece of plumbing. Anyone in the circle has to ask for a birth date when an account is set up, convert that birth date into one of four age ranges, and expose the result through an API that any application can call.
The plumbing is supposed to be invisible to the parent and to the child. Apps that ask for the signal get a simple bracketed answer: under 13, between 13 and 15, between 16 and 17, or 18 and up. Once the app knows the user is a minor, the bill kicks in a list of defaults: feeds restricted, profiles hidden from adult strangers, messages from adults blocked, location masked, notifications dark between 10 PM and 7 AM. Parents can override the defaults for their kids. Older teens can override them for themselves.
Deadlines and penalties are spelled out below the framework. The implementation deadline for OS vendors is the start of 2028. Apps have until the middle of 2028 to start requesting the signal. The penalty for non-compliance is set at $50,000 per violation, and the enforcement sits with the Illinois Attorney General. The law also includes a good-faith safe harbor: a company that builds the plumbing correctly is not on the hook if a downstream signal turns out to be wrong.
Why the open source case is the wrinkle
The wrinkle is not in the law’s intent. The wrinkle is in what the law requires of a project that distributes software under an open license.
A closed-source mobile platform can, in principle, build the plumbing once and refuse to ship a version without it. The platform’s licensing terms let the platform enforce that choice on every downstream user. The user can choose to use the platform or not use it, but the user cannot legally fork the platform and ship a modified version that omits the age signal.
An open source OS cannot, by its own licensing terms, make that choice. The whole point of the open source license is that anyone who receives the software is free to copy it, redistribute it, and modify it. So an open source project that complies with the Illinois law by shipping the age signal is, at the same time, distributing a version that other people can modify to remove the age signal. The project cannot prevent this. Its own license forbids it from trying.
This is not a novel legal argument. The same structural pattern has been litigated and discussed in the context of copyleft enforcement, GPL compliance, and the rights of downstream users to fork. The general legal posture is well established: if you ship under a license that permits modification, you cannot selectively forbid the modifications you find inconvenient.
How Colorado and California fixed the gap
Both Colorado and California started with the same gap. Both bills applied the framework to every operating system and developer without exception. In both cases, the open source community engaged the state-level lawmakers directly during the amendment phase and got language added.
Colorado’s fix was a structural exemption. SB26-051, as amended, explicitly carves out operating systems and developers whose licensing terms let anyone copy, redistribute, and modify the software freely. The exemption is in the law’s definition of who is covered, not in a separate “exceptions” section. The bill also blocks platforms from locking down modified versions of the software, which closes the workaround where a vendor would otherwise try to restrict the user’s right to fork.
California’s fix took a different shape. Assembly Member Buffy Wicks, the author of AB-1043, introduced a separate cleanup bill, AB-1856, that redefined “operating system provider” to exclude anyone distributing software under open-license terms. The exclusion is in the definition itself. The substantive requirements of the law are unchanged for closed-source platforms.
The two approaches are not identical, but they produce the same result for the open source case: the project is not covered by the framework, and the framework’s intent is preserved for the platforms the legislature was actually targeting.
Why Illinois did not get the same fix
The Illinois bill went through a different legislative process than the Colorado and California bills. The open source community engaged both states during the amendment phase. In Illinois, the engagement either did not happen, or happened too late to be reflected in the signed bill.
The most likely explanation is also the most boring: the open source community is small, the bills are large, and the legislative sessions do not align. Colorado and California had sessions where the open source community had time and access to engage. Illinois did not, or did not at the scale that would have produced an amendment. The result is that Illinois now has the law that Colorado and California had before they were fixed.
A secondary explanation is that the Illinois legislative drafters may not have understood the open source case at all. The bill’s language tracks the original Colorado and California bills, which were drafted without open source input. If the Illinois drafting team worked primarily from those earlier bills, they would have inherited the original gap without necessarily understanding what the gap was.
What the practical exposure looks like
The exposure depends on the structure of the open source project. Four cases worth thinking through:
- A distribution run by a non-U.S. foundation with no Illinois operations has, in practice, very little exposure. The Illinois Attorney General enforces against entities that do business in the state. A small foundation with no U.S. presence is not a reachable target.
- A distribution run by a U.S.-based nonprofit with volunteer maintainers has more exposure, but the bill’s enforcement provisions assume an entity with assets. A volunteer-run nonprofit does not have $50,000 per violation lying around to pay a penalty, and the bill does not have a mechanism to compel compliance from an organization that does not have the resources to comply.
- A commercially-backed distribution with a U.S. parent company has a different posture. The parent can pay the legal bill. The question is whether the parent wants to take the political risk of fighting the law publicly, or would rather absorb the cost of compliance. Both choices have costs. Neither is obviously cheaper.
- A community distribution where the maintainers are spread across multiple countries and there is no incorporated entity is in the most ambiguous position. The bill assumes an entity. A loose community of maintainers has no clear legal target. Whether the Illinois Attorney General would treat the maintainers individually as covered manufacturers is an open question that has not been litigated.
Trade-offs
The strongest argument for HB5511’s broad coverage is that any exemption creates a workaround. If a Linux distribution is exempt, a determined bad actor can install Linux on a child’s device to bypass the age signal. The bill’s drafters presumably wanted to plug that hole, and the most direct way to plug it is to cover every operating system without exception.
That argument has real force. A bill that exempts open source platforms creates a parallel distribution channel that the bill cannot reach. The bill’s intent, presumably, is that the parents of Illinois children should have a uniform experience regardless of which platform the family uses. An exemption undermines that uniformity.
A weaker but real counter-argument is that the open source community has other ways to respond. If a distribution does not want to comply with the Illinois framework, the distribution can choose not to operate in Illinois. The distribution can document the choice and let Illinois users decide whether to use the distribution. The distribution can engage the Attorney General’s office for guidance on enforcement discretion. None of these are good outcomes, but they are options.
Three open questions worth flagging:
- Will the Illinois Attorney General’s office treat open source projects as covered manufacturers in practice, or will it treat them as out of scope by convention?
- Will downstream Illinois-based applications refuse to call the age-signal API on platforms where the signal is not available, or will they assume the user is an adult by default?
- Will a federal preemption case emerge from the patchwork of state laws, or will each state continue to legislate independently?
The honest reading is that the bill’s drafters probably did not consider the open source case at all. The legislative history will tell us more, but the language of the bill suggests the drafters worked primarily from the earlier Colorado and California bills, and did not have the open source input that both of those bills eventually received.
The open source community now has a choice. It can engage Illinois in a post-signing amendment process, the way Colorado and California did. It can engage the Attorney General’s office for guidance on enforcement discretion. It can build tooling that helps distributions comply voluntarily, even when the legal exposure is unclear. Or it can accept that Illinois is, for now, the state where the open source gap is the law rather than the fix.
Ranking the four options: the first option is the most direct. The second option is the cheapest. The third option is the most respectful of the bill’s intent. The fourth option is what will happen if no one in the open source community has the bandwidth to do the first three.