California’s Expanded Age-Gating Law: A Threat to Online Privacy and Anonymity
Featured image: Photo by Miguel Á. Padriñán on Pexels.
California’s legislative landscape is once again shifting the ground beneath online privacy and anonymity. A new bill, Assembly Bill 1856 (AB 1856), initially presented as a “cleanup” measure for last year’s Digital Age Assurance Act (AB 1043), has taken a concerning turn. While it offers a welcome exemption for open-source operating systems, it simultaneously expands the reach of age-gating requirements, pushing them further into the fabric of the internet by targeting web browsers and websites. This expansion poses significant threats to users’ fundamental rights to free speech, privacy, and the ability to remain anonymous online, creating a system that could make it nearly impossible to navigate the internet without constant age verification and data collection [1].
The Foundation: California’s AB 1043
To understand the implications of AB 1856, it’s crucial to revisit its predecessor, AB 1043. Passed last year, AB 1043 mandated that all operating systems and app stores implement age-bracketing systems. These systems are designed to segment users based on their age, ostensibly to protect young people online. However, critics immediately flagged the law as a recipe for censorship, arguing that it creates unnecessary and unconstitutional barriers to accessing lawful online speech. Beyond speech concerns, the original law threatened users’ right to anonymity and pressured online services to collect vast amounts of sensitive user data. Furthermore, AB 1043’s broad compliance burdens were particularly detrimental to the open-source ecosystem, which forms the backbone of much of the modern web, imposing disproportionate harms on developers and projects [1].
AB 1856: A “Cleanup” That Expands the Problem
Lawmakers introduced AB 1856 this year, ostensibly to address the flaws and disproportionate impacts of AB 1043. The expectation was a bill that would narrow the scope and alleviate the burdens of the original legislation. However, instead of focusing solely on fixing AB 1043’s specific harms, such as its impact on open-source operating systems, AB 1856 has expanded the age-bracketing regime even further. The new amendments propose extending these age-gating requirements beyond just operating systems and app stores to now include web browsers and website operators. This dramatically broadens the scope of the original law, drawing a much wider array of services, developers, and internet users into a potentially privacy-destroying data collection framework [1].
A Partial Victory: The Open-Source Exemption
One notable positive development within AB 1856, and a direct result of public and advocacy group pressure, is the amendment to relieve the compliance burden on open-source operating systems. The new exception clarifies that an “operating system provider” does not include entities distributing operating systems or applications under license terms that permit copying, redistribution, and modification of the software. This is understood to exempt open-source operating systems from the requirement to collect and transmit users’ age-bracket data. This amendment represents a significant improvement and a welcome relief for open-source developers, who had voiced serious concerns about the existential threat AB 1043’s age-gating mandate posed to their projects and communities [1].
While this exemption is a definite win for open-source developers and demonstrates that lawmakers can respond to community concerns, some ambiguities still persist. For instance, it remains unclear how the law would apply when an open-source operating system is incorporated into a commercial product or service. Despite these lingering questions, the amendment substantially reduces the immediate threat that AB 1043 could have had on many open-source projects. However, it’s crucial not to mistake this partial victory for a complete resolution of the law’s broader issues [1].
The Persistent Threat to Privacy, Anonymity, and Security
Despite the positive step for open-source, AB 1856 ultimately fails to address the core problems inherent in AB 1043’s age-bracketing regime: the fundamental threats it poses to users’ speech, privacy, anonymity, and security. Even without explicitly requiring companies to perform age verification, the liability structure imposed by these laws strongly pressures companies to verify users’ ages. In practical terms, this often translates to an increase in demands for ID checks, potentially biometric scanning, and other invasive forms of data collection. Such methods not only create more barriers to accessing lawful online content for both adults and young people but also centralize vast amounts of sensitive personal information [1].
This centralization of data is a major concern. Every online age verification scheme, regardless of its intentions, forces users to reveal sensitive personal information to third parties simply to access the web. Once this valuable data is collected and centralized, it becomes an immediate and attractive target for leaks, hacks, and misuse. This is not a hypothetical risk; such breaches have occurred multiple times in the past. By age-gating the web and compelling extensive data collection, a “honeypot” of private information is created, ripe for exploitation by malicious actors [2].
Broader Implications: Censorship and Surveillance
The push for widespread online age verification, while often framed as a measure for protecting young people, carries broader and more insidious implications for everyone’s digital rights. These new restrictive mandates can be, and often are, used to justify government-led censorship and expanded surveillance. Handing any entity, particularly governments, the keys to new forms of censorship and surveillance constitutes a serious risk. History demonstrates a consistent pattern: such powers, once granted, are almost invariably abused. Rather than trading everyone’s digital rights for perceived safety, there is a need to demand better solutions that do not compromise fundamental freedoms [2].
The expansion of California’s age-gating framework to browsers and websites makes it nearly impossible for regular internet users to avoid these age gates. This comprehensive reach means that a significant portion of online activity could soon be subjected to age verification, transforming the internet experience into one characterized by constant data demands and diminished anonymity. The unchecked proliferation of such regimes threatens to fundamentally alter the open and accessible nature of the internet, turning it into a more controlled and surveilled environment where privacy is a luxury, not a right [1, 2].
Sources
- [1] One Step Forward, Two Steps Back: CA's AB 1856 Exempts Open Source But Expands Age-Gating (www.eff.org)
- [2] Age Verification is a Privacy Nightmare (www.eff.org)
StealthAnon is a news and analysis site covering cybersecurity, privacy, web analytics, anonymity, and tech tools.
