California’s AB 1856 Age-Gating Bill: A Growing Threat to Online Privacy and Anonymity

Featured image: Photo by John Tekeridis on Pexels.

California’s legislative landscape is once again at the forefront of digital rights debates with the introduction of AB 1856. Hailed by some as a “clean-up” bill for last year’s sweeping Digital Age Assurance Act (AB 1043), this new legislation, however, appears to be taking a significant step backward for online privacy and anonymity. While it offers a crucial exemption for open-source operating systems, AB 1856 dramatically expands the reach of age-gating requirements, pushing California closer to a future where nearly every internet interaction demands age verification, posing profound threats to users’ fundamental digital rights.

The Foundation: Understanding AB 1043’s Initial Framework

To fully grasp the implications of AB 1856, it’s essential to revisit its predecessor, AB 1043. Passed last year, AB 1043 mandated that all operating systems and app stores establish age-bracketing systems, segmenting users based on their age. From its inception, this regime raised serious concerns. Critics argued that it was a recipe for censorship, creating unnecessary and potentially unconstitutional barriers to accessing lawful online speech. Furthermore, it threatened the right to anonymity online and pressured services to collect vast amounts of sensitive user data. The compliance burdens imposed by AB 1043 were also seen as disproportionately harmful to the vibrant open-source ecosystem that forms the backbone of much of the modern web [1]. The initial framework, while ostensibly aimed at protecting young people, inadvertently laid the groundwork for a surveillance-heavy internet, impacting users of all ages.

AB 1856: Expansion Disguised as Refinement

Lawmakers introduced AB 1856 with the stated goal of addressing the flaws of AB 1043. However, instead of merely narrowing or refining the existing law, AB 1856 significantly broadens its scope. The new bill extends the age-bracketing requirements beyond operating systems and app stores to include web browsers and website operators. This expansion means that the vast majority of online services and platforms could soon be compelled to request and collect users’ ages, making it nearly impossible for regular internet users to avoid these age gates [1]. This move transforms what was already a contentious requirement into a pervasive system that could fundamentally alter how everyone interacts with the internet, creating a ubiquitous demand for personal data simply to browse or access content.

A Partial Victory: The Open-Source Exemption

Amidst the concerns, AB 1856 did introduce one notable amendment that has been welcomed by digital rights advocates and the open-source community. Prior to its passage in the Assembly, the bill was amended to relieve the compliance burden on open-source operating systems. The new exception clarifies that an “operating system provider” does not include entities distributing software under licenses that permit copying, redistribution, and modification. This change is understood to exempt open-source operating systems from the requirement to collect and transmit users’ age-bracket data [1]. This is a meaningful improvement and a testament to the advocacy efforts that highlighted the existential threat AB 1043’s age-gating mandate posed to open-source developers. While some ambiguities remain regarding how the law might apply when open-source systems are integrated into commercial products, this exemption substantially reduces a significant threat to a critical part of the digital infrastructure.

The Broader Threat to Privacy and Anonymity

Despite the positive step for open-source, the fundamental problem with AB 1856 and the expanded age-gating regime persists: it creates a profound privacy and security nightmare for all internet users [1], [2]. While AB 1043 and AB 1856 do not explicitly mandate age verification, the liability structure they impose strongly pressures companies to verify users’ ages. In practice, this will likely lead to an increase in invasive data collection methods, including more ID checks, biometric scanning, and the gathering of sensitive personal information [1], [2].

When users are forced to reveal such sensitive data to third parties merely to access the web, that information becomes a centralized “honeypot” for bad actors. This valuable data, once collected, becomes an immediate and attractive target for leaks, hacks, and misuse [2]. History has shown that such data breaches are not hypothetical; they have occurred numerous times, compromising the personal information of millions. The expansion of age-gating requirements by AB 1856 dramatically increases the surface area for these risks, making the internet less secure for everyone. The promise of online anonymity, a cornerstone of free expression and privacy, is severely undermined when nearly every online interaction requires a verified identity.

Impact on Free Speech and Digital Rights

Beyond privacy, age-gating regimes pose significant harms to users’ speech and fundamental digital rights. By creating barriers to access based on age, these systems risk stifling lawful online speech for both adults and young people [1]. The internet thrives on open access to information and diverse perspectives. Introducing mandatory age gates can lead to over-blocking, where content that is perfectly appropriate for certain age groups, or even for all ages, becomes inaccessible due to overly cautious implementation by platforms seeking to avoid liability. This chilling effect on speech can limit access to educational resources, news, artistic expression, and community forums, thereby diminishing the richness and utility of the internet for everyone.

Furthermore, the underlying principle of these mandates often justifies government-led censorship and expanded surveillance capabilities [2]. Regardless of current intentions, handing over keys to new forms of censorship and surveillance creates a dangerous precedent. History teaches that such powers are frequently abused, making it imperative to resist policies that enable broad control over online access and content. The goal of protecting young people online, while laudable, should not come at the cost of everyone’s digital rights and the open, accessible nature of the web.

The Path Forward: Continued Opposition

Despite the welcome amendment for open-source operating systems, the Electronic Frontier Foundation (EFF) and other digital rights organizations continue to oppose AB 1856. The bill’s expansion of the problematic age-bracketing regime far outweighs the benefits of the open-source exemption [1]. The fight is far from over, as AB 1856 has passed the Assembly and now moves through the Senate. Advocates will continue to push for amendments that genuinely “clean up” and narrow the scope of AB 1043, rather than expanding its reach, and to offer stronger protections for users against the inherent harms of age-gating systems. The goal remains to protect the web as an open, private, and accessible space for all users, without sacrificing fundamental rights in the pursuit of online safety.

Key Takeaways

• AB 1856, intended as a “clean-up” for AB 1043, significantly expands age-gating requirements to web browsers and websites.
• While the bill includes a crucial exemption for open-source operating systems, it broadens the overall scope of mandated age-bracketing.
• Age-gating pressures services into collecting sensitive personal data, leading to increased privacy and security risks, including potential data breaches.
• Centralized age data creates “honeypots” for malicious actors, threatening the privacy and anonymity of all internet users.
• The expanded regime poses a threat to free speech by creating unnecessary barriers to lawful online content and can enable future censorship.
• Advocates continue to oppose AB 1856 due to its fundamental harms to privacy, anonymity, and digital rights, pushing for narrower legislation.

Sources

1. [1] One Step Forward, Two Steps Back: CA's AB 1856 Exempts Open Source But Expands Age-Gating (www.eff.org)
2. [2] Age Verification is a Privacy Nightmare (www.eff.org)

StealthAnon is a news and analysis site covering cybersecurity, privacy, web analytics, anonymity, and tech tools.