The editorial frames the unanimous vote as evidence that targeted lobbying from the Linux Foundation, EFF, and adjacent groups landed cleanly. It emphasizes that lawmakers finally understood — at least on this narrow point — that hobbyist maintainers cannot realistically implement identity verification for anonymous git clone traffic.
By submitting the Tom's Hardware story with the framing of a 'Linux exemption' passing unanimously, the submitter highlights the significance of legislators explicitly carving out GPL, MIT, BSD, and Apache-licensed software. The 132-point score signals community endorsement of this as a meaningful precedent.
The editorial stresses that the exemption attaches to four named licenses, not to open-source as a concept — 'it exempts the license, not the vibe.' Dual-licensed projects with commercial tiers, and the app stores themselves, remain fully on the hook, meaning maintainers still need to think carefully about distribution channels.
The editorial argues the underlying age-verification law — aimed at Apple, Google, and major storefronts — caught open-source projects only because 'covered software' was defined broadly enough to include anything downloadable in California. This echoes a two-decade pattern where GDPR, DMA, CRA, and similar regimes force the FOSS community to re-explain that a solo maintainer with a LICENSE file isn't a Fortune 500 SaaS.
On a unanimous vote, California lawmakers passed an amendment exempting software distributed under the GPL, MIT, BSD, and Apache licenses from the state's forthcoming app-store age-verification regime. The underlying law — part of California's broader push to force platforms to check the ages of users before serving them certain content — was written with Apple, Google, and the big storefronts in mind. It swept up open-source projects almost by accident, because the statutory language defined "covered software" broadly enough to catch anything a Californian could download and run.
The exemption is narrow but precise: if your project ships under one of four named permissive or copyleft licenses, the age-verification obligations do not attach to you as a distributor. It does not exempt the app stores themselves, and it does not exempt commercial forks that relicense. It exempts the license, not the vibe. A dual-licensed project with a proprietary commercial tier still has to think carefully about which distribution channel is covered.
The vote was unanimous in both chambers, which is worth pausing on. California's legislature does not usually agree unanimously on anything involving tech regulation, and the age-verification bill itself was contentious. That the carve-out sailed through without a dissenting vote suggests lobbying from the Linux Foundation, EFF, and adjacent groups landed cleanly — and that legislators understood, at least on this specific point, that hobbyist maintainers cannot realistically implement identity verification for anonymous `git clone` traffic.
For two decades, the working assumption in open-source policy fights has been that lawmakers don't distinguish between a Fortune 500 SaaS and a solo maintainer with 12 stars on GitHub. Every time a compliance regime — GDPR, DMA, CRA, SB-something — lands, the FOSS community spends the next year explaining to regulators that yes, a `README.md` and a `LICENSE` file really is the entire company. Sometimes it works (see: the last-minute Cyber Resilience Act amendments in the EU). Often it doesn't.
This time, California actually named the licenses. That's the shift worth noting — not the exemption itself, but the mechanism. Naming GPL, MIT, BSD, and Apache in statute means the legislature is treating the OSI-style license as a legal primitive, not a technicality. That's a template other states and countries can copy, and one that's much harder to accidentally strip out in a future "clean-up" amendment than a vague "non-commercial" carve-out would be.
It also implicitly resolves a question the CRA fight never fully answered: does "open source" mean "the code is visible" or "the license permits redistribution"? California picked the second. Source-available licenses — BSL, SSPL, the various "fair source" experiments — are not on the list. Neither is anything Meta ships under the Llama Community License, which some people call open and some people don't. If you're a maintainer who moved to BSL to protect against hyperscaler exploitation, congratulations: you're now also outside this exemption. That trade-off is going to come up in a lot of licensing debates over the next year.
The practical scope is narrower than the headline suggests. Age verification in California will still apply to the app stores that distribute your software, so if your Android build ships through Google Play, Play still has to do its part — the exemption just means you don't have to bolt an ID-check SDK into your own binary. For anything distributed directly (`.deb`, `.dmg`, `brew install`, `pip install`, a tarball on a personal server), the exemption is the whole story: no obligation, no exposure.
Community reaction on Hacker News was, predictably, split between relief and suspicion. The relief camp read it as a clean win. The suspicion camp pointed out that a law which requires the legislature to name your license to exempt you is a law that assumes the default is regulation. A decade ago, the default was that hobby software was invisible to the state. That's no longer true, and no amount of carve-outs changes the underlying trajectory.
If you maintain or contribute to a project under one of the four named licenses, and your users include Californians, your compliance surface just shrank. Concretely: you do not need to think about integrating age verification into your installer, your first-run flow, or your web downloads. You do not need a lawyer's opinion letter before pushing v2.0. The exemption is self-executing on the license text.
If your project is under a source-available or "business source" license, you are now in a materially different regulatory posture than a nearby MIT project doing the same thing. That is the first time in memory a US state has drawn a bright line where the OSI does. If you're on the fence about relicensing away from MIT/Apache for commercial-defense reasons, this exemption is a real, quantifiable cost of doing so — small today, potentially larger as more states copy the template.
For companies that ship both an OSS core and a commercial product, the exemption cleanly separates the two. The core stays exempt. The commercial distribution — Cloud, Enterprise, whatever you call it — does not, and needs the same compliance work any other SaaS would. This is arguably the cleanest legal framing yet for the open-core model, and it happens to mirror how most of these companies already draw internal boundaries. Sentry, GitLab, and Grafana-style stacks will find this easier to reason about than the previous "we're kind of open source" ambiguity.
One concrete audit worth doing this quarter: check every `LICENSE` file in projects you maintain and confirm it's actually one of the four. "Apache 2.0 with a Commons Clause" is not Apache 2.0 for this purpose. "MIT but you can't use it for evil" (the JSON License trap) is not MIT. The exemption is textual; if a court has to squint at your license to figure out what it is, you don't want to be the test case.
The interesting question isn't whether California's exemption survives — unanimous votes rarely get repealed — it's whether it becomes the template. Texas, Utah, and a handful of EU member states are all drafting age-verification and platform-liability regimes right now. If they copy California's approach, the four-license list becomes a de facto safe harbor and the pressure on source-available projects intensifies. If they don't, we're back to fighting the same battle in every jurisdiction, one CRA-style amendment at a time. Either way, the era of assuming open source is invisible to regulators is over, and the maintainers who understand their `LICENSE` file the best are going to have the easiest next decade.
We got into this mess because people wanted Facebook to have age verification, and MZ decided to push the responsibility on to OSes.The result looks to me like Facebook will ban access from non-approved OSes like Linux. Android will still be allowed, GrapheneOS probably not.
So is anyone going to revert the commits that jumped the gun on this?E.g. systemd's birthdate field https://github.com/systemd/systemd/pull/40954
Hope you all are excited for the most important parts of the internet to be completely unusable by default on Linux in a few years.
This is a silly idea since California's law was actually well-thought-out. This will actually force social media to ban Linux clients, since the social media can't be compliant in that case. The operating system won't provide an age signal and the social media isn't allowed to as
Top 10 dev stories every morning at 8am UTC. AI-curated. Retro terminal HTML email.
Excellent. From now on all kids will become linux natives. The decade of the linux desktop is coming!