Illinois' New Age Verification Law Casts a Wide Net Over Open Source
AI-generated image · Bay Street Wire
While Governor JB Pritzker frames the Children’s Social Media Safety Act as a strike against Big Tech platforms, the fine print targets the very operating systems that provide an alternative to corporate walled gardens.
OPINION: Illinois is once again treating open-source infrastructure as a corporate entity, effectively penalizing the community-driven tools that provide the only real alternative to Big Tech's walled gardens.
On the surface, Illinois Public Act 104-0664—known as the Children’s Social Media Safety Act (HB5511)—appears to be a standard piece of 2026 legislation targeting social media giants. As Linux Stans first reported, Governor JB Pritzker’s press release focuses heavily on platforms like TikTok, Instagram, Facebook, X, Snapchat, and Roblox. The law, signed July 31, mandates that these platforms default minors into chronological, follow-only feeds and restricts notifications between 10 p.m. and 7 a.m. It also prevents adult strangers from messaging minors or viewing their location.
However, Linux Stans notes that the press release largely ignores a critical component of the bill: the creation of a legal category for "operating system providers." This definition is broad enough to encompass anyone who builds an internet-connected OS, regardless of whether they are a commercial entity or a nonprofit.
Under the law, these "covered manufacturers"—which include OS vendors, device makers, and app stores—must implement a specific age-declaration system by January 1, 2028. The requirements include:
* An accessible setup screen where account holders indicate their birth date or age. * An encrypted API that sends an age-bracket signal (under 13, 13-15, 16-17, or 18+) to any requesting app or platform. * Strict limits on data sharing, ensuring only the minimum necessary information is transmitted.
Once an app receives a "minor" signal, the law considers the operator to have actual knowledge that the user is underage, triggering the social media protections.
While the law does not require biometric scans or passports, it creates a significant compliance burden for community-run, noncommercial open-source projects that lack the resources of a corporate compliance department. Linux Stans points out that Illinois notably failed to include an exemption for open-source software, a mistake other states have already worked to correct. For instance, Colorado's SB26-051—signed June 3 by Governor Jared Polis—exempts operating systems and code repositories like GitHub, GitLab, Docker, and Podman, provided they use an open license. This change occurred after System76 founder Carl Richell collaborated with State Senator Matt Ball. Similarly, California is attempting to fix a similar gap in AB-1043 through Assemblymember Buffy Wicks' proposed AB-1856.
Enforcement of the Illinois law falls solely to the Attorney General. There is a discrepancy regarding penalties: the text of the bill caps fines at $7,500 per affected child, while Governor Pritzker’s press release claims penalties of up to $50,000 per violation. The bill passed the General Assembly on June 1 with unanimous support (57-0 in the Senate and 113-0 in the House concurrence), supported by Attorney General Kwame Raoul and groups including Mothers Against Media Addiction and Common Sense Media.