Illinois Just Made Your Operating System Check Your Age
Illinois age verification is no longer a proposal. Governor JB Pritzker signed HB 5511, the Children's Social Media Safety Act, on 31 July 2026, after both chambers passed it unanimously. The law moves the age check off websites and into the device itself: from 2028, the operating system on your phone, tablet or computer has to know how old you are and hand that answer to any app that asks. There is no carve-out for open source, which is why Linux maintainers spent the first week of August reading a bill about Instagram.
What the Illinois Age Verification Law Requires
The mechanism is deliberately simple. At device or account setup, the operating system provider must present an interface asking the account holder for a birth date. The system converts that date into one of four categories: under 13, 13 to 15, 16 to 17, and 18 and up. Apps can then query the operating system through an interface and receive the category, transmitted in encrypted form. The app never sees the birth date, only the bracket.
The rest of the act sits on top of that signal. Platforms covered by the law have to turn on stricter privacy defaults for users under 18, limit recommendation feeds for minors to content they requested, searched for, or follow, and switch off notifications between 10 p.m. and 7 a.m. except for messages from friends and family. Minors' profiles are hidden from adult strangers, with no location sharing and no financial transactions with unknown adults. The governor's office named Instagram, TikTok, Facebook, Snapchat, X and Roblox as the kind of service in scope; news outlets, broadband providers, email services and learning management systems are excluded.
Enforcement falls to the Illinois Attorney General, with civil penalties of up to $50,000 per violation.
An Eighteen-Month Countdown to OS-Level Checks
Device makers and operating system providers have until 1 January 2028 to ship the age-assurance interface. Apps have until 1 July 2028 to start requesting and honouring the signal. The staggered schedule is the tell: the state is not asking apps to build anything clever, it is asking the platform layer to become the identity layer and giving app developers half a year to plug in afterwards.
Official framing presents this as the privacy-preserving option. Because the check happens once, at setup, individual apps no longer need to demand a passport scan or a face scan to establish that a user is an adult. That argument is not empty. Compared with every website collecting government ID separately, one attested bracket leaks less. The objection is not that the design is worse than document uploads, it is that it makes the check universal and permanent instead of occasional.
Why Linux Distributions Are Caught By HB 5511
The law defines an operating system provider broadly enough to cover commercial and nonprofit entities that develop or supply an internet-connected operating system. In practice everyone expects Apple, Google and Microsoft to be the targets. On the text, a volunteer-run distribution shipping an installer with a network stack is not obviously outside the definition.
Two other states saw this coming. Colorado's SB26-051 and California's AB-1043 were both amended to add exemption language for open-source projects before passage. Illinois has none of it. A Debian or Fedora maintainer cannot ask a hobbyist installer to collect a verified birth date, cannot afford a $50,000 penalty per violation, and cannot geofence Illinois out of a torrent of an ISO file.
What EFF Argued Before HB 5511 Was Signed
The Electronic Frontier Foundation asked Pritzker to veto the bill on 29 June 2026. Its objection was that device-level age-gating would "effectively dismantle online anonymity", jeopardise data security, and "severely restrict access to constitutionally protected speech for young people and adults alike". EFF also argued the bill would cut off lifelines for vulnerable youth in non-traditional families, and called it an existential threat to the open-source ecosystem that underpins the modern internet.
One technical criticism deserves particular attention: the law does not specify how an operating system confirms that a self-declared birth date is true. If a teenager types 1985 into the setup screen, nothing described in the act catches it. That leaves two futures, and neither is comfortable. Either the signal stays unverified, in which case the compliance burden is real and the protection is theatre, or a later amendment adds actual verification, and the document scan everyone was promised they would avoid arrives at the operating system layer instead of the website layer. NetChoice, an industry trade group, filed its own veto request; litigation over similar state laws has been routine, and this one is a strong candidate.
Why This Matters Outside Illinois
No manufacturer builds a special version of Android for one American state. If Apple, Google and Microsoft implement an age-assurance interface to satisfy Illinois, that interface exists in the global build, dormant or active depending on jurisdiction. The same pattern already played out with age checks on the web: a handful of laws produced infrastructure that everyone else inherited. Illinois is the first state in the country to put the requirement at the operating-system layer, and the ratchet only turns one way.
This is also where the honest limit of network privacy tools sits. Changing your exit IP does not change what your own device reports about you. An age category asserted by the operating system travels with the session no matter which country the traffic appears to come from, which is a different problem from the website-level checks that the bill's earlier draft was already criticised for and from the patchwork of national rules tracked in our list of countries restricting social media by age. A VPN still does what it always did, hiding traffic from an ISP and moving your apparent location, but it does not sit between an app and the operating system underneath it. Anyone who assumed a subscription would cover this class of law should adjust that assumption now rather than in 2028.
