In the first week of August, Illinois Governor JB Pritzker signed HB5511, the Children’s Social Media Safety Act, now Public Act 104-0664. What makes the law notable is not “protecting minors” — that is consensus politics across US states by now — but where it puts the duty to collect age: at the operating system layer. Device makers, OS vendors, and app stores all fall under “covered manufacturer,” and from 2028 they must collect age during the out-of-box setup flow. Tech media spent early August on the detail that got overlooked: this version has no open-source exemption.
A Law That Pushes the Duty Into the OS
The bill passed in June by overwhelming margins, cleared its final concurrence vote unanimously, and was signed on July 31. The model follows Colorado’s SB26-051 and California’s AB-1043 — Illinois is the third state to adopt this OS-level approach — and the pattern is spreading because it solves a coordination problem: one age signal per device instead of a separate identity check for every app a teenager opens. Rather than making every app verify age on its own, the operating system collects it once and hands out an age signal.
Platform duties follow from the signal. Minors get chronological, follow-only feeds by default; notifications are silenced from 10 PM to 7 AM; adult strangers cannot contact or view minors; profiles are hidden from search and location data is masked. Parents can override the defaults, and so can minors over 16.
How It Works: Four Age Brackets and Encrypted Signals
During setup, a parent or account holder declares the child’s birth date, which the system converts into four brackets: under 13, 13 to 15, 16 to 17, and 18-plus. The collection itself is deliberately light — a self-declared birth date, with no passport checks or face scans required. The bracket travels over an encrypted API, sharing only the minimum needed, with no third-party disclosure beyond what the law requires. Once an app receives a minor bracket, it is deemed to have “actual knowledge,” and the full set of protections triggers automatically. Each app no longer builds its own age gate; it reads one signal from the device and calibrates its defaults accordingly.
The timeline: operating systems must have the interface ready by January 1, 2028, and apps must begin requesting signals by July 1, 2028. The penalties contain an odd discrepancy — the bill text says up to $2,500 per child for negligence and $7,500 for intent, while the governor’s press release cites up to $50,000 per violation. Enforcement belongs solely to the Illinois Attorney General; there is no private right of action. Manufacturers and apps acting in good faith are not liable if a signal turns out to be incorrect.
No Open-Source Exemption: Linux Projects Are Pulled In
Both the Colorado and California versions carved out exemptions for open-source projects. Illinois “has none of this,” as coverage put it, leaving the definitions of “covered manufacturer” and “application store” broad enough to cover commercial and nonprofit projects alike. The realistic enforcement picture is lopsided: hobbyist maintainers without an Illinois business presence are practically out of reach, while vendors with state revenue — Google, Microsoft, Apple — are directly exposed to fines. The chilling effect lands on distributions and community projects without legal departments, even though the obligation applies to everyone.
The Bigger Picture: The Age-Verification Wave and Anonymity
The same week, the outlet Effort published an investigation mapping the lobbying behind this legislative wave: five UK-founded organizations and their American affiliates pushing digital ID and age-verification bills across 21 states and in Congress. The 5Rights Foundation alone engaged on 42 bills in 18 states, 11 of which became law, and its founder Baroness Beeban Kidron has even endorsed VPN bans, arguing that restrictions without them are “for show and headlines, not for children.” One frequently cited template is California’s AB 2273, co-designed by 5Rights and modeled on the UK’s Age Appropriate Design Code.
Supporters call this child safety. Critics read the endpoint as de facto real-name identification — the space for adults to use the internet anonymously is being compressed state by state.
For developers, the practical impact is direct: if your product has multi-state US users, age-signal APIs become a 2027–2028 compliance line item, and fragmented rules across states are the next cost center.
Sources
- Illinois HB5511: Operating system age verification — Linux Stans
- Illinois Age Verification Bill — It’s FOSS
- The UK’s war on anonymity has come to America — Effort
AI-assisted summary compiled from the sources above, reviewed by a human before publishing.