Illinois signs age-verification law with no open source exemption
Illinois Governor JB Pritzker has signed HB5511, the Children's Online Social Media Safety Act, creating a new age verification framework that covers every device sold or used in the state. The law defines a broad category called "covered manufacturers" that lumps together device makers, operating system providers and app stores.
By January 1, 2028, these manufacturers must build an interface at account setup that asks a parent or account holder for the child's birth date. That date is converted into one of four age brackets: under 13, 13 to 15, 16 to 17, or 18 and up. All transmitted digital signals have to be encrypted. Apps then pull that bracket through an API once a user downloads or launches them, and once an app receives a signal marking a user as a minor, it is legally treated as having "actual knowledge" of that fact.
Once a user is flagged as a minor, apps must turn on a set of default safety settings: feeds get restricted, profiles are hidden from adult strangers, messages from adults are blocked, precise location is masked, and notifications go dark between 10 PM and 7 AM. Parents can override these defaults for their children, and minors over 16 can override them for themselves. Apps have until July 1, 2028 to start requesting the age signals, and violations can cost up to $50,000 each, enforced by the state Attorney General. Device manufacturers and apps acting in good faith are not liable if a signal turns out to be wrong.
The bill passed the Illinois House 82-27 and the Senate 57-0 before clearing final concurrence unanimously. Rep. Jennifer Gong-Gershowitz led it through the House, with Reps. Margaret Croke and Janet Yang Rohr as chief co-sponsors and more than a dozen others signed on; Sen. Willie Preston carried it in the Senate alongside Sens. Robert F. Martwick, Mary Edly-Allen and Adriane Johnson.
Illinois is not the first state to try this model. Colorado's SB26-051 and California's AB-1043 rely on the same OS-level age signal setup, where apps request the signal and the device answers. Both started out with no concessions for open source platforms such as Linux. Colorado's SB26-051 originally applied to every operating system and developer without exception, until System76 founder Carl Richell worked directly with state lawmakers to add language exempting operating systems and developers that distribute software under terms letting anyone copy, redistribute and modify it freely, plus a clause blocking platforms from locking down modified versions. California's AB-1043 had the same gap; Assembly Member Buffy Wicks, who wrote AB-1043, introduced AB-1856 to fix it, and after several rounds of edits the amended bill redefines "operating system provider" to exclude anyone distributing software under those same open license terms. Illinois's HB5511 has none of this: its definitions of "covered manufacturer" and "application store" stay just as broad as Colorado's and California's bills were before their amendments.
Key facts
- HB5511 requires operating systems, device makers and app stores in Illinois to collect a child's birth date at account setup and convert it into one of four age brackets (under 13, 13 to 15, 16 to 17, 18 and up) by January 1, 2028.
- Apps must request the encrypted age signal via API starting July 1, 2028, and flagged minor accounts get restricted feeds, hidden profiles, blocked adult messages, masked location and notifications silenced from 10 PM to 7 AM.
- Violations cost up to $50,000 each, enforced by the Illinois Attorney General; manufacturers and apps acting in good faith are not liable for a wrong signal.
- The bill passed 82-27 in the House and 57-0 in the Senate, with Rep. Jennifer Gong-Gershowitz leading it and Sen. Willie Preston carrying it in the Senate.
- Unlike Colorado's SB26-051 and California's AB-1043/AB-1856, which were both amended to exempt open source operating systems and developers, Illinois's HB5511 carries no such exemption.
Why it matters
Illinois is the latest US state to push OS-level age verification, after Colorado and California, and it does so with a broader, unamended definition of "covered manufacturer" that folds device makers, operating system providers and app stores into a single reporting obligation. The law shifts age checking from individual apps to the operating system itself, which then supplies an age bracket over an API whenever an app is downloaded or launched.
Who it affects
Every device maker, operating system provider and app store selling into or operating in Illinois falls under the "covered manufacturer" definition, along with any app that receives the age signal and must then apply the mandated safety defaults. Parents and account holders enter the child's birth date at setup, and minors themselves gain override rights once they turn 16.
How to use it
Compliance has two deadlines: manufacturers must have the birth-date interface built by January 1, 2028, and apps must begin requesting the age signal by July 1, 2028. The signal itself is just one of four brackets, transmitted encrypted, and a good-faith reliance on a wrong signal does not expose a manufacturer or app to liability. The $50,000-per-violation penalty is enforced by the state Attorney General.
How solid is it
The bill's legislative path is documented and lopsided: 82-27 in the House and 57-0 in the Senate, followed by unanimous final concurrence, with named sponsors on both sides of the chamber. The mechanics described, the age brackets, the API pull, the safety defaults and the deadlines, are stated as enacted law rather than a proposal still in committee.
Risks and caveats
HB5511's definitions of "covered manufacturer" and "application store" carry no exemption for open source software, unlike the versions of Colorado's SB26-051 and California's AB-1043 that now exist after later amendments pushed by System76 founder Carl Richell and Assembly Member Buffy Wicks respectively. As written, that leaves open source operating systems and developers, such as Linux distributions, subject to the same reporting obligations as commercial platforms, with no indication in the source that Illinois lawmakers plan to add a comparable carve-out.