Illinois Just Passed a Law That Puts Linux on the Hook for Age Verification

HB5511 is officially about TikTok and Instagram. Read past the press release and it’s also about your operating system.

Governor JB Pritzker’s press release on HB5511 is thick with quotes from legislators and advocacy groups, and it names Instagram, TikTok, Snapchat, X, Facebook, and Roblox specifically. Device setup gets one mention, framed as something a parent configures during setup. Nowhere does it explain that the law also creates a separate legal category called an operating system provider, with its own 2028 deadline and its own civil penalties, that has nothing to do with what any parent chooses to click.

TL;DR

HB5511, the Children’s Social Media Safety Act, is now IllinoisPublic Act 104-0664. Pritzker signed it July 31.
The headline provisions target social platforms: no algorithmic feeds for minors by default, no notifications between 10pm and 7am, no contact from adult strangers.
A separate part of the bill defines operating system providerandcovered manufacturerbroadly enough to include anyone who builds an internet-connected OS, commercial or nonprofit.
By January 1, 2028, those providers have to build an age-declaration step and hand an age-bracket signal to any app that requests one.
Unlike Colorado, and unlike where California is heading, Illinois added no exemption for open source software.
Enforcement runs through the Illinois Attorney General only. The bill’s own text caps penalties at $7,500 per affected child. The governor’s press release advertises penalties of up to $50,000 per violation. Those numbers don’t obviously square with each other.

The Version Illinois Wants You to Read

Set the operating system question aside for a second, because the social media half of this bill is fairly standard for 2026. Platforms built around algorithmic feeds, plus platforms where kids can be contacted by strangers (Roblox is the named example), now have to default minors into chronological, follow-only feeds instead of an engagement-optimized one. Notifications get cut off overnight. Adult strangers can’t see a minor’s profile, message them, or see their location. News sites, email providers, broadband companies, and school software are all carved out by name.

It passed the General Assembly on June 1 without a single no vote, 57-0 in the Senate and 113-0 in the House concurrence. Pritzker signed it July 31, flanked by quotes from Attorney General Kwame Raoul and groups like Common Sense Media and Mothers Against Media Addiction. Nothing about that rollout mentions your desktop.

The Part the Press Release Skipped

Here’s what actually set off the Reddit thread: a post claiming Illinois now requires operating system providers, open source projects included, to build age verification by 2028. It wasn’t universally believed. On at least one mirror of the discussion, a commenter argued the framing was misleading and that the post should be corrected. So instead of trusting a screenshot either way, we went and read the bill on the Illinois General Assembly’s own tracker.

It holds up. Separate from the social media rules, HB5511 creates duties for an operating system provider and folds device makers, OS vendors, and app stores together under the term covered manufacturer. Legislative trackers that follow this exact category of bill across states file this piece under its own name: Digital Age Assurance, the same bucket Colorado’s and California’s versions land in.

What Every Covered Manufacturer Has to Build by 2028

An accessible setup screen that asks an account holder to indicate a birth date, an age, or both.
A way for any app or platform that asks (the bill calls them “operators” and “covered developers”) to receive a signal for that age, delivered through a consistent, encrypted API.
A hard limit on what gets shared: only the minimum information needed to answer the question, and no handing it to a third party beyond what the law requires.

The signal itself isn’t a birthday, it’s a bracket: under 13, 13 to 15, 16 to 17, or 18 and up. Operating systems have until January 1, 2028 to have this built. Platforms then have until July 1, 2028 to start actually requesting that signal for their users. Once an app gets a “minor” bracket back, the law treats it as having actual knowledge the user is underage, which is what flips on every default protection in the social media half of the bill.

Nothing in the bill requires a passport scan or a face scan at setup. It’s self-declared, the same way most apps ask your birthday today, just centralized once at the OS level instead of repeated app by app. That’s exactly why a good chunk of the r/linux replies were jokes about setting their install’s date of birth to sometime in the Nixon administration.

Nobody Carved Out an Exception This Time

This structure, OS hands out an age bracket, apps pull it through an API, already showed up in Colorado and California, and both ran into the same objection: the definitions were broad enough to catch community-run, noncommercial, open source projects with no realistic way to run an age-gated setup wizard, let alone a compliance department.

Colorado fixed it. Governor Jared Polis signed SB26-051 on June 3, and largely because System76 founder Carl Richell worked directly with the bill’s co-author, State Senator Matt Ball, the final version exempts operating systems, apps, code repositories like GitHub and GitLab, and container platforms like Docker and Podman, as long as they’re distributed under an open license. It also blocks a vendor from locking down a modified version of the software just to dodge the exemption.

California is trying to get to the same place. Its original law, AB-1043, had the identical gap. Assemblymember Buffy Wicks, who wrote that bill, introduced a follow-up, AB-1856, specifically to redefine operating system provider so it excludes anyone shipping software under those same open terms. As of this writing, that fix is still moving through Sacramento, not finished.

Illinois skipped that step entirely. HB5511’s definitions for covered manufacturer and application store are exactly as broad as Colorado’s and California’s were before anyone patched them. The structure isn’t unique to Illinois, either: California did it first, Colorado followed the same blueprint, and HB5511 reads like a close cousin of both, same age brackets, same API-based signal, same per-child penalty figures.

Even Big Tech’s Own Lobby Hated This One

Before Pritzker signed anything, the Electronic Frontier Foundation sent him a letter asking for a veto, calling the bill “a massive privacy and free speech nightmare” and naming the open source ecosystem specifically as one of the things it put at risk. EFF grouped Illinois with a wider run of state bills leaning on child safety language to justify sweeping age-verification mandates.

Separately, and for very different reasons, NetChoice, the trade group that counts companies like Google and Meta among its members, filed testimony opposing the same bill. Its objection was First Amendment law and the risk of exposing sensitive user data, not open source specifically. It’s an odd pairing: a digital rights nonprofit and the lobbying arm for the platforms the bill is supposed to be regulating, arguing against the same bill for opposite reasons. Illinois lawmakers passed it unanimously anyway.

Could Anyone Actually Enforce This?

Only the Illinois Attorney General can bring a case. There’s no private right of action, so an individual can’t sue over this personally. The civil penalty written into the bill itself is up to $2,500 per affected child for a negligent violation and up to $7,500 per affected child for an intentional one. That’s not a coincidence: it’s the exact same figure Colorado’s law uses, because these bills are largely working from the same template as they spread state to state.

Set that against the governor’s own press release, which advertises penalties of up to $50,000 per violation. It’s possible both numbers are technically accurate and just refer to different sections of a fairly long piece of legislation, but nothing in the state’s own materials reconciles them for the reader, and the bigger number is the one that made it into the announcement.

As for actually reaching a hobbyist distro maintainer: nothing in the bill has teeth against someone with no business presence in Illinois, which is exactly the loophole half of r/linux jumped to immediately. Expect a wave of joke warning labels on distro download pages long before anyone pays a fine. The providers who can’t shrug this off are the ones already doing real business in the state, meaning Google, Microsoft, Apple, and any Linux vendor with actual Illinois revenue on the books.

What Happens Between Now and 2028

The compliance deadline is still more than a year out, which leaves room for a few things to happen before it matters. NetChoice has already challenged comparable social media and age-verification laws in Mississippi, Colorado, California, Louisiana, Georgia, and Ohio, with mixed results, some provisions blocked, others upheld. Given that track record, a challenge to HB5511 specifically wouldn’t be a shock, though nothing had been filed as of this writing. There’s also room for an amendment adding the same open source carve-out Colorado and California landed on. Or there’s room for nothing to change, in which case Illinois becomes the version other states copy instead of the exception.

Which of those happens probably depends on whether the open source community shows up in Springfield the way Carl Richell showed up in Denver. Nobody did this time. There’s still time to change that before January 1, 2028 turns into a deadline that actually bites.