California\u2019s Digital Age Assurance Act may reshape how online services handle age data, but critics argue the law stops short of requiring true age assurance. Scheduled to take effect on January 1, 2027, the law puts the collection of age data on the device provider and app store operator, by requiring operating systems to ask for a date of birth when a user registers a device. The OS then shares a signal with sites and platforms, who are expected to adjust their content and services to be age-appropriate for particular age brackets.<\/p>\n
Critics argue the framework still relies heavily on self-declared age information, long viewed as one of the weakest forms of age assurance. It\u2019s not hard to imagine why; a fifteen year-old user who knows that they\u2019ll have access to porn will happily tell their phone that they\u2019re three years older.<\/p>\n
With six months to go before the law takes effect, some parties are issuing guidance, some are bemoaning a perceived loss of privacy and free speech, and some are arguing that AB 1043<\/a>\u2019s system is not, in fact, age assurance<\/a> at all.<\/p>\n AB 1043 departs from familiar age check models: IEEE<\/p>\n Standards body IEEE SA has published a piece outlining how California\u2019s Digital Age Assurance Act will affect businesses. \u201cWhile the law does not mandate government ID uploads or biometric scans,\u201d the standards organization says<\/a>, \u201cit still carries meaningful compliance implications for companies offering digital services to California residents.\u201d<\/p>\n The framework leverages a device-level \u201cage bracket signal<\/a>\u201d based on the birthdate collected when a user registers a device. This declared age will be used to curate what\u2019s available on the app store, and can be shared with developers as a secure signal on request to ensure age-appropriate experiences.<\/p>\n \u201cApplications receive only the age range, not a birthdate or identifying documentation. The law emphasizes proportionality, data minimization, and accountability once age information has been collected.\u201d<\/p>\n \u201cFor businesses, this represents a notable departure from traditional online age verification methods\u201d \u2013 and a potential shift in how businesses establish \u201cactual knowledge\u201d of a user\u2019s age under existing privacy laws.<\/p>\n Definition of \u2018actual knowledge\u2019 becomes slippery<\/p>\n According to IEEE, once a business receives an age signal indicating a user is under 18, California law treats that business as having actual knowledge of the user\u2019s age range. The signal is treated as \u201cthe primary indicator of a user\u2019s age range for purposes of complying with applicable law, unless a business possesses clear and convincing internal information to the contrary.\u201d<\/p>\n \u201cIf an application receives an age bracket signal and ignores it, the law treats that inaction as willful. In practice, this may affect how personal data is collected, how advertising is served, and how default privacy settings are configured.\u201d<\/p>\n Unlike states such as Texas<\/a> or Utah<\/a>, which have legislated platform-level age checks or app store checks that require age verification, California\u2019s broad framework seeks to avoid banning whole categories of apps or mandating universal parental approval. \u201cThe emphasis is on providing age context so existing laws can be enforced more consistently,\u201d says the IEEE. \u201cThis makes AB 1043 relevant not only to social media companies, but also to gaming platforms, productivity tools, streaming services, and other applications that may not traditionally think of themselves as child-directed.\u201d<\/p>\n The IEEE says that, as an alternative to stricter, platform level age checks that other states have put in place for restricted content, California\u2019s law could prove to be an attractive model for other countries. \u201cWhile statutes such as AB 1043 do not prescribe specific technical standards or certification requirements, many organizations look to established frameworks as reference points when interpreting evolving compliance expectations.\u201d<\/p>\n AVPA argues AB 1043 doesn\u2019t mandate age assurance at all<\/p>\n And what does the age assurance sector think of California\u2019s law? Not much.<\/p>\n In a statement<\/a>, the Age Verification Providers Association says the open source exemption is great \u2013 \u201ca sensible correction that allows policymakers to focus on the commercial operating systems that are the true target of the law\u201d \u2013 it fails on a fundamental issue, which is that it is \u201ca parental control framework, not an age assurance framework.\u201d<\/p>\n Its argument is rather convincing. AVPA says AB 1043 \u201cdoes not establish that the person currently accessing a service is the age claimed, does not tell a relying platform anything about the level of age assurance behind the signal it receives, and does not require Apple<\/a> or Google<\/a> to independently verify a single age declaration before transmitting an age signal downstream.\u201d<\/p>\n The trade organization points out how easy it is for a 15-year-old to acquire a smartphone today in the U.S. \u201cThey can purchase a handset outright with cash from any electronics retailer or carrier store where no age check is required or customary. They can activate it using a prepaid SIM card bought over the counter at a supermarket or pharmacy with no identity check. Next, they can create an Apple ID or Google account by entering a date of birth of their choosing.\u201d<\/p>\n Even though independent age verification never enters the picture, \u201cif a user claims to be over 18, that declaration becomes the foundation of every subsequent age signal generated by the operating system.\u201d<\/p>\n This poses a compliance risk for platforms, which do not receive the same legal protections as Apple and Google under the law. Big Tech gets \u201csubstantial liability protection under section 1798.503(b), including for erroneous signals and for certain downstream conduct by platforms that receive them.\u201d<\/p>\n Meanwhile, platforms \u201care deemed to have actual knowledge based on a signal whose integrity is not guaranteed, yet they remain responsible for complying with COPPA, state privacy laws and a growing range of other age restrictions.\u201d<\/p>\n EFF criticizes expansion of age-bracketing model<\/p>\n The Electronic Frontier Foundation (EFF) has also criticized AB 1043 and a related clean-up bill, AB 1856<\/a>, arguing the framework threatens privacy, anonymity and free expression.<\/p>\n While EFF welcomed an exemption for open-source operating systems, it warned that expanding the age-bracketing system to browsers and websites could create what it called \u201ca recipe for censorship.\u201d<\/p>\n The group argues<\/a> that mandated age-gating systems risk undermining privacy and anonymity online, even when they stop short of requiring government ID or biometric checks.<\/p>\n Certification gains yet more importance<\/p>\n The law throws yet another spotlight on the increasing importance of testing and certifications<\/a>.<\/p>\n \u201cFor organizations navigating children\u2019s privacy, advertising restrictions, and data handling obligations,\u201d says IEEE, \u201caligning with an online age verification certification program early can help clarify expectations and reduce uncertainty as enforcement approaches.\u201d A practical benchmark can show that a company has \u201ctaken reasonable steps to align its practices with emerging standards, rather than relying on ad hoc or outdated approaches.\u201d<\/p>\n In preparing for compliance, online businesses serving California should now think beyond single statutes and check boxes, and focus on building sustainable, standards-based practices<\/a>.<\/p>\n Look to standards for reliable age assurance<\/p>\n \u201cThe AVPA supports measures that help parents manage children\u2019s online experiences. Device-level age signals<\/a> and parental controls can form part of a broader child safety ecosystem and may serve as useful inputs into a platform\u2019s age assurance process. They are not, however, a substitute for independent age assurance for medium and high risk use-cases.<\/p>\n \u201cWhere legislators want reliable age determination \u2013 not just a declared age passed through a pipeline \u2013 they should require publisher-level age assurance conducted against recognised technical standards such as ISO\/IEC 27566-1<\/a> and IEEE 2089.1<\/a>.\u201d<\/p>\n \t\t\t\tArticle Topics<\/p>\n age verification<\/a> \u00a0|\u00a0 AVPA<\/a> \u00a0|\u00a0 California<\/a> \u00a0|\u00a0 Digital Age Assurance Act<\/a> \u00a0|\u00a0 IEEE<\/a> \u00a0|\u00a0 legislation<\/a> \u00a0|\u00a0 United States<\/a><\/p>\n \t\t\t\t\tLatest Biometrics News<\/p>\n \t\t\t\t \n\t\t\t\t\t\t\t\tJun 8, 2026, 4:49 pm EDT\t\t\t\t\t\t\t<\/p>\n The Ghanaian government is working on a policy that would mandate age verification for access to age-restricted services like online\u2026<\/p>\n \t\t\t\t \n\t\t\t\t\t\t\t\tJun 8, 2026, 4:00 pm EDT\t\t\t\t\t\t\t<\/p>\n The Zambian government is banking on a new partnership with Chinese tech giant Huawei to power digital government services across\u2026<\/p>\n \t\t\t\t \n\t\t\t\t\t\t\t\tJun 8, 2026, 3:16 pm EDT\t\t\t\t\t\t\t<\/p>\n Australia is moving beyond age assurance mandates toward a broader legal framework designed to hold online platforms accountable for harms\u2026<\/p>\n \t\t\t\t \n\t\t\t\t\t\t\t\tJun 8, 2026, 2:54 pm EDT\t\t\t\t\t\t\t<\/p>\n Governments are increasingly pursuing technological sovereignty as concerns grow around dependence on foreign AI, cloud and biometric infrastructure. S. Krishnan,\u2026<\/p>\n
\n\t\t\t\t\t\u00a0\t\t\t\t<\/a>\t\t\t\t<\/p>\n
\n\t\t\t\t\t\u00a0\t\t\t\t<\/a>\t\t\t\t<\/p>\n
\n\t\t\t\t\t\u00a0\t\t\t\t<\/a>\t\t\t\t<\/p>\n
\n\t\t\t\t\t\u00a0\t\t\t\t<\/a>\t\t\t\t<\/p>\n