Your phone is the new age checkpoint — operating-system age verification explained

The second platform is not far behind. Its app store offers an age-signal service that lets apps ask how old a user is; it was due to reach Australia in August and every market by the end of the year.

Australian rules require age checks at the app store, not a prompt built into the operating system. Elsewhere, that deeper check is becoming law. Britain has promised legislation forcing device-level protections, and three US states now require operating systems to ask your age at setup and pass an age range to any app that asks.

The checkpoint is moving off the website and into the device itself.

One template, three states

California set the pattern. Its Digital Age Assurance Act (AB 1043), signed in October 2025 and in force from 1 January 2027, requires operating-system providers to ask for a birth date or age when an account is created. The system then answers apps in real time with one of four brackets: under 13, 13–15, 16–17 or 18-plus. Developers must request that signal when an app is downloaded and launched, and once they have it they are treated as knowing the user’s age range. Breaches carry penalties of up to US$7,500 per affected child, enforced by the state Attorney General.

A follow-up law, AB 1856, signed on 10 September, cleaned up the scheme. It fixed a definition that had technically treated every device owner as a child, dropped a proposed extension to browsers and websites, and exempted anyone distributing software under licence terms that let recipients “copy, redistribute, and modify” it.

Colorado’s version (SB26-051), signed in June, takes effect in 2028 with a similar open-source exemption. Illinois followed in July with HB5511: operating systems must comply by 1 January 2028, with no open-source carve-out. Brazil, which also places age duties on operating-system providers, has applied its rules since March.

In all three states, nothing is verified: the age is self-declared, once, at setup. Nor does the signal block anything on its own. It is plumbing — other laws covering data collection, addictive design and parental consent hang their duties on it.

Britain wants devices that do more than ask

The UK is going further. In June, the government gave the two companies behind almost every smartphone operating system a three-month deadline to show how phones and tablets would stop children taking, sharing or viewing nude images. Ministers cite the Internet Watch Foundation’s estimate that 91% of such images are self-generated by children, often under coercion, and then used for blackmail.

On 8 September, Culture Secretary Lisa Nandy told the Commons the companies’ changes were a step in the right direction but did not match the scale of the crisis. She committed to primary legislation that would make major tech platforms build device-level protections for children, and make apps that children use stop them accessing or sharing nudity.

As reported, the model is protection switched on by default on every UK device, with adults verifying their age to turn it off. Blocking an image before it is sent means analysing it on the device — the client-side scanning we described in June. The government says it will reconsider legislating if the platforms deliver first. One already has a head start: since a March software update, its UK users who have not confirmed they are adults get content filters by default.

For the checkpoint — and against it

The case for moving the check into the operating system is real. Confirming age once, on the device, is less intrusive than uploading a passport to every app and website that asks. Apps receive an age band, not a birth date or a document. One major app store bars developers from using its signal for advertising or profiling, and Illinois limits disclosure to the minimum necessary. The Reason Foundation praised California’s design for replacing high-risk ID checks with a simple signal, and parents set a child’s age once rather than app by app.

The objections are just as concrete. A self-declared signal stops only people who answer honestly; a verified one — Britain’s plan, and already the case on one major platform — means handing over a card or ID. Either way, the age is tied to an account, not to whoever holds the phone, a gap that age-verification firms and Governor Newsom have both flagged. The Electronic Frontier Foundation warns that because developers are deemed to know a user’s age once the signal arrives, many will restrict more than the law requires. More than 400 computer scientists have signed a letter arguing that such laws build surveillance infrastructure without reliably keeping children out.

For privacy-conscious readers, that last point matters most. Once a standard age layer sits beneath every app, controlled by a handful of platform owners, extending it is easy — to new content, new age thresholds, or identity itself.

What it means for open-source phones and computers

For privacy-focused phones and open-source computers, the US picture is brighter than it looked in March. California and Colorado now exempt software distributed under licences that let anyone copy, modify and redistribute it. Hardened open-source phone systems and mainstream desktop distributions use exactly those kinds of licences, so the projects themselves appear to sit outside both laws. One prominent hardened-phone project had already said it would remain usable without asking for personal details, ID or an account — and that if its devices could not be sold somewhere as a result, so be it.

Three caveats apply.

• Illinois offers no exemption. Its rules apply from 2028. How the state would pursue an overseas volunteer project is unclear, and the gap may yet be closed — or copied elsewhere.

• Exempt is not invisible. The laws put the duty to request a signal on app developers. On a phone that supplies none, some apps may ask you directly or fall back to restricted settings. And if you run the mainstream app store in a sandbox and sign in with an account, that store — itself regulated under these laws — can, in principle, answer apps’ age queries whatever the operating system does. A privacy phone is only as private as its app store.

• Hardware is not software. A major handset maker is expected to ship a phone running a hardened open-source system in 2027. Whether the exemptions cover a commercial manufacturer pairing that code with proprietary firmware is untested.

Australia is quieter, for now. Our industry codes require operating-system providers for phones and tablets to offer child and restricted accounts with default safety settings — a parental tool, not a universal age prompt. If you run an open-source mobile system here, the checkpoint arrives through the stores and apps you choose, not the operating system.

What to do now

• Know which layer is asking. An age prompt may come from the operating system, the app store or the app itself, and each holds different data. Check your phone’s account settings for an age-confirmation entry and note what you have already declared.

• Choose the least revealing check. Where you must prove your age, prefer a check that confirms a fact over one that copies a document, and find out what is kept and for how long.

• Decide what “private” means for you. On a hardened open-source phone, keep the mainstream app store in a separate user profile if you need it, so store-dependent apps and their age queries stay apart from everything else.

• Configure children’s devices properly. Each of these schemes assumes a correctly set-up child account, which remains the most direct control a parent has.

• Organisations: map your obligations. If your apps are used in the US, California’s duties start on 1 January, and Colorado and Illinois follow in 2028. Treat any age signal as personal information — request it only when required and keep it out of analytics.

The bottom line

For decades, age checks lived at the edges: a tick-box on a website, a form inside an app. These laws push the check down into the layer everything else depends on. Done well, that could mean fewer passports handed to strangers. Done badly, it becomes a permanent identity layer beneath everything you run, controlled by whoever writes the operating system.

For people running open-source systems, lawmakers have largely left the operating system alone. The pressure will arrive through app stores and apps instead, which means the decisions that matter are yours: which store you use, which account you sign into, and which layers you let ask who you are.

Xiph Cyber supplies hardened privacy handsets and private SIM cards, and the setup advice to run them well — including profiles that keep big-tech services at arm’s length. To discuss your devices, or your organisation’s obligations under new age-assurance rules, get in touch or email enquiries@xiphcyber.com.

Further reading

• GOV.UK — Lisa Nandy’s statement on protecting children online (8 September 2026)

• Biometric Update — Device-level child safety controls to be legislated in UK (2026)

• Kelley Drye — California’s 2026 legislative session wraps, including AB 1856

• BillTrack50 — Colorado SB26-051, Age Attestation on Computing Devices