Your Computer May Soon Be Forced to Report Your Age to Every Website You Visit. Your VPN Can't Stop It.

Your browser doesn't know how old you are. If California's AB 1856 passes, it will.

The bill cleared the state Assembly 68-1 on May 28. It's now in the California Senate, with committee reviews expected in June. If it becomes law, browsers would be required to automatically and silently transmit your age bracket to every covered website you visit before you interact with anything on the page.

AB 1856 was framed as a fix for open-source software developers frustrated by last year's Digital Age Assurance Act. It addresses that concern. But its bigger effect is on everyone else.

What California's AB 1856 actually does

AB 1856 is a follow-up to AB 1043, known as the Digital Age Assurance Act. AB 1043 was signed by Gov. Gavin Newsom on October 13, 2025, and is scheduled to take effect on January 1, 2027. It requires operating systems to collect your age when you set up the device. You have to choose an age bracket:

• Under 13
• 13–15
• 16–17
• 18+

Then the operating system uses an automated age-signal transmission to share the reported age with websites and apps. It shifts the responsibility of age verification from specific sites to your device.

Assemblymember Buffy Wicks, who created the Digital Age Assurance Act, introduced AB 1856 to address concerns raised by the open-source software community. Under AB 1043, Linux distributions and other open-source operating systems would have been required to implement age-collection systems. That would’ve been a technically and legally complicated mandate for volunteer-run projects with no centralized infrastructure.

AB 1856 exempts any operating system distributed under a license that lets users copy, redistribute, and modify the software, which covers the vast majority of Linux distributions.

AB 1856 also introduced new expansions on the original legislation. Browsers and website operators are now listed as entities required to collect and automatically transmit age signals. The Electronic Frontier Foundation (EFF) warns that this expansion would make it "nearly impossible for regular internet users to avoid AB 1043's age gates." Your chosen age bracket will follow you across websites with no manual check needed.

AB 1856 does include one genuine improvement: it narrows the "actual knowledge" provision so that when a developer receives an age signal, that knowledge applies only to the specific device you're using, not across every device and account you own. That's a meaningful privacy gain for app users.

AB 1856 passed the Assembly 68-1. The next step is for the California Senate to vote on it. Committee reviews are expected to happen in June 2026. For now, the Digital Age Assurance Act is still on track to become law on January 1, 2027.

What California's age-tracking bill means for your privacy

AB 1856 does exactly what privacy advocates have been warning about. If it passes, every covered browser and website will silently receive a signal confirming your age bracket before you interact with anything on the page.

The category of "covered" websites isn't fixed either. It started with adult content sites and has since expanded to social media. AB 1856 doesn't define its own boundary: it piggybacks on whatever age verification laws already exist, meaning every new law automatically widens the pipeline.

Already, 22% of Americans say they've used a VPN to bypass age-restricted content. But a VPN won't stop the age bracket signal. A VPN encrypts your traffic, but the proposed signal would travel within that encryption and be delivered to the website on the other end.

Utah's Senate Bill 73 adds more pressure, holding websites liable when VPN users bypass age checks. And separately, FISA Section 702 means VPN traffic can already be treated as foreign by U.S. intelligence agencies.

Privacy-conscious internet users who rely on VPNs face pressure on all three fronts.

What to do right now about California's age verification law

1. Know where the law stands before you act.

AB 1856 hasn't passed yet. Senate committee reviews are expected in June 2026, and the bill must be signed into law before anything changes. AB 1043, the original law it amends, takes effect January 1, 2027. You can track the bill's progress at leginfo.legislature.ca.gov. For now, knowing what's coming is the first step.

2. Use a VPN to protect your broader privacy.

AB 1856's age-tracking pipeline operates at the browser level, and a virtual private network (VPN) won't block that signal. But a VPN can encrypt your traffic, mask your IP address, and reduce how much of your activity is visible to third parties as more of these laws take shape. See our guide to the best VPNs for providers with a verified no-logs policy and built-in obfuscation protocols.

3. If you're a parent, weigh both sides of this law.

AB 1856 was designed to protect minors online. But the infrastructure it creates — age-bracket data sitting with every covered website operator — represents a new breach surface for your child's information too. Parental control apps give you the same protection over what your kids can access without routing their age data through every site they visit. See our guide to the best parental control apps for more details.

4. Reduce your data footprint before this takes effect.

The data AB 1856 would generate about you, and data already circulating about you, doesn't disappear when a law changes. A data removal service can reduce how much of your personal information is held by data brokers right now, before new pipelines add to the picture. See our guide to the best data removal services for audited options.

Bottom line

AB 1856 is not law yet, but it passed the California Assembly 68-1 and is heading into Senate review. It fixed a real problem for open-source developers. For everyone else, it expanded an age-tracking pipeline that would follow you from your device setup to every website you visit.

The Senate still has to act. Until then, the most practical step is getting your privacy infrastructure in place: a solid VPN, reviewed parental controls if you have kids, and a reduced data footprint.

These tools matter whether or not this specific bill passes. California won't be the last state to move toward broader age-tracking restrictions online. Utah, Wisconsin, and Michigan have all advanced age verification legislation, and the infrastructure AB 1856 is building is designed to scale.