--- title: Illinois HB5511: What It Means for Linux and Open Source description: Illinois HB5511, the Children's Social Media Safety Act (now Public Act 104-0664), signed July 31, contains a largely overlooked provision requiring operating... canonical: https://daily.dev/posts/illinois-hb5511-what-it-means-for-linux-and-open-source-iahbpku4g twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Illinois HB5511: What It Means for Linux and Open Source | daily.dev og:description: Illinois HB5511, the Children's Social Media Safety Act (now Public Act 104-0664), signed July 31, contains a largely overlooked provision requiring operating... og:url: https://daily.dev/posts/illinois-hb5511-what-it-means-for-linux-and-open-source-iahbpku4g og:image: https://api.daily.dev/og/posts/IahbPkU4g.png og:image:alt: Illinois HB5511: What It Means for Linux and Open Source og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Illinois HB5511: What It Means for Linux and Open Source **[Hacker News](https://daily.dev/sources/hn)** · 8 min read · 1 upvotes · 0 comments ## Summary Illinois HB5511, the Children's Social Media Safety Act (now Public Act 104-0664), signed July 31, contains a largely overlooked provision requiring operating system providers and device makers to build an age-declaration step by January 1, 2028. The OS must collect a birth date or age at setup and expose an encrypted API returning one of four age brackets (under 13, 13–15, 16–17, 18+) to any requesting app. Unlike Colorado's SB26-051—where System76's Carl Richell lobbied for an explicit open source exemption—and California's pending AB-1856 fix, Illinois included no carve-out for nonprofit or community-run open source projects. The EFF urged a veto, calling the bill a privacy and free speech risk to the open source ecosystem. Enforcement is limited to the Illinois AG; civil penalties in the bill text are $2,500–$7,500 per affected child, though the governor's press release cited $50,000 per violation. Hobbyist distro maintainers with no Illinois business presence are practically unreachable, but commercial Linux vendors, Google, Microsoft, and Apple face real compliance obligations. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What does Illinois HB5511 require operating system providers to do by 2028? By January 1, 2028, Illinois HB5511 (now Public Act 104-0664) requires every 'operating system provider' and 'covered manufacturer' of an internet-connected OS, commercial or nonprofit, to build a setup screen collecting a birth date or age and to expose an age-bracket signal (under 13, 13-15, 16-17, or 18+) via an encrypted API to any app that requests it. Platforms then have until July 1, 2028 to start requesting that signal. _Teams tracking upcoming compliance deadlines like this one can follow the story as it develops on daily.dev._ ### Does Illinois HB5511 exempt open source software from its operating system age verification rules? No, Illinois HB5511 includes no exemption for open source software, unlike Colorado's SB26-051, which exempts operating systems, apps, code repositories such as GitHub and GitLab, and container platforms like Docker and Podman when distributed under an open license. California's AB-1856 aims for a similar carve-out but was still moving through the legislature as of this writing, leaving Illinois's broad definitions unpatched. _Open source maintainers weighing regulatory exposure can keep tabs on state-by-state age-verification carve-outs via daily.dev._ ### What penalties does Illinois HB5511 set for violating the operating system age verification requirement? The bill's own text caps civil penalties at $2,500 per affected child for a negligent violation and $7,500 per affected child for an intentional one, matching Colorado's figures since the laws share a common template. The governor's press release instead advertises penalties of up to $50,000 per violation, and nothing in the state's materials reconciles the two figures. Only the Illinois Attorney General can enforce the law; there is no private right of action. _Developers assessing legal risk from new state tech laws can track penalty details like these on daily.dev._ ## Community take How the wider developer community reacted, aggregated from 1 discussion and 270 comments across hackernews (as of 2026-09-14). **TL;DR:** The community is largely critical of Illinois HB5511, viewing it as unenforceable overreach against open source projects and a privacy/surveillance risk, though a minority argues the self-declaration approach is modest and preferable to harsher alternatives like ID verification. **Sentiment:** 10% positive · 35% mixed · 55% skeptical **The case for** - Self-declaration (not verification) is a relatively low-friction mechanism that parents could use to set content limits at device setup. - A modest opt-in age-declaration system now could preempt far more invasive ID-verification mandates later. - Commercial vendors (Google, Apple, Microsoft) already have the infrastructure to implement this without burdening hobbyist distros. **The pushback** - The law builds age-verification infrastructure into the OS stack, making it trivially easy for future legislatures to mandate actual verified identity checks. - Enforcement against international, decentralized, volunteer-run open source projects is practically impossible, making the law largely theater. - Requiring an OS to ask for age/birth date is a category error — it's an OS, not a social media platform, and the data collection is inherently a privacy risk. - The law contains no carve-out for nonprofit or community-run open source projects despite similar laws in other states including one. - The encrypted API exposing age brackets to any requesting app creates a new attack surface and surveillance vector regardless of intent. - Content providers, not OS vendors, are the logical place to enforce age-appropriate access controls. **By community** - hackernews (skeptical): Dominated by a lengthy debate between a defiant Linux distro founder and skeptical legal voices, with most commenters viewing the law as unenforceable overreach while a small minority argues self-declaration is a reasonable, privacy-preserving compromise. **Hottest debate:** Whether publicly declaring intent to defy the law is a principled free-speech stand or a legally reckless move that could be used as evidence of intent to violate. **Open questions** - How would age-bracket APIs interact with virtual machines, containers, and ephemeral OS instances where there is no persistent user? - Can Illinois actually prosecute a California-based developer for distributing software legally in California? - Does the 'code is speech' / Bernstein precedent actually protect FOSS maintainers from being compelled to implement this feature? - Would major gatekeepers (Apple, Google, Microsoft) simply pass the requirement down to browsers or app stores, rendering OS-level enforcement moot? **Highlights** > Not that I'm condoning it, but this law requires self-declaration, not verification. It might sound pedantic but the practical difference is huge. Self-declaration means that the system asks the user to declare if they are a minor. Nothing is verified. Age verification typically means a system which checks ID or has other enforcement measures to try to verify age. > — [Aurornis on hackernews · 5 comments](https://news.ycombinator.com/item?id=49249608) > > Our FOSS code is constitutionally protected free speech and I would defend on those grounds. You have precisely zero additional speech rights as a FOSS project than any other organization has. If "free speech" was a valid defense for you, then Meta would be doing the same. > The technical design of the project just makes it so no one can force changes on the distro unwanted by the maintainer team regardless of any courtroom outcomes. Being unable to comply is not a valid legal defense. > Like, what if someone made a law that said Bitcoin nodes must KYC? They could make the law I guess, and the international network operators would just laugh at it. This is the law in various places under various mechanisms. It is handled by putting people in prison or taking people's assets. > — [kube-system on hackernews · 3 comments](https://news.ycombinator.com/item?id=49250240) > I feel like all of these laws are being designed backwards. Content providers, like MPAA films, should have to identify what sort of content they are providing. Then I can give my kids a device configured to allow some or all of that at my discretion. Requiring my kids' devices to advertise their age (or their age "bucket", as if that was a meaningful difference) to protect them is not doing me or my kids any favors. > — [kej on hackernews · 12 comments](https://news.ycombinator.com/item?id=49249786) > Or alternatively - you could recognize that normal people are getting more and more pissed off by the fact that social media companies are force-feeding garbage into their kids eyeballs 16 hours a day. We could give them a reasonable solution that demonstrably preserves privacy and doesn't inconvenience anyone else (Suppose you want to see all the uncensored everything, you open your new PC or phone and say your DOB is 1/1/1900. Done. Status quo.) Or we could be alarmist about that, torpedo that plan, and then in 2 more years when people are even MORE pissed, a horrifying new plan comes out, where the government scans your photo ID (with the help of some crappy private contractor of course) and both of them promise to probably not store the info and log your access. And that one manages to scrape by because people are at that point even more pissed and are determined to solve the problem somehow. The actual 'bad guys' just wouldn't be able to get the public support for that second, shitty plan, if we basically solve the problem now with this very modest plan that's on the table now. Parents can handle this simple one-time out-of-box prompt and it makes sense. Device owner, the parent, that's the one who should make the call. > — [xp84 on hackernews](https://news.ycombinator.com/item?id=49250518) > > hoping you are never forced to add code to a project you do not want to add You keep saying that, but that's not the realistic outcome. The realistic outcome isn't an injunction forcing you to add code. It'd be to force you to pull it out of circulation. > — [otterley on hackernews](https://news.ycombinator.com/item?id=49250621) **Source threads** - [hackernews](https://news.ycombinator.com/item?id=49249150) · 189 points · 270 comments ## Similar posts on daily.dev - [Illinois Just Told Every Operating System to Start Reporting Your Kid's Age](https://daily.dev/posts/illinois-just-told-every-operating-system-to-start-reporting-your-kid-s-age-tb3tfmt1b) · It's Foss · 0 upvotes · 0 comments - [California’s age verification law applies to Linux, FreeBSD, and FreeDOS too](https://daily.dev/posts/california-s-age-verification-law-applies-to-linux-freebsd-and-freedos-too-s05pz4jbv) · All Things Open · 0 upvotes · 0 comments - [California Passes AB-1856 For Open-Source Relief Over Age Verification](https://daily.dev/posts/california-passes-ab-1856-for-open-source-relief-over-age-verification-b3tdic507) · Phoronix · 0 upvotes · 0 comments --- Tags: [#general-programming](https://daily.dev/tags/general-programming), [#open-source](https://daily.dev/tags/open-source), [#linux](https://daily.dev/tags/linux) [View this post on daily.dev](https://daily.dev/posts/illinois-hb5511-what-it-means-for-linux-and-open-source-iahbpku4g) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Illinois HB5511: What It Means for Linux and Open Source","url":"https://daily.dev/posts/illinois-hb5511-what-it-means-for-linux-and-open-source-iahbpku4g","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/illinois-hb5511-what-it-means-for-linux-and-open-source-iahbpku4g"},"datePublished":"2026-08-10T20:53:41.264Z","dateModified":"2026-09-14T09:31:52.619Z","description":"Illinois HB5511, the Children's Social Media Safety Act (now Public Act 104-0664), signed July 31, contains a largely overlooked provision requiring operating...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/7214257b71f78d37925d2a4da22199bc?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/7214257b71f78d37925d2a4da22199bc?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Hacker News","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Hacker News","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/hn","url":"https://daily.dev/sources/hn"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/illinois-hb5511-what-it-means-for-linux-and-open-source-iahbpku4g","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"general-programming,open-source,linux","timeRequired":"PT8M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Hacker News","item":"https://daily.dev/sources/hn"},{"@type":"ListItem","position":3,"name":"Illinois HB5511: What It Means for Linux and Open Source"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/illinois-hb5511-what-it-means-for-linux-and-open-source-iahbpku4g#faq","mainEntity":[{"@type":"Question","name":"What does Illinois HB5511 require operating system providers to do by 2028?","acceptedAnswer":{"@type":"Answer","text":"By January 1, 2028, Illinois HB5511 (now Public Act 104-0664) requires every 'operating system provider' and 'covered manufacturer' of an internet-connected OS, commercial or nonprofit, to build a setup screen collecting a birth date or age and to expose an age-bracket signal (under 13, 13-15, 16-17, or 18+) via an encrypted API to any app that requests it. Platforms then have until July 1, 2028 to start requesting that signal. Teams tracking upcoming compliance deadlines like this one can follow the story as it develops on daily.dev."}},{"@type":"Question","name":"Does Illinois HB5511 exempt open source software from its operating system age verification rules?","acceptedAnswer":{"@type":"Answer","text":"No, Illinois HB5511 includes no exemption for open source software, unlike Colorado's SB26-051, which exempts operating systems, apps, code repositories such as GitHub and GitLab, and container platforms like Docker and Podman when distributed under an open license. California's AB-1856 aims for a similar carve-out but was still moving through the legislature as of this writing, leaving Illinois's broad definitions unpatched. Open source maintainers weighing regulatory exposure can keep tabs on state-by-state age-verification carve-outs via daily.dev."}},{"@type":"Question","name":"What penalties does Illinois HB5511 set for violating the operating system age verification requirement?","acceptedAnswer":{"@type":"Answer","text":"The bill's own text caps civil penalties at $2,500 per affected child for a negligent violation and $7,500 per affected child for an intentional one, matching Colorado's figures since the laws share a common template. The governor's press release instead advertises penalties of up to $50,000 per violation, and nothing in the state's materials reconciles the two figures. Only the Illinois Attorney General can enforce the law; there is no private right of action. Developers assessing legal risk from new state tech laws can track penalty details like these on daily.dev."}}]} ```