Illinois HB5511: What It Means for Linux and Open Source
Skip to content
Search
Search
Search …
Search
Search
Search …
Search
Search …
Menu
HB5511 is officially about TikTok and Instagram. Read past the press release and it’s also about your operating system.
Governor JB Pritzker’s press release on HB5511 is thick with quotes from legislators and advocacy groups, and it names Instagram, TikTok, Snapchat, X, Facebook, and Roblox specifically. Device setup gets one mention, framed as something a parent configures during setup. Nowhere does it explain that the law also creates a separate legal category called an operating system provider , with its own 2028 deadline and its own civil penalties, that has nothing to do with what any parent chooses to click.
TL;DR
HB5511, the Children’s Social Media Safety Act , is now Illinois Public Act 104-0664 . Pritzker signed it July 31.
The headline provisions target social platforms: no algorithmic feeds for minors by default, no notifications between 10pm and 7am, no contact from adult strangers.
A separate part of the bill defines operating system provider and covered manufacturer broadly enough to include anyone who builds an internet-connected OS, commercial or nonprofit.
By January 1, 2028 , those providers have to build an age-declaration step and hand an age-bracket signal to any app that requests one.
Unlike Colorado, and unlike where California is heading, Illinois added no exemption for open source software .
Enforcement runs through the Illinois Attorney General only. The bill’s own text caps penalties at $7,500 per affected child. The governor’s press release advertises penalties of up to $50,000 per violation. Those numbers don’t obviously square with each other.
The Version Illinois Wants You to Read
Set the operating system question aside for a second, because the social media half of this bill is fairly standard for 2026. Platforms built around algorithmic feeds, plus platforms where kids can be contacted by strangers (Roblox is the named example), now have to default minors into chronological, follow-only feeds instead of an engagement-optimized one. Notifications get cut off overnight. Adult strangers can’t see a minor’s profile, message them, or see their location. News sites, email providers, broadband companies, and school software are all carved out by name.
It passed the General Assembly on June 1 without a single no vote, 57-0 in the Senate and 113-0 in the House concurrence. Pritzker signed it July 31, flanked by quotes from Attorney General Kwame Raoul and groups like Common Sense Media and Mothers Against Media Addiction. Nothing about that rollout mentions your desktop.
The Part the Press Release Skipped
Here’s what actually set off the Reddit thread: a post claiming Illinois now requires operating system providers, open source projects included, to build age verification by 2028. It wasn’t universally believed. On at least one mirror of the discussion, a commenter argued the framing was misleading and that the post should be corrected. So instead of trusting a screenshot either way, we went and read the bill on the Illinois General Assembly’s own tracker.
It holds up. Separate from the social media rules, HB5511 creates duties for an operating system provider and folds device makers, OS vendors, and app stores together under the term covered manufacturer . Legislative trackers that follow this exact category of bill across states file this piece under its own name: Digital Age Assurance , the same bucket Colorado’s and California’s versions land in.
What Every Covered Manufacturer Has to Build by 2028
An accessible setup screen that asks an account holder to indicate a birth date, an age, or both.
A way for any app or platform that asks (the bill calls them "operators" and "covered developers") to receive a signal for that age, delivered through a consistent, encrypted API.
A hard limit on what gets shared: only the minimum information needed to answer the question, and no handing it to a third party beyond what the law requires.
The signal itself isn’t a birthday, it’s a bracket: under 13, 13 to 15, 16 to 17, or 18 and up . Operating systems have until January 1, 2028 to have this built. Platforms then have until July 1, 2028 to start actually requesting that signal for their users. Once an app gets a "minor" bracket back, the law treats it as having actual knowledge the user is underage, which is what flips on every default protection in the social media half of the bill.
Nothing in the bill requires a passport scan or a face scan at setup. It’s self-declared, the same way most apps ask your birthday today, just centralized once at the OS level instead of repeated app by app. That’s exactly why a good chunk of the r/linux replies were jokes about setting their install’s date of birth to sometime in the Nixon administration.
Nobody Carved Out an Exception This Time
This structure, OS hands out an age...