Illinois Passed a Kids-and-TikTok Bill. It Also Reaches Open Source Operating Systems.

Pritzker signed HB5511 on July 31 at a bill table in Chicago, with advocates from Common Sense Media and Mothers Against Media Addiction flanking him, and the press release that followed read like a TikTok crackdown. Headlines picked up the social media half: no algorithmic feeds for minors by default, no overnight notifications, no contact from adult strangers. That half passed 57-0 in the Senate and 113-0 in House concurrence on June 1, and it slots into the same 2026 boilerplate other states are running.

The underreported second half has nothing to do with social media. As of January 1, 2028, any "operating system provider" in Illinois must build an age-declaration step into their product and hand an age-bracket signal to any app that asks. The bill defines that category broadly enough to reach any builder of an internet-connected OS, commercial or nonprofit, with no open source exemption. Enforcement runs through the Illinois Attorney General only. There is no private right of action.

That is the structural story the wire coverage has not surfaced. A secondary analysis of the bill flagged the gap: Colorado's age-assurance statute, and the direction California is now moving, both carved out open source projects by category. Illinois declined that carveout. Public Act 104-0664, the enrolled act number once a bill is signed, treats an open source OS the same as a commercial one, on the same January 1, 2028 clock, with the same AG enforcement lane.

What the statute actually reaches, and what it omits, is the news. A broadly defined "operating system provider" who builds any internet-connected OS is now a regulated entity in Illinois for age-assurance purposes, without a category exemption for noncommercial projects. The bill's own text caps civil penalties at $7,500 per affected child, but the governor's press release advertises up to $50,000 per violation. The two figures do not square, and the press release does not explain the gap. A reader running compliance math needs to know which number is statutory and which is rhetorical.

The duty itself is narrow in form and broad in reach. A covered OS provider must add an age-declaration step and pass an age-bracket signal to any app that requests it. The statute does not say which apps must ask, what age-bracket schema to use, or how a provider verifies the declaration in the first place. That implementation work is left to the AG, to guidance, and to the January 1, 2028 deadline. A nonprofit open source maintainer shipping a Linux distribution into Illinois now has to decide whether to build that path, decline the jurisdiction, or wait for guidance that may not come before the clock runs out.

Developer-side reaction on Hacker News reads this as an open question of jurisdiction, not a done deal, with forum commenters split on whether distros will ship the path, decline it, or wait for AG guidance. That is commentary, not corroborated fact, and the AG has not issued public guidance yet.

The legitimate criticism cuts both ways. The bill passed unanimously in both chambers on its core provisions, including the OS-provider half, and the AG is the sole enforcer, with no private right of action, so the practical compliance pressure runs through one office and one set of guidance. That is a different posture from a regime with a bounty structure or a per-app fee, and it changes the cost of getting it wrong: a $7,500 per-child statutory cap, not the $50,000 the press release implies. The press release figure is the one advocates and reporters have been repeating; the statutory cap is the one a builder's counsel will read.

The bigger question is the design choice Illinois just declined. Colorado carved out open source by category. California is moving in the same direction. Illinois wrote a broader definition, kept the open source projects inside it, and put the AG in charge of figuring out what compliance looks like for a category that includes nonprofits shipping free software. If the AG issues guidance that treats open source projects like any other provider, the carveout is dead. If the AG issues guidance that de facto exempts them, the statutory text says otherwise, and a future AG can read it back in. The bill's silence on the question is the answer some builders were looking for, and the trap others will walk into.

The compliance clock starts January 1, 2028. The press release and the bill text disagree on the penalty. The category is broad, the carveout is missing, and the enforcer is one office. That is the structural read the wire coverage has not run.