On April 13, 2026, Representatives Josh Gottheimer (D-NJ) and Elise Stefanik (R-NY) introduced H.R. 8250, a bipartisan bill that would require every operating system provider in the United States to verify the age of each user and expose that verified age data through standardized APIs accessible to applications and platforms. The bill — formally titled "To require operating system providers to verify the age of any user of an operating system, and for other purposes" — was referred to the House Committee on Energy and Commerce on April 13. If enacted, it would be the most sweeping age-assurance mandate in U.S. history, moving the verification checkpoint upstream from websites and apps to the core software running every PC, smartphone, and smart home device.

Why It Matters

H.R. 8250 is arguably the most consequential age verification proposal introduced in the U.S. to date — not because it's likely to pass immediately, but because it establishes federal intent to move beyond the patchwork of state site-level mandates. If the OS-level model gains traction, it would standardize the verification environment that adult platforms have been operating in chaotically for years, potentially turning age assurance from a liability into a neutral infrastructure layer. The bipartisan framing signals this is not going away, and California's A.B. 1043 provides a likely preview of what federal implementation looks like in practice.

The bill's model is OS-level age bracketing: Windows, macOS, iOS, Android, and potentially Linux distributions would need to verify user ages at device setup, allow parents to configure content controls at that point, and then feed those settings through APIs to any app or website running on the device. Applications would default to child-restrictive settings when an OS fails to provide a valid age signal — a provision that has raised alarm in the open-source community. System76, the Linux PC maker, warned that "Linux distributions that do not provide an age bracket signal will result in a nerfed internet" for their users, since most Linux distributions lack the centralized user-verification infrastructure that commercial OS vendors have. Non-compliant OS providers face fines of $7,500 per violation.

The bill mirrors California's A.B. 1043, which passed unanimously and takes effect in January 2027, and tracks similar legislation advancing in Colorado, Illinois, Louisiana, New York, Texas, and Utah. Gottheimer and Stefanik's bill represents the first attempt to federalize the OS-level model, which proponents argue is more effective than platform-by-platform age checks because it cannot be circumvented by switching browsers or using VPNs within a verified device session. Critics, including the Electronic Frontier Foundation, counter that centralizing age verification at the OS level would create a government-accessible identity database tied to every device action — a privacy architecture with no precedent in U.S. law. Bill text was not publicly available as of April 15; a commenter noted it appeared on April 16.

For the adult content industry, OS-level age verification would fundamentally change the consumer access journey. Rather than age gates built and maintained individually by each adult platform — with all their legal and privacy risk — OS-verified age signals would flow automatically to participating platforms, dramatically lowering compliance costs while also enabling content defaults that could restrict adult material until a user actively unlocks access. The practical effect on conversion funnels, default states, and the geography of compliance risk is still being assessed by industry legal teams. The bill has not yet been scheduled for committee hearings.

Sources

Update — 2026-04-17

Initial entry — story first created.

Update — 2026-10-03

Microsoft builds the OS-level age signal itself, without waiting for a federal mandate. H.R. 8250 is still in committee, but Windows is moving to the architecture the bill describes. On September 8, 2026, Microsoft's Windows Experience Blog announced the Windows Age API, which lets apps query a user's age band instead of a birthdate. GetUserAgeRangeAsync returns one of five non-identifying groups (under 10, 10–12, 13–15, 16–17, 18+). GetAgeVerificationStatusAsync reports whether that age has been verified or only self-reported, for "scenarios when self-reported age is not sufficient." CheckAgeStatusAsync returns child/minor/adult status "as defined by regional policies." Alongside the API, Microsoft Age Verification (MAV) lets users verify once through their Microsoft account and carry that status across Windows and apps ("verify once → use everywhere"). MAV is already live in Microsoft storefronts in Singapore, Brazil and Australia, and Microsoft says more regions will be added as local laws require.

A Bangkok Post explainer published today (October 3) reports that the Age API is currently available to Windows Insiders ahead of broader release. It also places the move against the FTC's February 2026 policy statement that it would not take enforcement action over personal data collected solely for age verification, provided the data is deleted afterward.

Why it matters for adult and sexual-wellness platforms: With Apple's iOS 26.4 account-level checks (now under Ofcom scrutiny in the Aylo case) and Windows' Age API, both major desktop and mobile OS vendors outside Google now offer a signal that distinguishes verified 18+ users from self-reported ones. That is the infrastructure Aylo has been lobbying for. It is also what California's AB 1043 (effective January 1, 2027) and this bill would require. The open question is the same one Ofcom is asking in London: will a regulator accept "the OS said 18+, verified" as discharging a site's own duty? Until one does, expect these signals to add to site-level checks rather than replace them.

New Sources