Senate Bill 26-051 reflects that pattern. The bill does not directly regulate individual websites that publish adult or otherwise restricted content. Instead, it shifts responsibility to operating system providers and app distribution infrastructure.
Under the bill, an operating system provider would be required to collect a user’s date of birth or age information when an account is established. The provider would then generate an age bracket signal and make that signal available to developers through an application programming interface when an app is downloaded or accessed through a covered application store.
App developers, in turn, would be required to request and use that age bracket signal.
Rather than mandating that every website perform its own age verification check, the bill attempts to embed age attestation within the operating system account layer and have that classification flow through app store ecosystems.
The measure represents the latest iteration in a series of Colorado efforts that have struggled to balance child safety, privacy, feasibility and constitutional limits.
Ah, I found the official answer to my question in the definitions (definition 9):
This still leaves room for ambiguity, though, especially when it comes to Linux: is the OSP the person who installs the OS (e.g. a sysadmin)? They control the operating system on that device. Or are they the individual/organization that deems what software counts as a given operating system (e.g. Microsoft or Linus)? They develop and license the operating system that happens to be on a given device. Maybe it’s both, but the context suggests the latter more strongly to me.