Presumably by outlawing the types of algorithms used with the legislation carefully limited to a particular context rather than anything being authored by an individual. Right to express oneself preserved, government regulates a harmful product, business as usual.

As far as this specific Colorado legislation goes (which is concerned with the ability to comply with their previously passed data privacy law) I think it's not entirely bad but I have two issues with it.

First, it reverses the problem. Services should be sending an age-appropriateness (or even just general content classification) signal to the device for local processing, not the other way around. If you're going to mandate that OS creators do anything it should be to implement a certain baseline level of (interoperable!) functionality as far as parental controls are concerned.

Second, the entire thing should be predicated on some metric such as MAU or revenue or combination thereof not on the exceedingly vague idea of a "free, publicly available code repository".