Ofcom, the UK regulator in charge of implementing the Online Safety Act (OSA), recently released new guidance for service providers. It is unclear how Ofcom intends to enforce the OSA against small communities like Woof.group. The potential costs of non-compliance are severe, and Woof.group does not have the funds to mount a legal defense should Ofcom choose to prosecute. We may be blocked by, or forced to block, the UK.

The OSA has already triggered the shutdown of several community forums. Woof.group is at particular risk because we allow users to share and view a broad variety of content, including advanced mathematics, sewing, and pornography. We may also run afoul of the OSA's prohibition of “extreme pornography”. If the OSA applies to Woof.group, we believe most Fediverse instances will also be at risk.

Is Woof.group in Scope?

Woof.group is based in the US. However, the OSA covers service providers worldwide if they “have links with the United Kingdom”. The most relevant category for Woof.group, a “Part 3 service”, is defined in part 2, section 4:

(5) For the purposes of subsection (2), a user-to-user service or a search service “has links with the United Kingdom” if—

(a) the service has a significant number of United Kingdom users, or

(b) United Kingdom users form one of the target markets for the service (or the only target market).

Woof.group has ~740 monthly active local users—that is to say, people with an account on Woof.group itself. We have 1531 local users with logged IP addresses. Of those, 185 have an IP which resolves to a “GB” country code. There are likely some UK people who access Woof.group content via RSS readers, the public web interface, the API, or via federation. For a number of reasons (e.g. automated crawlers, NATs, the difficulty of mapping requests to human beings, federation dynamics, etc.) we have no meaningful way to measure how many UK people fall into this category.

Is 185+ people, or on the order of 12% of our registered users, “significant? We have no idea. However, Ofcom indicates that the OSA will cover overseas ... services run by micro businesses.

We believe the UK does not form a “target market” for Woof.group. Woof.group does not sell anything to users or third parties and does not run advertisements. We provide a free community service, and are supported entirely by donations.

(6) For the purposes of subsection (2), a user-to-user service or a search service also “has links with the United Kingdom” if—

(a) the service is capable of being used in the United Kingdom by individuals, and

(b) there are reasonable grounds to believe that there is a material risk of significant harm to individuals in the United Kingdom presented by—

(i) in the case of a user-to-user service, user-generated content present on the service or (if the service includes a search engine) search content of the service;

We are unsure whether Woof.group meets this test. Like almost every web site, we are capable of being used by individuals in the UK. We do not believe our content poses a “material risk of significant harm” to anyone. However, the Online Safety Act goes to great lengths to define pornography (section 61.2) as “harmful to children”. Is that risk “material”, and is the harm of pornography “significant”? We don't know.

Age Verification

Per Ofcom's Statement on Age Assurance and Children's Access,

[A]ll services which allow pornography must have highly effective age assurance in place by July 2025 at the latest to prevent children from accessing it. The Act imposes different deadlines on different types of provider. Services that display or publish their own pornographic content, including certain Generative AI tools, must begin taking steps immediately to introduce robust age checks. Services that host user-generated pornographic content must have fully implemented age checks by July.

Earlier this month, Woof.group wrote to Ofcom to request clarification about legal risks and whether Ofcom was likely to enforce the OSA against small web forums. Ofcom's response reiterated this guidance:

Please note that if your service allows pornography, it will need to use highly effective age assurance to prevent children from accessing that content.

Woof.group does not allow members under 18 years of age. We take aggressive moderation action, including referral to law enforcement, for instances of CSAM. However, performing the “highly effective age assurance” required by the OSA is essentially impossible. Mastodon, the software we run, has no concept of age verification. We would need to pay a third-party service to perform age verification of our users, fork Mastodon, disable federation and all public interfaces, integrate that age verification service, and test and maintain our fork indefinitely. Woof.group runs on a shoestring budget and volunteer hours. We do not have the funds, technical expertise, or engineering time to enact these measures. Maintaining a fork would make it significantly harder to deploy upstream security patches.

Even if we could comply, doing so would break functionality our members and friends on other instances depend on. Nor will Woof.group ban pornography: we believe in the expression of sexuality, and in particular queer leathersex, as a public good. Our paintings, our family portraits, our videos of floggings and marches, our thirst traps and sex work are at the vital heart of queer culture. Woof.group exists to make these things possible, not to repress them.

Extreme Pornography

The OSA also proscribes “extreme pornography”. Until recently, the UK banned a long list of our favorites, including spanking, caning, aggressive whipping, physical or verbal abuse (regardless of consent), physical restraint, female ejaculation, watersports, and fisting. Ofcom's Illegal Content Judgement Guidance defines extreme pornography on pages 158-160. It forbids realistic, “grossly offensive, disgusting or otherwise of an obscene character” images of certain types of acts. “Grossly offensive” and “obscene” are “given [their] ordinary meaning[s]“. We do not know how to apply these terms practically.

Proscribed acts include any “which results, or is likely to result, in serious injury to a person’s anus, breasts or genitals”. It is unclear what constitutes a serious injury. Is a chest-punching or branding scene against the rules? CBT? How will a UK court evaluate the safety of fisting?

The guidance also proscribes acts which threaten a person's life:

‘Acts which threaten a person’s life’ mean acts which depict physical endangerment with a material risk of death. Non exhaustive examples include explicit and realistic hanging, strangulation, suffocation and causing life threatening injury.

It is perfectly safe to press a hand over someone's mouth for the five seconds it takes to snap a photograph. Does the resulting image depict “suffocation”? Leatherfolk would likely judge such an image to have a vanishingly small chance of death. Will Ofcom and the courts rule similarly?

The guidance also bans images of non-consensual penetration. How do providers establish a lack of consent? Paragraph 10.17 explains that any user report qualifies:

A user report which suggests that the content depicts non-consensual acts should be taken as reasonable grounds to believe that there was no consent, unless there is evidence to the contrary.

This raises the prospect that images of events which were consented to in real life, and which a reasonable leather audience would implicitly understand as consensual, could be judged non-consensual on the basis of an anonymous third party report. This seems a clear vector for harassment. How are moderators to establish evidence to the contrary? Can we simply ask the poster if the media in question was actually consensual? Do we need to secure affidavits from anyone who posts images of penetrative sex?

Can Fediverse Instances Even Comply?

The Online Safety Act assumes services know what human beings are using their services, where they are located, and can control their access. Services which require a login to view content can sort of verify the ages of logged in users. This is how the Online Safety Act imagines a “child” (legally, any person under 18) might access pornography hosted on a Mastodon instance, like mastodon.social:

One might imagine mastodon.social (or any other instance) could comply with the OSA's regulations on pornography by forcing logged-in users to go through an age-assurance process, somehow finding a way to pay for it, defining a new kind of metadata on posts which identifies pornography (or other content “harmful to children” under the OSA), figuring out a way to federate that metadata via ActivityPub, forcing local and remote users to tag their content appropriately (an enormous moderation burden)—look, we all know this is not realistic, but someone might at least pretend.

Even if this were possible, this is not how Fediverse instances work. Instances generally have public web pages for much of their content, which can be viewed by anyone regardless of whether they have an account. There are RSS feeds which anyone can subscribe to; again, no login required. There are also public API endpoints which anyone on the internet could use to request content.

There is no way to establish the age of any of these users. Each instance allowing pornography would need to shut down its public API, RSS feeds, and public web pages. But this would also not be sufficient, because Fediverse instances are federated using the ActivityPub protocol. This is the entire point of the Fediverse. People on Woof.group can follow people on Mastodon.social, who can favorite posts on Pixelfed.social, who can comment on photos posted on Woof.group. A 17-year old could create an account on some other instance which does not perform age verification, and follow a porn account on mastodon.social from there. Or they could run their own instance—teens run all kinds of servers.

There is no way for a Fediverse instance to tell whether all the users of another instance are over 18. Instances cannot simply declare this fact: Ofcom is clear that self-attestation is not sufficient for age assurance. Even if the other instance performed age assurance, it would still need to shut down its own public API, RSS feeds, and web pages.

When pornography is federated from one instance to another, it is not clear whether the OSA would consider the originating instance, the receiving instance, or both to be illegal. If services are expected to robustly deny access to children, they might be required to disable federation entirely.

Plans

The OSA's restrictions on user-to-user pornography takes effect in July. However, many of the OSA's other provisions—like performing detailed risk assessments and submitting them to Ofcom, come into effect in on March 16. We must decide on a course of action by that time.

Woof.group is still attempting to figure out whether it is considered a regulated service under the OSA. We have written letters to Ofcom attempting to ascertain this fact, and to determine answers to some of the questions above; we await Ofcom's response. We are also attending an upcoming discussion with Ofcom.

Woof.group has already invested upwards of thirty hours reading the law, Ofcom's guidance, and corresponding with Ofcom and UK residents in an attempt to understand the law and devise a plan for compliance. There are literally thousands of pages of densely interlinked PDF guidance to review. We remain, like many others, hopelessly overwhelmed by the vagueness and complexity of the act.

If Woof.group is in scope, the potential penalties would be devastating. The UK could impose a fine of up to 18 million pounds or imprisonment. While we doubt the UK would attempt extradition of a US citizen, Woof.group's owner @aphyr visits the UK every few years and prefers his time behind bars to be voluntary and short-lived.

Some sites, like Wikipedia, intend to ignore the act and see what happens. However, Woof.group lacks the financial resources and time to mount a legal defense. It seems most likely we would be forced to block any access from IP addresses associated with the UK. Even if we take no action, Ofcom might order Woof.group banned by UK network providers.

If you are based in the UK, we recommend you export your data by March 15th in case we block access or are banned. You may also wish to ask your representatives for help.

If you run a web site or other kind of online service, you may wish to write Ofcom's Online Safety Team at OSengagement@ofcom.org.uk.

This letter (lightly edited for formatting and clarity) was sent to Ofcom's Online Safety Team on 2025-01-27 to clarify open questions regarding the Online Safety Act (OSA). The OSA appears to pose significant hazards to community forums, Fediverse instances, online art, and web infrastructure—for instance, hosting providers and object storage services like S3. Woof.group is trying to figure out whether we are a “regulated service” under the OSA, and if so, how to comply. Ofcom responded on 2025-02-05.

Dear Ofcom Online Safety Team,

I write with follow-up questions regarding the Online Safety Act and how it might pertain to Woof.group, a Mastodon instance of approximately seven hundred users. I have spent much of my recent nights and weekends reviewing hundreds of pages of Ofcom's guidance, the text of the act itself, and consulting with people in the UK in an attempt to understand what our risks might be and how we ought to comply. I have many questions which the guidance has yet to clarify, and would appreciate your specific insight. Your answers would also be of use to tens of thousands of other Fediverse operators who now find themselves in similar positions.

1. What constitutes a “significant number” of UK users?

Following further discussions with individuals more familiar with UK law, I am no longer certain what “a significant number” means. Woof.group has ~740 monthly active local users—that is to say, people with an account on woof.group itself. We have 1531 local users with logged IP addresses. Of those, 185 have at least one IP which resolves to a “GB” country code. There are likely some UK people who access woof.group content via RSS readers, the public web interface, the API, or via federation. For a number of reasons (e.g. automated crawlers, NATs, the difficulty of mapping requests to human beings, federation dynamics, etc.) we have no meaningful way to measure how many UK people fall into this category.

In Ofcom's judgement, does this constitute “a significant number”?

2. Do non-commercial, public-interest services have “target markets?”

Woof.group does not sell anything to users, or third parties, and does not run advertisements. We provide a free community service, and are supported entirely by donations denominated in US dollars. We are a US corporation, and until now, have had essentially nothing to say regarding the UK. I believe, and would like Ofcom to confirm, that the UK does not form “one of the target markets” for Woof.group.

3. Does pornography, or “extreme pornography”, constitute a “material risk of significant harm” to individuals in the UK?

I firmly believe that our user-created pornography poses little harm to anyone. However, the text of the OSA repeatedly refers to pornography as “harmful to children”, and Ofcom goes to great lengths to ban access to it. In Ofcom's judgement, does the presence of pornography on a service (which is, we stress, explicitly oriented towards 18+ individuals) pose “a material risk of significant harm”, for purposes of evaluating whether a service is regulated under the OSA? If not, does “extreme pornography” bring a service under scope?

4. What exactly is “extreme pornography”?

The OSA requires that “extreme pornography” be “grossly offensive” or “obscene”, which are “given [their] ordinary meaning[s]“. We are unsure how to establish whether material is grossly offensive or obscene, and would appreciate concrete examples, ideally with reference images.

We are aware that up until recently, physical restraint, watersports, female ejaculation, fisting, spanking, caning, aggressive whipping, and verbal or physical abuse, regardless of consent, were considered illegal pornography in the UK. Does Ofcom intend to ban these kinds of acts again? If not, which acts specifically?

The ICJG defines “extreme pornography” to include any act “which results, or is likely to result, in serious injury to a person’s anus, breasts or genitals”. Does this include fisting? Sounding? Piercing? Punching? Branding? Cutting? Ball beating? Where does the threshold for “serious injury” fall—light or heavy bruising? Abrasion? Swelling? Needle punctures? “Hamburger back”? Scarring? As SM practitioners, we are used to doing painful, scary-looking things to breasts, anuses, and genitals which are nevertheless quite safe and recoverable. However, we are unclear as to how Ofcom and UK courts would interpret those acts.

The ICJG also bans “acts which depict physical endangerment with a material risk of death” including “hanging, strangulation, suffocation and causing life threatening injury.” Is an image of a man's gloved hands over the mouth and nose of another “suffocation”? What about gripping the neck firmly, a tightened collar, or a headlock? An oven bag over the head? Leatherfolk know that these acts and images of them can be arranged with essentially no risk of death. Will Ofcom and the courts agree?

Would, for example, Sotheby's images of Robert Mapplethorpe's “X Portfolio” be considered grossly offensive or obscene? Are its images of scars, needles through nipples, mouth-filling gags, fisting, sounding, and bloody genitals, “extreme pornography”? Will Ofcom fine Sotheby's for publishing this media? Can they still offer it for auction?

5. How are we to interpret reports of non-consensual imagery?

Paragraph 10.17 of the ICJG indicates that “[a] user report which suggests that the content depicts non-consensual acts should be taken as reasonable grounds to believe that there was no consent, unless there is evidence to the contrary.” Suppose a user has consensual penetrative sex, uploads a photograph of that sex to Woof.group, and an anonymous user from (e.g.) another Mastodon instance files a moderation report stating “this is not consensual”. How do moderators establish whether there is evidence to the contrary? Is a statement from the user who posted the image sufficient? If not, does this provide a harassment vector by which anyone can take down posts or accounts by flooding the provider with reports that material is non-consensual?

6. Must services which allow pornography take down public endpoints?

Most Mastodon instances, like Woof.group and Mastodon.social, allow pornography. Almost without exception, these instances also come with public HTTP endpoints which do not require any kind of login or session to access. As shown in the attached image, there are public web pages, RSS feeds, and API endpoints by which users could access material. These users might be under 18 years of age—as with any public HTTP endpoint, there is simply no way to know. Are instances which allow pornography required to take down their public web pages, RSS feeds, and APIs?

7. Must services which allow pornography deny federation?

Woof.group, like most Mastodon servers, is a part of the Fediverse: a loose network of tens of thousands of instances, each run by different people, which exchange content via the ActivityPub protocol. These instances run all kinds of software: Mastodon, Pixelfed, Akkoma, Lemmy, and so on. Just like email, users on one instance can follow, view posts from, and interact with users on other instances.

Even if an instance were to perform age assurance on its own users, it has no way to establish whether users on other instances are also adults. As shown in the attached image, a 17-year old user of mstdn.ca could see content from users on mastodon.social, which allows pornography. In this scenario, whom does Ofcom hold responsible?

A 17-year old person in the UK could run their own server; the technical skills required are within the reach of many teens. Imagine a UK 17-year old were to run an instance for themselves in a datacenter in Brazil. Through that single-user instance, they follow a user on Woof.group, and see pornography. Is the 17-year old liable for having run their own service which allowed them to view porn? Is Woof.group liable for having allowed another instance—which we have no knowledge or control over, and which appears to be located outside the UK—to federate with us?

In order to robustly deny access to children, it would seem that Fediverse instances which allow pornography must shut down federation altogether. What exactly is Ofcom's position on federation?

8. Does Ofcom expect public object stores like AWS S3 to ban pornography?

Object storage services like S3 or DigitalOcean Spaces offer companies and individuals the ability to store and, via public HTTP endpoints, access arbitrary files. Under the OSA, these appear to be file-sharing services with significant links to the UK. They are also used by many online services (including Woof.group) to store images and video, including pornography. For example, here is one of Mapplethorpe's photographs of fisting, available to any web browser, hosted on AWS S3.

Does Ofcom consider S3 (et al) to be in violation of the OSA? If so, how does Ofcom propose AWS respond? Requiring S3 to perform age assurance would break a huge part of the web: S3's public endpoints have no concept of user accounts, so both S3 and its users would be forced to fundamentally redesign. Banning object stores at the network level in the UK would also render a good swath of the web unusable. Banning pornography would require S3 to identify and remove it. What is Ofcom planning to do?

9. Will community services be given notification and a chance to respond prior to fines and imprisonment?

A good number of sites are planning to shut down due to Ofcom's threats to levy fines of up to 18 million, or to imprison operators. I ask again: can Ofcom promise to contact operators, and give them a chance to respond, before imposing crushing penalties? Doing so would significantly lower all of our stress levels.

10. How does Ofcom intend to enforce the OSA against US corporations and citizens?

Publishing pornography is constitutionally protected speech in the US, but Ofcom has been clear that it expects “overseas ... services run by micro-businesses” to be affected by (e.g.) age assurance rules. What would happen if Woof.group, as a US company, hosted in the US, with US owners, failed to comply with Ofcom's rules? How does Ofcom plan to enforce rulings against US entities?

As I am now orders of magnitude beyond the suggested four hours it should take to understand compliance obligations, I would very much appreciate your help.

Perplexedly yours,

—Kyle Kingsbury

Woof.group Announcements

2025-01-21 17:40:29

Assessing the Online Safety Act

Ofcom, the UK regulator in charge of implementing the Online Safety Act (OSA), recently released new guidance for service providers. It is unclear how Ofcom intends to enforce the OSA against small communities like Woof.group. The potential costs of non-compliance are severe, and Woof.group does not have the funds to mount a legal defense should Ofcom choose to prosecute. We may be blocked by, or forced to block, the UK.

The OSA has already triggered the shutdown of several community forums. Woof.group is at particular risk because we allow users to share and view a broad variety of content, including advanced mathematics, sewing, and pornography. We may also run afoul of the OSA's prohibition of “extreme pornography”. If the OSA applies to Woof.group, we believe most Fediverse instances will also be at risk.

Is Woof.group in Scope?

Woof.group is based in the US. However, the OSA covers service providers worldwide if they “have links with the United Kingdom”. The most relevant category for Woof.group, a “Part 3 service”, is defined in part 2, section 4:

(5) For the purposes of subsection (2), a user-to-user service or a search service “has links with the United Kingdom” if—

(a) the service has a significant number of United Kingdom users, or

(b) United Kingdom users form one of the target markets for the service (or the only target market).

Woof.group has ~740 monthly active local users—that is to say, people with an account on Woof.group itself. We have 1531 local users with logged IP addresses. Of those, 185 have an IP which resolves to a “GB” country code. There are likely some UK people who access Woof.group content via RSS readers, the public web interface, the API, or via federation. For a number of reasons (e.g. automated crawlers, NATs, the difficulty of mapping requests to human beings, federation dynamics, etc.) we have no meaningful way to measure how many UK people fall into this category.

Is 185+ people, or on the order of 12% of our registered users, “significant? We have no idea. However, Ofcom indicates that the OSA will cover overseas ... services run by micro businesses.

We believe the UK does not form a “target market” for Woof.group. Woof.group does not sell anything to users or third parties and does not run advertisements. We provide a free community service, and are supported entirely by donations.

(6) For the purposes of subsection (2), a user-to-user service or a search service also “has links with the United Kingdom” if—

(a) the service is capable of being used in the United Kingdom by individuals, and

(b) there are reasonable grounds to believe that there is a material risk of significant harm to individuals in the United Kingdom presented by—

(i) in the case of a user-to-user service, user-generated content present on the service or (if the service includes a search engine) search content of the service;

We are unsure whether Woof.group meets this test. Like almost every web site, we are capable of being used by individuals in the UK. We do not believe our content poses a “material risk of significant harm” to anyone. However, the Online Safety Act goes to great lengths to define pornography (section 61.2) as “harmful to children”. Is that risk “material”, and is the harm of pornography “significant”? We don't know.

Age Verification

Per Ofcom's Statement on Age Assurance and Children's Access,

[A]ll services which allow pornography must have highly effective age assurance in place by July 2025 at the latest to prevent children from accessing it. The Act imposes different deadlines on different types of provider. Services that display or publish their own pornographic content, including certain Generative AI tools, must begin taking steps immediately to introduce robust age checks. Services that host user-generated pornographic content must have fully implemented age checks by July.

Earlier this month, Woof.group wrote to Ofcom to request clarification about legal risks and whether Ofcom was likely to enforce the OSA against small web forums. Ofcom's response reiterated this guidance:

Please note that if your service allows pornography, it will need to use highly effective age assurance to prevent children from accessing that content.

Woof.group does not allow members under 18 years of age. We take aggressive moderation action, including referral to law enforcement, for instances of CSAM. However, performing the “highly effective age assurance” required by the OSA is essentially impossible. Mastodon, the software we run, has no concept of age verification. We would need to pay a third-party service to perform age verification of our users, fork Mastodon, disable federation and all public interfaces, integrate that age verification service, and test and maintain our fork indefinitely. Woof.group runs on a shoestring budget and volunteer hours. We do not have the funds, technical expertise, or engineering time to enact these measures. Maintaining a fork would make it significantly harder to deploy upstream security patches.

Even if we could comply, doing so would break functionality our members and friends on other instances depend on. Nor will Woof.group ban pornography: we believe in the expression of sexuality, and in particular queer leathersex, as a public good. Our paintings, our family portraits, our videos of floggings and marches, our thirst traps and sex work are at the vital heart of queer culture. Woof.group exists to make these things possible, not to repress them.

Extreme Pornography

The OSA also proscribes “extreme pornography”. Until recently, the UK banned a long list of our favorites, including spanking, caning, aggressive whipping, physical or verbal abuse (regardless of consent), physical restraint, female ejaculation, watersports, and fisting. Ofcom's Illegal Content Judgement Guidance defines extreme pornography on pages 158-160. It forbids realistic, “grossly offensive, disgusting or otherwise of an obscene character” images of certain types of acts. “Grossly offensive” and “obscene” are “given [their] ordinary meaning[s]“. We do not know how to apply these terms practically.

Proscribed acts include any “which results, or is likely to result, in serious injury to a person’s anus, breasts or genitals”. It is unclear what constitutes a serious injury. Is a chest-punching or branding scene against the rules? CBT? How will a UK court evaluate the safety of fisting?

The guidance also proscribes acts which threaten a person's life:

‘Acts which threaten a person’s life’ mean acts which depict physical endangerment with a material risk of death. Non exhaustive examples include explicit and realistic hanging, strangulation, suffocation and causing life threatening injury.

It is perfectly safe to press a hand over someone's mouth for the five seconds it takes to snap a photograph. Does the resulting image depict “suffocation”? Leatherfolk would likely judge such an image to have a vanishingly small chance of death. Will Ofcom and the courts rule similarly?

The guidance also bans images of non-consensual penetration. How do providers establish a lack of consent? Paragraph 10.17 explains that any user report qualifies:

A user report which suggests that the content depicts non-consensual acts should be taken as reasonable grounds to believe that there was no consent, unless there is evidence to the contrary.

This raises the prospect that images of events which were consented to in real life, and which a reasonable leather audience would implicitly understand as consensual, could be judged non-consensual on the basis of an anonymous third party report. This seems a clear vector for harassment. How are moderators to establish evidence to the contrary? Can we simply ask the poster if the media in question was actually consensual? Do we need to secure affidavits from anyone who posts images of penetrative sex?

Can Fediverse Instances Even Comply?

The Online Safety Act assumes services know what human beings are using their services, where they are located, and can control their access. Services which require a login to view content can sort of verify the ages of logged in users. This is how the Online Safety Act imagines a “child” (legally, any person under 18) might access pornography hosted on a Mastodon instance, like mastodon.social:

One might imagine mastodon.social (or any other instance) could comply with the OSA's regulations on pornography by forcing logged-in users to go through an age-assurance process, somehow finding a way to pay for it, defining a new kind of metadata on posts which identifies pornography (or other content “harmful to children” under the OSA), figuring out a way to federate that metadata via ActivityPub, forcing local and remote users to tag their content appropriately (an enormous moderation burden)—look, we all know this is not realistic, but someone might at least pretend.

Even if this were possible, this is not how Fediverse instances work. Instances generally have public web pages for much of their content, which can be viewed by anyone regardless of whether they have an account. There are RSS feeds which anyone can subscribe to; again, no login required. There are also public API endpoints which anyone on the internet could use to request content.

There is no way to establish the age of any of these users. Each instance allowing pornography would need to shut down its public API, RSS feeds, and public web pages. But this would also not be sufficient, because Fediverse instances are federated using the ActivityPub protocol. This is the entire point of the Fediverse. People on Woof.group can follow people on Mastodon.social, who can favorite posts on Pixelfed.social, who can comment on photos posted on Woof.group. A 17-year old could create an account on some other instance which does not perform age verification, and follow a porn account on mastodon.social from there. Or they could run their own instance—teens run all kinds of servers.

There is no way for a Fediverse instance to tell whether all the users of another instance are over 18. Instances cannot simply declare this fact: Ofcom is clear that self-attestation is not sufficient for age assurance. Even if the other instance performed age assurance, it would still need to shut down its own public API, RSS feeds, and web pages.

When pornography is federated from one instance to another, it is not clear whether the OSA would consider the originating instance, the receiving instance, or both to be illegal. If services are expected to robustly deny access to children, they might be required to disable federation entirely.

Plans

The OSA's restrictions on user-to-user pornography takes effect in July. However, many of the OSA's other provisions—like performing detailed risk assessments and submitting them to Ofcom, come into effect in on March 16. We must decide on a course of action by that time.

Woof.group is still attempting to figure out whether it is considered a regulated service under the OSA. We have written letters to Ofcom attempting to ascertain this fact, and to determine answers to some of the questions above; we await Ofcom's response. We are also attending an upcoming discussion with Ofcom.

Woof.group has already invested upwards of thirty hours reading the law, Ofcom's guidance, and corresponding with Ofcom and UK residents in an attempt to understand the law and devise a plan for compliance. There are literally thousands of pages of densely interlinked PDF guidance to review. We remain, like many others, hopelessly overwhelmed by the vagueness and complexity of the act.

If Woof.group is in scope, the potential penalties would be devastating. The UK could impose a fine of up to 18 million pounds or imprisonment. While we doubt the UK would attempt extradition of a US citizen, Woof.group's owner @aphyr visits the UK every few years and prefers his time behind bars to be voluntary and short-lived.

Some sites, like Wikipedia, intend to ignore the act and see what happens. However, Woof.group lacks the financial resources and time to mount a legal defense. It seems most likely we would be forced to block any access from IP addresses associated with the UK. Even if we take no action, Ofcom might order Woof.group banned by UK network providers.

If you are based in the UK, we recommend you export your data by March 15th in case we block access or are banned. You may also wish to ask your representatives for help.

If you run a web site or other kind of online service, you may wish to write Ofcom's Online Safety Team at OSengagement@ofcom.org.uk.

Wikipedia will not perform Online Safety Bill age checks

It says age verification would contravene its commitment to collect minimal data from readers.

^{By Chris Vallance & Tom Gerken (BBC News)}

Updates on the OSA

In today's livestream (58:00), Ofcom's James Proudfoot told service providers, “If people reach out, what's useful is we can talk to you a bit more specifically about your service, and the regulations... it's a lot easier to talk about through a one-on-one conversation.” His colleague Alice Glossop chimed in: “If you reach out to us, we want to have conversations about what applies to your service.”

Woof.group has been trying to have these conversations with Ofcom since mid-January. Yesterday, we received a response to our most recent questions regarding the Online Safety Act. Ofcom informs us that they will not provide specific instructions for service providers, and declined to address all but one of our questions. In this post, we attempt to understand these non-answers, and summarize key warnings in today's OSA livestream. We follow up with thoughts on where this leaves Woof.group and the other thirty-thousand-odd Fediverse instances which may be illegal in the UK come July.

Ofcom's Response to our Questions

Dear Kyle,

Thank you for your message and feedback. We recognise that navigating the requirements of the online safety regime can be challenging and we have developed a series of quick guides to our online safety regulation, linked in our previous correspondence. These guides are designed to be accessible to services of all sizes and are intended to help services understand what they need to do to meet their duties under the Online Safety Act.

As the regulator we are not able to provide individual service providers with bespoke instructions, but by following Ofcom guidance and Codes, providers of online services will be able to assess the risks their services pose to their users, in order to establish what action they may need to take to comply with their Online Safety duties under the Act.

In relation to pornographic content, the duties in the Act are set by UK Government and apply to all services in scope regardless of size. If a service is in scope of the Online Safety Act and features pornography, it will need to use highly effective age assurance to prevent children from accessing that content. It is for the provider to decide how best to do this and which method of age assurance to implement. This could either be all areas of the service, or specific areas of the service which allow the pornographic content. Where a service cannot be accessed by UK users, it would not be in scope of the Act.

As we mentioned in our previous email, we will take a reasonable approach to enforcement with smaller services that present low risk to UK users, only taking action where it is proportionate and appropriate, and targeted only at cases in which action is needed to protect UK users from serious harm. We will also engage with services to explain our concerns and, in most cases, give them an opportunity to remedy our concerns before moving to formal action.

We have also recently released more helpful resources that we hope will be a support to you:

• We have published our first online safety industry bulletin of 2025. As the UK’s online safety regime is now in force, sites and apps must act to better protect users online, especially children. This bulletin sets out what services must do and when and the support and resources we will provide to help you comply with your duties and secure your user’s safety. It also explains the types of action we plan to take to drive better online safety outcomes.
• Our online safety regulations toolkit is now available on the Ofcom website. The toolkit provides a step-by-step guide to help you complete an assessment for the risks of illegal content on your platform. It will also help you to comply with your safety, record-keeping and review duties.
• We have also published a notice about Ofcom’s access to services, for transparency around our ways of working. This notice outlines that we may access services regulated under the Online Safety Act from time to time as part of our work.

Best, Online Safety Team

Considerations

Ofcom carefully avoided answering almost all of our questions. They declined to say whether ~185 users was a “significant number”. Several other participants in Ofcom's livestreams also asked what a significant number meant. Every time, Ofcom responded obliquely: there are no numeric thresholds, a significant number could be “small”, Ofcom could target “a one-man band”, and providers are expected to have a robust justification for deciding they do not have a significant number of UK users. It is unclear how anyone could make a robust justification given this nebulous guidance. In their letter, Ofcom also declined to say whether non-commercial services have target markets, or whether pornography poses a “material risk of significant harm”. In short, we have no answer as to whether Woof.group or other Fediverse instances are likely to fall in scope of the OSA.

Ofcom declined to clarify what kinds of acts would qualify as “extreme pornography”, or the evidentiary basis providers may use in adjudicating reports of non-consensual imagery. This makes it difficult, if not impossible, to operationalize the OSA into actionable policy for our moderators.

Woof.group, like almost every Fediverse instance, allows pornography. At present Woof.group federates with thirty-one thousand different instances; these domains therefore also allow their users to see pornography. If these instances are in scope of the OSA, they are legally required to implement highly effective age assurance by July. Ofcom declined to say whether these instances must disable their public web pages, RSS feeds, or APIs. Ofcom also declined to say whether they must disable federation. Similarly, Ofcom declined to say whether file-sharing services like S3, which host an immense volume of porn over public HTTP endpoints, would be blocked come July. It is frankly shocking that Ofcom has not considered this latter question: resources from S3 et al are essential for the operation of much of the modern internet.

Ofcom did offer a positive response to one of our questions: promising to—in most cases—engage with services prior to initiating formal action. This would have been reassuring were it not immediately contradicted by Ofcom's enforcement representatives in today's livestream. Finally, Ofcom declined to elaborate on how they might attempt to enforce UK law against US entities.

What Is Going On Here?

First: none of us are lawyers, and none of this is legal advice.

From Ofcom's responses to Woof.group, and in the livestream Q&A sessions this week, it appears that Ofcom is conscientiously avoiding telling web sites what they need to know to comply with the law. Are services in scope? We can't say. What kind of porn do we need to block? No idea. Is Fediverse as we know it illegal? Who knows! The fact that Ofcom has produced several thousand pages of guidance and yet cannot answer simple questions like “are we likely to be in scope” is striking. We are scrambling to interpret this behavior.

To some extent, Ofcom may not understand how this part of the internet works. Their policy documents and presentations almost exclusively refer to impact on businesses. There seems to be little awareness that much of the web is run by volunteers, individuals, and small, informal coalitions. We have yet to find any policy guidance for federated services, or discussion of the act's impact on RSS feeds and public APIs. Perhaps nobody at Ofcom realized the S3 issue until last week, and now they have to spend a year gaming out how they're going to poke the Amazon Legal Bear.

Another interpretation is that Ofcom, as a regulator, wishes to reserve maximal strategic latitude for future enforcement actions. If they declare a ten-user site “not a significant number”, and a nine-user CSAM ring pops up, Ofcom might find themselves in a bind. On the other hand, if there truly are no real lower bounds, what is the point of having “significant number” language at all? Expecting every five-person gardening forum or neighborhood blog on the planet to perform a seventeen-point formal risk assessment at regular intervals for N foreign governments is patently absurd.

A third possibility is that Ofcom doesn't actually know the answers to these questions. After all, the law doesn't say what “significant” means. And the determination of legality falls to the UK court system, not Ofcom itself. Per the ICJG:

A provider is not usually required to accept the opinions of a third party as to whether content is illegal content. Only a judgment of a UK court is binding on it in making this determination.

The OSA is sweeping new legislation, and there is no body of case law to draw on for the new offenses it defines. Ofcom could be just as much in the dark as us, and planning to grope their way to the fractal boundaries of “extreme pornography” and “in-scope services” through a series of enforcement actions and protracted legal proceedings.

Today's Livestream on Pornography

While Ofcom has avoided our questions, their comments in today's livestream make the picture sound increasingly bleak for Fediverse instances and other small communities. At 6:58, Glossop explained that any pornography on a service would require age assurance—that is to say, facial scanning, verification of bank records, etc.

The act does designate pornographic content as a type of content that is harmful to children and that children need to be prevented from accessing, and that applies across the board... whether it's just one small part of a very broad service that you offer.

And at 35:32, she reiterated:

Whether you are an adult service that only provides that kind of content, or whether you're a social media service that doesn't prohibit that kind of content, the requirement is the same: to use age assurance.

At 8:50, she explained that the presence of pornography on a service, even if the service were quite small and not based in the UK, could cause it to have a “significant number” of UK users, and therefore fall in scope of the OSA.

Importantly, it's not about where the service provider is based, as a company. It's actually about whether your service has UK users on it.... The terminology in the act is a “significant number” of UK users. And in terms of what “significant” means here, it's not just a big number, or a proportionately big number in relation to your total service. It could also mean significant if the level of harm on that service is particularly high, and given the scope of the act is about the protection of children, and the emphasis on types of harmful content including pornography, it is kind of generally likely that a service would be considered to have a “significant number” of UK users in the scope of that question.

Are small services like indie porn studios exempt because of their small scale? Absolutely not. At 38:25, Ofcom explained:

The requirement is if you allow this type of content, you need to use highly effective age assurance to prevent children from accessing it. The part of Ofcom's remit of being a proportionate regulator (which we absolutely are) doesn't have a role in saying “Oh, well maybe you don't have to do highly effective age assurance.” That requirement remains the same. Where our proportionality comes in is thinking about what process you take to implement your highly effective age assurance.... The act makes clear that this is now a cost of business to do that type of content and provide that type of content.

Ofcom's James Proudfoot confirmed at 32:50 that Ofcom intends to go after small web sites that allow pornography:

We are conscious that with highly effective age assurance, everyone needs to implement it in order for this to work, and so we've taken that into account. We won't just be going for big sites, which you might see elsewhere, but also small and medium sites as well when it comes to enforcement action.

At 50:20, Ofcom explained that sites which allow users to view content without logging in could be expected to perform highly effective age assurance on each visitor. It is hard to envision requiring age assurance on public HTTP endpoints for a Mastodon instance—doing so would render the API and federation completely unusable.

If you've got a site that doesn't have any kind of login process, you might consider age-assuring each unique user and doing it each time.

Can sites wait for regulators to reach out before taking action? Ofcom's response to Woof.group said Ofcom would “engage with services to explain our concerns and, in most cases, give them an opportunity to remedy our concerns before moving to formal action.” However, Matthew Hoskings, of Ofcom's enforcement division, cast significant doubt on this picture at 53:45.

Question: When Ofcom notifies a site that they're in breach of the act, are they given a chance to put [age verification] in place by a deadline before being fined?

Hoskings: I think the answer is no. The duties come into force—part five is in force now, and part three comes into July. When we write to you to say you're in breach, that is, “You are in breach”. You need to take steps to be getting yourself compliant... Don't wait until you get that breach letter. Reach out to us, work with us, because once that breach letter is there that is the final, and that is when we start following with enforcement action.

Question: What would Ofcom say to sites that are delaying age assurance measures because none of their competitors have implemented it, and they don't want to be at a commercial disadvantage by complying?

Hoskings: This is across the board. We are looking at big players, we are focused across the industry, whether it be one-man bands, the smaller service, the big companies. We want a level playing field, and we are applying our powers proportionately and fairly.

What Do We Do Now?

We still don't know whether or not Woof.group is in-scope under the OSA. There seem to be two possible worlds:

1. Woof.group is not in scope of the OSA. We are unaffected.
2. Woof.group is in scope. Compliance with the OSA is obviously impossible. Since we (like some ~31,000 other instances) allow pornography, our only option would be to geoblock the UK. Luckily, Ofcom confirmed in yesterday's livestream that geoblocking would satisfy them.

There seems to be no point in performing risk assessments, reviewing content guidelines, collating evidence of illegal harms, producing written procedures, performing compliance training, or taking other compliance measures at this time. Either we aren't in scope and need not jump through these hoops, or we are in scope, must block the UK, and the question becomes similarly moot.

Do we block pre-emptively, or if and when Ofcom asks? This is the ethical question Woof.group's team, like other community forums, have been wrestling with. Ofcom would certainly like sites to take action immediately. As Hoskings warned:

Don't wait until it's too late. That's the message. Once you do get the breach letter, that is when it is too late. The time doesn't start ticking from then. The time is ticking from—for part five services, from January, part three from July.

Blocking pre-emptively might also influence the UK powers-that-be: Ofcom has said that they want the UK public to retain access to internet services, and if services go dark, that could generate political backlash. However, this only works if enough services go dark. Right now most sites seem completely unaware of their risks under the OSA; we face a collective action problem, and Woof.group is diminutive. More pressingly, geoblocking is guaranteed to cut off our existing UK users and many federated instances who are a cherished part of our community. We must balance a large-but-speculative benefit against a smaller, more closely-felt, and certain loss.

There is also the elephant in the room. What Ofcom is trying to do—place all pornography on the web behind robust age assurance—is obviously impossible. Ofcom has finite time, budget, enforcement personnel, and political goodwill. The internet is international, heterogenous, and full of human beings who enjoy sexual speech. Successful enforcement measures are likely to engender adaptive behavior: migration to less-policed platforms, VPNs, robust anonymity and encryption schemes, age assurance countermeasures, and so on. This is not an arms race I think anyone—Ofcom included—expects regulators to win. They may find the task so intractable that we, and other small community forums, never have to care.

We've been debating this internally at Woof.group, bouncing ideas off peers in the UK, and still haven't reached a conclusion. However we do want to share the information we have, and encourage others to evaluate risks and reach out to Ofcom themselves. Ofcom just announced a contact address for services that allow pornography, and it seems some thirty-one thousand of you now have a reason to get in touch: PornSupervision@ofcom.org.uk.

Woof.group Announcements

2025-01-28 14:48:43

Letter to Ofcom Regarding the Online Safety Act

This letter (lightly edited for formatting and clarity) was sent to Ofcom's Online Safety Team on 2025-01-27 to clarify open questions regarding the Online Safety Act (OSA). The OSA appears to pose significant hazards to community forums, Fediverse instances, online art, and web infrastructure—for instance, hosting providers and object storage services like S3. Woof.group is trying to figure out whether we are a “regulated service” under the OSA, and if so, how to comply. Ofcom responded on 2025-02-05.

Dear Ofcom Online Safety Team,

I write with follow-up questions regarding the Online Safety Act and how it might pertain to Woof.group, a Mastodon instance of approximately seven hundred users. I have spent much of my recent nights and weekends reviewing hundreds of pages of Ofcom's guidance, the text of the act itself, and consulting with people in the UK in an attempt to understand what our risks might be and how we ought to comply. I have many questions which the guidance has yet to clarify, and would appreciate your specific insight. Your answers would also be of use to tens of thousands of other Fediverse operators who now find themselves in similar positions.

1. What constitutes a “significant number” of UK users?

Following further discussions with individuals more familiar with UK law, I am no longer certain what “a significant number” means. Woof.group has ~740 monthly active local users—that is to say, people with an account on woof.group itself. We have 1531 local users with logged IP addresses. Of those, 185 have at least one IP which resolves to a “GB” country code. There are likely some UK people who access woof.group content via RSS readers, the public web interface, the API, or via federation. For a number of reasons (e.g. automated crawlers, NATs, the difficulty of mapping requests to human beings, federation dynamics, etc.) we have no meaningful way to measure how many UK people fall into this category.

In Ofcom's judgement, does this constitute “a significant number”?

2. Do non-commercial, public-interest services have “target markets?”

Woof.group does not sell anything to users, or third parties, and does not run advertisements. We provide a free community service, and are supported entirely by donations denominated in US dollars. We are a US corporation, and until now, have had essentially nothing to say regarding the UK. I believe, and would like Ofcom to confirm, that the UK does not form “one of the target markets” for Woof.group.

3. Does pornography, or “extreme pornography”, constitute a “material risk of significant harm” to individuals in the UK?

I firmly believe that our user-created pornography poses little harm to anyone. However, the text of the OSA repeatedly refers to pornography as “harmful to children”, and Ofcom goes to great lengths to ban access to it. In Ofcom's judgement, does the presence of pornography on a service (which is, we stress, explicitly oriented towards 18+ individuals) pose “a material risk of significant harm”, for purposes of evaluating whether a service is regulated under the OSA? If not, does “extreme pornography” bring a service under scope?

4. What exactly is “extreme pornography”?

The OSA requires that “extreme pornography” be “grossly offensive” or “obscene”, which are “given [their] ordinary meaning[s]“. We are unsure how to establish whether material is grossly offensive or obscene, and would appreciate concrete examples, ideally with reference images.

We are aware that up until recently, physical restraint, watersports, female ejaculation, fisting, spanking, caning, aggressive whipping, and verbal or physical abuse, regardless of consent, were considered illegal pornography in the UK. Does Ofcom intend to ban these kinds of acts again? If not, which acts specifically?

The ICJG defines “extreme pornography” to include any act “which results, or is likely to result, in serious injury to a person’s anus, breasts or genitals”. Does this include fisting? Sounding? Piercing? Punching? Branding? Cutting? Ball beating? Where does the threshold for “serious injury” fall—light or heavy bruising? Abrasion? Swelling? Needle punctures? “Hamburger back”? Scarring? As SM practitioners, we are used to doing painful, scary-looking things to breasts, anuses, and genitals which are nevertheless quite safe and recoverable. However, we are unclear as to how Ofcom and UK courts would interpret those acts.

The ICJG also bans “acts which depict physical endangerment with a material risk of death” including “hanging, strangulation, suffocation and causing life threatening injury.” Is an image of a man's gloved hands over the mouth and nose of another “suffocation”? What about gripping the neck firmly, a tightened collar, or a headlock? An oven bag over the head? Leatherfolk know that these acts and images of them can be arranged with essentially no risk of death. Will Ofcom and the courts agree?

Would, for example, Sotheby's images of Robert Mapplethorpe's “X Portfolio” be considered grossly offensive or obscene? Are its images of scars, needles through nipples, mouth-filling gags, fisting, sounding, and bloody genitals, “extreme pornography”? Will Ofcom fine Sotheby's for publishing this media? Can they still offer it for auction?

5. How are we to interpret reports of non-consensual imagery?

Paragraph 10.17 of the ICJG indicates that “[a] user report which suggests that the content depicts non-consensual acts should be taken as reasonable grounds to believe that there was no consent, unless there is evidence to the contrary.” Suppose a user has consensual penetrative sex, uploads a photograph of that sex to Woof.group, and an anonymous user from (e.g.) another Mastodon instance files a moderation report stating “this is not consensual”. How do moderators establish whether there is evidence to the contrary? Is a statement from the user who posted the image sufficient? If not, does this provide a harassment vector by which anyone can take down posts or accounts by flooding the provider with reports that material is non-consensual?

6. Must services which allow pornography take down public endpoints?

Most Mastodon instances, like Woof.group and Mastodon.social, allow pornography. Almost without exception, these instances also come with public HTTP endpoints which do not require any kind of login or session to access. As shown in the attached image, there are public web pages, RSS feeds, and API endpoints by which users could access material. These users might be under 18 years of age—as with any public HTTP endpoint, there is simply no way to know. Are instances which allow pornography required to take down their public web pages, RSS feeds, and APIs?

7. Must services which allow pornography deny federation?

Woof.group, like most Mastodon servers, is a part of the Fediverse: a loose network of tens of thousands of instances, each run by different people, which exchange content via the ActivityPub protocol. These instances run all kinds of software: Mastodon, Pixelfed, Akkoma, Lemmy, and so on. Just like email, users on one instance can follow, view posts from, and interact with users on other instances.

Even if an instance were to perform age assurance on its own users, it has no way to establish whether users on other instances are also adults. As shown in the attached image, a 17-year old user of mstdn.ca could see content from users on mastodon.social, which allows pornography. In this scenario, whom does Ofcom hold responsible?

A 17-year old person in the UK could run their own server; the technical skills required are within the reach of many teens. Imagine a UK 17-year old were to run an instance for themselves in a datacenter in Brazil. Through that single-user instance, they follow a user on Woof.group, and see pornography. Is the 17-year old liable for having run their own service which allowed them to view porn? Is Woof.group liable for having allowed another instance—which we have no knowledge or control over, and which appears to be located outside the UK—to federate with us?

In order to robustly deny access to children, it would seem that Fediverse instances which allow pornography must shut down federation altogether. What exactly is Ofcom's position on federation?

8. Does Ofcom expect public object stores like AWS S3 to ban pornography?

Object storage services like S3 or DigitalOcean Spaces offer companies and individuals the ability to store and, via public HTTP endpoints, access arbitrary files. Under the OSA, these appear to be file-sharing services with significant links to the UK. They are also used by many online services (including Woof.group) to store images and video, including pornography. For example, here is one of Mapplethorpe's photographs of fisting, available to any web browser, hosted on AWS S3.

Does Ofcom consider S3 (et al) to be in violation of the OSA? If so, how does Ofcom propose AWS respond? Requiring S3 to perform age assurance would break a huge part of the web: S3's public endpoints have no concept of user accounts, so both S3 and its users would be forced to fundamentally redesign. Banning object stores at the network level in the UK would also render a good swath of the web unusable. Banning pornography would require S3 to identify and remove it. What is Ofcom planning to do?

9. Will community services be given notification and a chance to respond prior to fines and imprisonment?

A good number of sites are planning to shut down due to Ofcom's threats to levy fines of up to 18 million, or to imprison operators. I ask again: can Ofcom promise to contact operators, and give them a chance to respond, before imposing crushing penalties? Doing so would significantly lower all of our stress levels.

10. How does Ofcom intend to enforce the OSA against US corporations and citizens?

Publishing pornography is constitutionally protected speech in the US, but Ofcom has been clear that it expects “overseas ... services run by micro-businesses” to be affected by (e.g.) age assurance rules. What would happen if Woof.group, as a US company, hosted in the US, with US owners, failed to comply with Ofcom's rules? How does Ofcom plan to enforce rulings against US entities?

---

As I am now orders of magnitude beyond the suggested four hours it should take to understand compliance obligations, I would very much appreciate your help.

Perplexedly yours,

—Kyle Kingsbury

Online safety

Under the Online Safety Act, Ofcom's job is to make online services safer for the people who use them. We make sure companies have effective systems in place to protect users from harm.

^{www.ofcom.org.uk}