Ofcom, the UK regulator in charge of implementing the Online Safety Act (OSA), recently released new guidance for service providers. It is unclear how Ofcom intends to enforce the OSA against small communities like Woof.group. The potential costs of non-compliance are severe, and Woof.group does not have the funds to mount a legal defense should Ofcom choose to prosecute. We may be blocked by, or forced to block, the UK.

The OSA has already triggered the shutdown of several community forums. Woof.group is at particular risk because we allow users to share and view a broad variety of content, including advanced mathematics, sewing, and pornography. We may also run afoul of the OSA's prohibition of “extreme pornography”. If the OSA applies to Woof.group, we believe most Fediverse instances will also be at risk.

Is Woof.group in Scope?

Woof.group is based in the US. However, the OSA covers service providers worldwide if they “have links with the United Kingdom”. The most relevant category for Woof.group, a “Part 3 service”, is defined in part 2, section 4:

(5) For the purposes of subsection (2), a user-to-user service or a search service “has links with the United Kingdom” if—

(a) the service has a significant number of United Kingdom users, or

(b) United Kingdom users form one of the target markets for the service (or the only target market).

Woof.group has ~740 monthly active local users—that is to say, people with an account on Woof.group itself. We have 1531 local users with logged IP addresses. Of those, 185 have an IP which resolves to a “GB” country code. There are likely some UK people who access Woof.group content via RSS readers, the public web interface, the API, or via federation. For a number of reasons (e.g. automated crawlers, NATs, the difficulty of mapping requests to human beings, federation dynamics, etc.) we have no meaningful way to measure how many UK people fall into this category.

Is 185+ people, or on the order of 12% of our registered users, “significant? We have no idea. However, Ofcom indicates that the OSA will cover overseas ... services run by micro businesses.

We believe the UK does not form a “target market” for Woof.group. Woof.group does not sell anything to users or third parties and does not run advertisements. We provide a free community service, and are supported entirely by donations.

(6) For the purposes of subsection (2), a user-to-user service or a search service also “has links with the United Kingdom” if—

(a) the service is capable of being used in the United Kingdom by individuals, and

(b) there are reasonable grounds to believe that there is a material risk of significant harm to individuals in the United Kingdom presented by—

(i) in the case of a user-to-user service, user-generated content present on the service or (if the service includes a search engine) search content of the service;

We are unsure whether Woof.group meets this test. Like almost every web site, we are capable of being used by individuals in the UK. We do not believe our content poses a “material risk of significant harm” to anyone. However, the Online Safety Act goes to great lengths to define pornography (section 61.2) as “harmful to children”. Is that risk “material”, and is the harm of pornography “significant”? We don't know.

Age Verification

Per Ofcom's Statement on Age Assurance and Children's Access,

[A]ll services which allow pornography must have highly effective age assurance in place by July 2025 at the latest to prevent children from accessing it. The Act imposes different deadlines on different types of provider. Services that display or publish their own pornographic content, including certain Generative AI tools, must begin taking steps immediately to introduce robust age checks. Services that host user-generated pornographic content must have fully implemented age checks by July.

Earlier this month, Woof.group wrote to Ofcom to request clarification about legal risks and whether Ofcom was likely to enforce the OSA against small web forums. Ofcom's response reiterated this guidance:

Please note that if your service allows pornography, it will need to use highly effective age assurance to prevent children from accessing that content.

Woof.group does not allow members under 18 years of age. We take aggressive moderation action, including referral to law enforcement, for instances of CSAM. However, performing the “highly effective age assurance” required by the OSA is essentially impossible. Mastodon, the software we run, has no concept of age verification. We would need to pay a third-party service to perform age verification of our users, fork Mastodon, disable federation and all public interfaces, integrate that age verification service, and test and maintain our fork indefinitely. Woof.group runs on a shoestring budget and volunteer hours. We do not have the funds, technical expertise, or engineering time to enact these measures. Maintaining a fork would make it significantly harder to deploy upstream security patches.

Even if we could comply, doing so would break functionality our members and friends on other instances depend on. Nor will Woof.group ban pornography: we believe in the expression of sexuality, and in particular queer leathersex, as a public good. Our paintings, our family portraits, our videos of floggings and marches, our thirst traps and sex work are at the vital heart of queer culture. Woof.group exists to make these things possible, not to repress them.

Extreme Pornography

The OSA also proscribes “extreme pornography”. Until recently, the UK banned a long list of our favorites, including spanking, caning, aggressive whipping, physical or verbal abuse (regardless of consent), physical restraint, female ejaculation, watersports, and fisting. Ofcom's Illegal Content Judgement Guidance defines extreme pornography on pages 158-160. It forbids realistic, “grossly offensive, disgusting or otherwise of an obscene character” images of certain types of acts. “Grossly offensive” and “obscene” are “given [their] ordinary meaning[s]“. We do not know how to apply these terms practically.

Proscribed acts include any “which results, or is likely to result, in serious injury to a person’s anus, breasts or genitals”. It is unclear what constitutes a serious injury. Is a chest-punching or branding scene against the rules? CBT? How will a UK court evaluate the safety of fisting?

The guidance also proscribes acts which threaten a person's life:

‘Acts which threaten a person’s life’ mean acts which depict physical endangerment with a material risk of death. Non exhaustive examples include explicit and realistic hanging, strangulation, suffocation and causing life threatening injury.

It is perfectly safe to press a hand over someone's mouth for the five seconds it takes to snap a photograph. Does the resulting image depict “suffocation”? Leatherfolk would likely judge such an image to have a vanishingly small chance of death. Will Ofcom and the courts rule similarly?

The guidance also bans images of non-consensual penetration. How do providers establish a lack of consent? Paragraph 10.17 explains that any user report qualifies:

A user report which suggests that the content depicts non-consensual acts should be taken as reasonable grounds to believe that there was no consent, unless there is evidence to the contrary.

This raises the prospect that images of events which were consented to in real life, and which a reasonable leather audience would implicitly understand as consensual, could be judged non-consensual on the basis of an anonymous third party report. This seems a clear vector for harassment. How are moderators to establish evidence to the contrary? Can we simply ask the poster if the media in question was actually consensual? Do we need to secure affidavits from anyone who posts images of penetrative sex?

Can Fediverse Instances Even Comply?

The Online Safety Act assumes services know what human beings are using their services, where they are located, and can control their access. Services which require a login to view content can sort of verify the ages of logged in users. This is how the Online Safety Act imagines a “child” (legally, any person under 18) might access pornography hosted on a Mastodon instance, like mastodon.social:

One might imagine mastodon.social (or any other instance) could comply with the OSA's regulations on pornography by forcing logged-in users to go through an age-assurance process, somehow finding a way to pay for it, defining a new kind of metadata on posts which identifies pornography (or other content “harmful to children” under the OSA), figuring out a way to federate that metadata via ActivityPub, forcing local and remote users to tag their content appropriately (an enormous moderation burden)—look, we all know this is not realistic, but someone might at least pretend.

Even if this were possible, this is not how Fediverse instances work. Instances generally have public web pages for much of their content, which can be viewed by anyone regardless of whether they have an account. There are RSS feeds which anyone can subscribe to; again, no login required. There are also public API endpoints which anyone on the internet could use to request content.

There is no way to establish the age of any of these users. Each instance allowing pornography would need to shut down its public API, RSS feeds, and public web pages. But this would also not be sufficient, because Fediverse instances are federated using the ActivityPub protocol. This is the entire point of the Fediverse. People on Woof.group can follow people on Mastodon.social, who can favorite posts on Pixelfed.social, who can comment on photos posted on Woof.group. A 17-year old could create an account on some other instance which does not perform age verification, and follow a porn account on mastodon.social from there. Or they could run their own instance—teens run all kinds of servers.

There is no way for a Fediverse instance to tell whether all the users of another instance are over 18. Instances cannot simply declare this fact: Ofcom is clear that self-attestation is not sufficient for age assurance. Even if the other instance performed age assurance, it would still need to shut down its own public API, RSS feeds, and web pages.

When pornography is federated from one instance to another, it is not clear whether the OSA would consider the originating instance, the receiving instance, or both to be illegal. If services are expected to robustly deny access to children, they might be required to disable federation entirely.

Plans

The OSA's restrictions on user-to-user pornography takes effect in July. However, many of the OSA's other provisions—like performing detailed risk assessments and submitting them to Ofcom, come into effect in on March 16. We must decide on a course of action by that time.

Woof.group is still attempting to figure out whether it is considered a regulated service under the OSA. We have written letters to Ofcom attempting to ascertain this fact, and to determine answers to some of the questions above; we await Ofcom's response. We are also attending an upcoming discussion with Ofcom.

Woof.group has already invested upwards of thirty hours reading the law, Ofcom's guidance, and corresponding with Ofcom and UK residents in an attempt to understand the law and devise a plan for compliance. There are literally thousands of pages of densely interlinked PDF guidance to review. We remain, like many others, hopelessly overwhelmed by the vagueness and complexity of the act.

If Woof.group is in scope, the potential penalties would be devastating. The UK could impose a fine of up to 18 million pounds or imprisonment. While we doubt the UK would attempt extradition of a US citizen, Woof.group's owner @aphyr visits the UK every few years and prefers his time behind bars to be voluntary and short-lived.

Some sites, like Wikipedia, intend to ignore the act and see what happens. However, Woof.group lacks the financial resources and time to mount a legal defense. It seems most likely we would be forced to block any access from IP addresses associated with the UK. Even if we take no action, Ofcom might order Woof.group banned by UK network providers.

If you are based in the UK, we recommend you export your data by March 15th in case we block access or are banned. You may also wish to ask your representatives for help.

If you run a web site or other kind of online service, you may wish to write Ofcom's Online Safety Team at OSengagement@ofcom.org.uk.