In today's livestream (58:00), Ofcom's James Proudfoot told service providers, “If people reach out, what's useful is we can talk to you a bit more specifically about your service, and the regulations... it's a lot easier to talk about through a one-on-one conversation.” His colleague Alice Glossop chimed in: “If you reach out to us, we want to have conversations about what applies to your service.”
Woof.group has been trying to have these conversations with Ofcom since mid-January. Yesterday, we received a response to our most recent questions regarding the Online Safety Act. Ofcom informs us that they will not provide specific instructions for service providers, and declined to address all but one of our questions. In this post, we attempt to understand these non-answer
... mehr anzeigen
Updates on the OSA
In today's livestream (58:00), Ofcom's James Proudfoot told service providers, “If people reach out, what's useful is we can talk to you a bit more specifically about your service, and the regulations... it's a lot easier to talk about through a one-on-one conversation.” His colleague Alice Glossop chimed in: “If you reach out to us, we want to have conversations about what applies to your service.”
Woof.group has been trying to have these conversations with Ofcom since mid-January. Yesterday, we received a response to our most recent questions regarding the Online Safety Act. Ofcom informs us that they will not provide specific instructions for service providers, and declined to address all but one of our questions. In this post, we attempt to understand these non-answers, and summarize key warnings in today's OSA livestream. We follow up with thoughts on where this leaves Woof.group and the other thirty-thousand-odd Fediverse instances which may be illegal in the UK come July.
Ofcom's Response to our Questions
Dear Kyle,
Thank you for your message and feedback. We recognise that navigating the requirements of the online safety regime can be challenging and we have developed a series of quick guides to our online safety regulation, linked in our previous correspondence. These guides are designed to be accessible to services of all sizes and are intended to help services understand what they need to do to meet their duties under the Online Safety Act.
As the regulator we are not able to provide individual service providers with bespoke instructions, but by following Ofcom guidance and Codes, providers of online services will be able to assess the risks their services pose to their users, in order to establish what action they may need to take to comply with their Online Safety duties under the Act.
In relation to pornographic content, the duties in the Act are set by UK Government and apply to all services in scope regardless of size. If a service is in scope of the Online Safety Act and features pornography, it will need to use highly effective age assurance to prevent children from accessing that content. It is for the provider to decide how best to do this and which method of age assurance to implement. This could either be all areas of the service, or specific areas of the service which allow the pornographic content. Where a service cannot be accessed by UK users, it would not be in scope of the Act.
As we mentioned in our previous email, we will take a reasonable approach to enforcement with smaller services that present low risk to UK users, only taking action where it is proportionate and appropriate, and targeted only at cases in which action is needed to protect UK users from serious harm. We will also engage with services to explain our concerns and, in most cases, give them an opportunity to remedy our concerns before moving to formal action.
We have also recently released more helpful resources that we hope will be a support to you:
We have published our first online safety industry bulletin of 2025. As the UK’s online safety regime is now in force, sites and apps must act to better protect users online, especially children. This bulletin sets out what services must do and when and the support and resources we will provide to help you comply with your duties and secure your user’s safety. It also explains the types of action we plan to take to drive better online safety outcomes.
Our online safety regulations toolkit is now available on the Ofcom website. The toolkit provides a step-by-step guide to help you complete an assessment for the risks of illegal content on your platform. It will also help you to comply with your safety, record-keeping and review duties.
We have also published a notice about Ofcom’s access to services, for transparency around our ways of working. This notice outlines that we may access services regulated under the Online Safety Act from time to time as part of our work.
Best, Online Safety Team
Considerations
Ofcom carefully avoided answering almost all of our questions. They declined to say whether ~185 users was a “significant number”. Several other participants in Ofcom's livestreams also asked what a significant number meant. Every time, Ofcom responded obliquely: there are no numeric thresholds, a significant number could be “small”, Ofcom could target “a one-man band”, and providers are expected to have a robust justification for deciding they do not have a significant number of UK users. It is unclear how anyone could make a robust justification given this nebulous guidance. In their letter, Ofcom also declined to say whether non-commercial services have target markets, or whether pornography poses a “material risk of significant harm”. In short, we have no answer as to whether Woof.group or other Fediverse instances are likely to fall in scope of the OSA.
Ofcom declined to clarify what kinds of acts would qualify as “extreme pornography”, or the evidentiary basis providers may use in adjudicating reports of non-consensual imagery. This makes it difficult, if not impossible, to operationalize the OSA into actionable policy for our moderators.
Woof.group, like almost every Fediverse instance, allows pornography. At present Woof.group federates with thirty-one thousand different instances; these domains therefore also allow their users to see pornography. If these instances are in scope of the OSA, they are legally required to implement highly effective age assurance by July. Ofcom declined to say whether these instances must disable their public web pages, RSS feeds, or APIs. Ofcom also declined to say whether they must disable federation. Similarly, Ofcom declined to say whether file-sharing services like S3, which host an immense volume of porn over public HTTP endpoints, would be blocked come July. It is frankly shocking that Ofcom has not considered this latter question: resources from S3 et al are essential for the operation of much of the modern internet.
Ofcom did offer a positive response to one of our questions: promising to—in most cases—engage with services prior to initiating formal action. This would have been reassuring were it not immediately contradicted by Ofcom's enforcement representatives in today's livestream. Finally, Ofcom declined to elaborate on how they might attempt to enforce UK law against US entities.
What Is Going On Here?
First: none of us are lawyers, and none of this is legal advice.
From Ofcom's responses to Woof.group, and in the livestream Q&A sessions this week, it appears that Ofcom is conscientiously avoiding telling web sites what they need to know to comply with the law. Are services in scope? We can't say. What kind of porn do we need to block? No idea. Is Fediverse as we know it illegal? Who knows! The fact that Ofcom has produced several thousand pages of guidance and yet cannot answer simple questions like “are we likely to be in scope” is striking. We are scrambling to interpret this behavior.
To some extent, Ofcom may not understand how this part of the internet works. Their policy documents and presentations almost exclusively refer to impact on businesses. There seems to be little awareness that much of the web is run by volunteers, individuals, and small, informal coalitions. We have yet to find any policy guidance for federated services, or discussion of the act's impact on RSS feeds and public APIs. Perhaps nobody at Ofcom realized the S3 issue until last week, and now they have to spend a year gaming out how they're going to poke the Amazon Legal Bear.
Another interpretation is that Ofcom, as a regulator, wishes to reserve maximal strategic latitude for future enforcement actions. If they declare a ten-user site “not a significant number”, and a nine-user CSAM ring pops up, Ofcom might find themselves in a bind. On the other hand, if there truly are no real lower bounds, what is the point of having “significant number” language at all? Expecting every five-person gardening forum or neighborhood blog on the planet to perform a seventeen-point formal risk assessment at regular intervals for N foreign governments is patently absurd.
A third possibility is that Ofcom doesn't actually know the answers to these questions. After all, the law doesn't say what “significant” means. And the determination of legality falls to the UK court system, not Ofcom itself. Per the ICJG:
A provider is not usually required to accept the opinions of a third party as to whether content is illegal content. Only a judgment of a UK court is binding on it in making this determination.
The OSA is sweeping new legislation, and there is no body of case law to draw on for the new offenses it defines. Ofcom could be just as much in the dark as us, and planning to grope their way to the fractal boundaries of “extreme pornography” and “in-scope services” through a series of enforcement actions and protracted legal proceedings.
Today's Livestream on Pornography
While Ofcom has avoided our questions, their comments in today's livestream make the picture sound increasingly bleak for Fediverse instances and other small communities. At 6:58, Glossop explained that any pornography on a service would require age assurance—that is to say, facial scanning, verification of bank records, etc.
The act does designate pornographic content as a type of content that is harmful to children and that children need to be prevented from accessing, and that applies across the board... whether it's just one small part of a very broad service that you offer.
And at 35:32, she reiterated:
Whether you are an adult service that only provides that kind of content, or whether you're a social media service that doesn't prohibit that kind of content, the requirement is the same: to use age assurance.
At 8:50, she explained that the presence of pornography on a service, even if the service were quite small and not based in the UK, could cause it to have a “significant number” of UK users, and therefore fall in scope of the OSA.
Importantly, it's not about where the service provider is based, as a company. It's actually about whether your service has UK users on it.... The terminology in the act is a “significant number” of UK users. And in terms of what “significant” means here, it's not just a big number, or a proportionately big number in relation to your total service. It could also mean significant if the level of harm on that service is particularly high, and given the scope of the act is about the protection of children, and the emphasis on types of harmful content including pornography, it is kind of generally likely that a service would be considered to have a “significant number” of UK users in the scope of that question.
Are small services like indie porn studios exempt because of their small scale? Absolutely not. At 38:25, Ofcom explained:
The requirement is if you allow this type of content, you need to use highly effective age assurance to prevent children from accessing it. The part of Ofcom's remit of being a proportionate regulator (which we absolutely are) doesn't have a role in saying “Oh, well maybe you don't have to do highly effective age assurance.” That requirement remains the same. Where our proportionality comes in is thinking about what process you take to implement your highly effective age assurance.... The act makes clear that this is now a cost of business to do that type of content and provide that type of content.
Ofcom's James Proudfoot confirmed at 32:50 that Ofcom intends to go after small web sites that allow pornography:
We are conscious that with highly effective age assurance, everyone needs to implement it in order for this to work, and so we've taken that into account. We won't just be going for big sites, which you might see elsewhere, but also small and medium sites as well when it comes to enforcement action.
At 50:20, Ofcom explained that sites which allow users to view content without logging in could be expected to perform highly effective age assurance on each visitor. It is hard to envision requiring age assurance on public HTTP endpoints for a Mastodon instance—doing so would render the API and federation completely unusable.
If you've got a site that doesn't have any kind of login process, you might consider age-assuring each unique user and doing it each time.
Can sites wait for regulators to reach out before taking action? Ofcom's response to Woof.group said Ofcom would “engage with services to explain our concerns and, in most cases, give them an opportunity to remedy our concerns before moving to formal action.” However, Matthew Hoskings, of Ofcom's enforcement division, cast significant doubt on this picture at 53:45.
Question: When Ofcom notifies a site that they're in breach of the act, are they given a chance to put [age verification] in place by a deadline before being fined?
Hoskings: I think the answer is no. The duties come into force—part five is in force now, and part three comes into July. When we write to you to say you're in breach, that is, “You are in breach”. You need to take steps to be getting yourself compliant... Don't wait until you get that breach letter. Reach out to us, work with us, because once that breach letter is there that is the final, and that is when we start following with enforcement action.
Question: What would Ofcom say to sites that are delaying age assurance measures because none of their competitors have implemented it, and they don't want to be at a commercial disadvantage by complying?
Hoskings: This is across the board. We are looking at big players, we are focused across the industry, whether it be one-man bands, the smaller service, the big companies. We want a level playing field, and we are applying our powers proportionately and fairly.
What Do We Do Now?
We still don't know whether or not Woof.group is in-scope under the OSA. There seem to be two possible worlds:
Woof.group is not in scope of the OSA. We are unaffected.
Woof.group is in scope. Compliance with the OSA is obviously impossible. Since we (like some ~31,000 other instances) allow pornography, our only option would be to geoblock the UK. Luckily, Ofcom confirmed in yesterday's livestream that geoblocking would satisfy them.
There seems to be no point in performing risk assessments, reviewing content guidelines, collating evidence of illegal harms, producing written procedures, performing compliance training, or taking other compliance measures at this time. Either we aren't in scope and need not jump through these hoops, or we are in scope, must block the UK, and the question becomes similarly moot.
Do we block pre-emptively, or if and when Ofcom asks? This is the ethical question Woof.group's team, like other community forums, have been wrestling with. Ofcom would certainly like sites to take action immediately. As Hoskings warned:
Don't wait until it's too late. That's the message. Once you do get the breach letter, that is when it is too late. The time doesn't start ticking from then. The time is ticking from—for part five services, from January, part three from July.
Blocking pre-emptively might also influence the UK powers-that-be: Ofcom has said that they want the UK public to retain access to internet services, and if services go dark, that could generate political backlash. However, this only works if enough services go dark. Right now most sites seem completely unaware of their risks under the OSA; we face a collective action problem, and Woof.group is diminutive. More pressingly, geoblocking is guaranteed to cut off our existing UK users and many federated instances who are a cherished part of our community. We must balance a large-but-speculative benefit against a smaller, more closely-felt, and certain loss.
There is also the elephant in the room. What Ofcom is trying to do—place all pornography on the web behind robust age assurance—is obviously impossible. Ofcom has finite time, budget, enforcement personnel, and political goodwill. The internet is international, heterogenous, and full of human beings who enjoy sexual speech. Successful enforcement measures are likely to engender adaptive behavior: migration to less-policed platforms, VPNs, robust anonymity and encryption schemes, age assurance countermeasures, and so on. This is not an arms race I think anyone—Ofcom included—expects regulators to win. They may find the task so intractable that we, and other small community forums, never have to care.
We've been debating this internally at Woof.group, bouncing ideas off peers in the UK, and still haven't reached a conclusion. However we do want to share the information we have, and encourage others to evaluate risks and reach out to Ofcom themselves. Ofcom just announced a contact address for services that allow pornography, and it seems some thirty-one thousand of you now have a reason to get in touch: PornSupervision@ofcom.org.uk.
This letter (lightly edited for formatting and clarity) was sent to Ofcom's Online Safety Team on 2025-01-27 to clarify open questions regarding the Online Safety Act (OSA). The OSA appears to pose significant hazards to community forums, Fediverse instances, online art, and web infrastructure—for instance, hosting providers and object storage services like S3. Woof.group is trying to figure out whether we are a “regulated service” under the OSA, and if so, how to comply. Ofcom responded on 2025-02-05.
Dear Ofcom Online Safety Team,
I write with follow-up questions regarding the Online Safety Act and how it might pertain to Woof.group, a Mastodon instance of approximately seven hundred users. I have spent much of my recent nights and weekends reviewing hundreds of pages of Ofcom's guidance, the text of the act itself, and consulting with people in the UK in an attempt to understand what our risks might be and how we ought to comply. I have many questions which the guidance has yet to clarify, and would appreciate your specific insight. Your answers would also be of use to tens of thousands of other Fediverse operators who now find themselves in similar positions.
1. What constitutes a “significant number” of UK users?
Following further discussions with individuals more familiar with UK law, I am no longer certain what “a significant number” means. Woof.group has ~740 monthly active local users—that is to say, people with an account on woof.group itself. We have 1531 local users with logged IP addresses. Of those, 185 have at least one IP which resolves to a “GB” country code. There are likely some UK people who access woof.group content via RSS readers, the public web interface, the API, or via federation. For a number of reasons (e.g. automated crawlers, NATs, the difficulty of mapping requests to human beings, federation dynamics, etc.) we have no meaningful way to measure how many UK people fall into this category.
In Ofcom's judgement, does this constitute “a significant number”?
2. Do non-commercial, public-interest services have “target markets?”
Woof.group does not sell anything to users, or third parties, and does not run advertisements. We provide a free community service, and are supported entirely by donations denominated in US dollars. We are a US corporation, and until now, have had essentially nothing to say regarding the UK. I believe, and would like Ofcom to confirm, that the UK does not form “one of the target markets” for Woof.group.
3. Does pornography, or “extreme pornography”, constitute a “material risk of significant harm” to individuals in the UK?
I firmly believe that our user-created pornography poses little harm to anyone. However, the text of the OSA repeatedly refers to pornography as “harmful to children”, and Ofcom goes to great lengths to ban access to it. In Ofcom's judgement, does the presence of pornography on a service (which is, we stress, explicitly oriented towards 18+ individuals) pose “a material risk of significant harm”, for purposes of evaluating whether a service is regulated under the OSA? If not, does “extreme pornography” bring a service under scope?
4. What exactly is “extreme pornography”?
The OSA requires that “extreme pornography” be “grossly offensive” or “obscene”, which are “given [their] ordinary meaning[s]“. We are unsure how to establish whether material is grossly offensive or obscene, and would appreciate concrete examples, ideally with reference images.
We are aware that up until recently, physical restraint, watersports, female ejaculation, fisting, spanking, caning, aggressive whipping, and verbal or physical abuse, regardless of consent, were considered illegal pornography in the UK. Does Ofcom intend to ban these kinds of acts again? If not, which acts specifically?
The ICJG defines “extreme pornography” to include any act “which results, or is likely to result, in serious injury to a person’s anus, breasts or genitals”. Does this include fisting? Sounding? Piercing? Punching? Branding? Cutting? Ball beating? Where does the threshold for “serious injury” fall—light or heavy bruising? Abrasion? Swelling? Needle punctures? “Hamburger back”? Scarring? As SM practitioners, we are used to doing painful, scary-looking things to breasts, anuses, and genitals which are nevertheless quite safe and recoverable. However, we are unclear as to how Ofcom and UK courts would interpret those acts.
The ICJG also bans “acts which depict physical endangerment with a material risk of death” including “hanging, strangulation, suffocation and causing life threatening injury.” Is an image of a man's gloved hands over the mouth and nose of another “suffocation”? What about gripping the neck firmly, a tightened collar, or a headlock? An oven bag over the head? Leatherfolk know that these acts and images of them can be arranged with essentially no risk of death. Will Ofcom and the courts agree?
Would, for example, Sotheby's images of Robert Mapplethorpe's “X Portfolio” be considered grossly offensive or obscene? Are its images of scars, needles through nipples, mouth-filling gags, fisting, sounding, and bloody genitals, “extreme pornography”? Will Ofcom fine Sotheby's for publishing this media? Can they still offer it for auction?
5. How are we to interpret reports of non-consensual imagery?
Paragraph 10.17 of the ICJG indicates that “[a] user report which suggests that the content depicts non-consensual acts should be taken as reasonable grounds to believe that there was no consent, unless there is evidence to the contrary.” Suppose a user has consensual penetrative sex, uploads a photograph of that sex to Woof.group, and an anonymous user from (e.g.) another Mastodon instance files a moderation report stating “this is not consensual”. How do moderators establish whether there is evidence to the contrary? Is a statement from the user who posted the image sufficient? If not, does this provide a harassment vector by which anyone can take down posts or accounts by flooding the provider with reports that material is non-consensual?
6. Must services which allow pornography take down public endpoints?
Most Mastodon instances, like Woof.group and Mastodon.social, allow pornography. Almost without exception, these instances also come with public HTTP endpoints which do not require any kind of login or session to access. As shown in the attached image, there are public web pages, RSS feeds, and API endpoints by which users could access material. These users might be under 18 years of age—as with any public HTTP endpoint, there is simply no way to know. Are instances which allow pornography required to take down their public web pages, RSS feeds, and APIs?
7. Must services which allow pornography deny federation?
Woof.group, like most Mastodon servers, is a part of the Fediverse: a loose network of tens of thousands of instances, each run by different people, which exchange content via the ActivityPub protocol. These instances run all kinds of software: Mastodon, Pixelfed, Akkoma, Lemmy, and so on. Just like email, users on one instance can follow, view posts from, and interact with users on other instances.
Even if an instance were to perform age assurance on its own users, it has no way to establish whether users on other instances are also adults. As shown in the attached image, a 17-year old user of mstdn.ca could see content from users on mastodon.social, which allows pornography. In this scenario, whom does Ofcom hold responsible?
A 17-year old person in the UK could run their own server; the technical skills required are within the reach of many teens. Imagine a UK 17-year old were to run an instance for themselves in a datacenter in Brazil. Through that single-user instance, they follow a user on Woof.group, and see pornography. Is the 17-year old liable for having run their own service which allowed them to view porn? Is Woof.group liable for having allowed another instance—which we have no knowledge or control over, and which appears to be located outside the UK—to federate with us?
In order to robustly deny access to children, it would seem that Fediverse instances which allow pornography must shut down federation altogether. What exactly is Ofcom's position on federation?
8. Does Ofcom expect public object stores like AWS S3 to ban pornography?
Object storage services like S3 or DigitalOcean Spaces offer companies and individuals the ability to store and, via public HTTP endpoints, access arbitrary files. Under the OSA, these appear to be file-sharing services with significant links to the UK. They are also used by many online services (including Woof.group) to store images and video, including pornography. For example, here is one of Mapplethorpe's photographs of fisting, available to any web browser, hosted on AWS S3.
Does Ofcom consider S3 (et al) to be in violation of the OSA? If so, how does Ofcom propose AWS respond? Requiring S3 to perform age assurance would break a huge part of the web: S3's public endpoints have no concept of user accounts, so both S3 and its users would be forced to fundamentally redesign. Banning object stores at the network level in the UK would also render a good swath of the web unusable. Banning pornography would require S3 to identify and remove it. What is Ofcom planning to do?
9. Will community services be given notification and a chance to respond prior to fines and imprisonment?
A good number of sites are planning to shut down due to Ofcom's threats to levy fines of up to 18 million, or to imprison operators. I ask again: can Ofcom promise to contact operators, and give them a chance to respond, before imposing crushing penalties? Doing so would significantly lower all of our stress levels.
10. How does Ofcom intend to enforce the OSA against US corporations and citizens?
Publishing pornography is constitutionally protected speech in the US, but Ofcom has been clear that it expects “overseas ... services run by micro-businesses” to be affected by (e.g.) age assurance rules. What would happen if Woof.group, as a US company, hosted in the US, with US owners, failed to comply with Ofcom's rules? How does Ofcom plan to enforce rulings against US entities?
As I am now orders of magnitude beyond the suggested four hours it should take to understand compliance obligations, I would very much appreciate your help.
Under the Online Safety Act, Ofcom's job is to make online services safer for the people who use them. We make sure companies have effective systems in place to protect users from harm.
