Woof.group Announcements

2025-02-05 01:52:55

Updates on the OSA

Updates on the OSA

In today's livestream (58:00), Ofcom's James Proudfoot told service providers, “If people reach out, what's useful is we can talk to you a bit more specifically about your service, and the regulations... it's a lot easier to talk about through a one-on-one conversation.” His colleague Alice Glossop chimed in: “If you reach out to us, we want to have conversations about what applies to your service.”

Woof.group has been trying to have these conversations with Ofcom since mid-January. Yesterday, we received a response to our most recent questions regarding the Online Safety Act. Ofcom informs us that they will not provide specific instructions for service providers, and declined to address all but one of our questions. In this post, we attempt to understand these non-answers, and summarize key warnings in today's OSA livestream. We follow up with thoughts on where this leaves Woof.group and the other thirty-thousand-odd Fediverse instances which may be illegal in the UK come July.

Ofcom's Response to our Questions

---

Dear Kyle,

Thank you for your message and feedback. We recognise that navigating the requirements of the online safety regime can be challenging and we have developed a series of quick guides to our online safety regulation, linked in our previous correspondence. These guides are designed to be accessible to services of all sizes and are intended to help services understand what they need to do to meet their duties under the Online Safety Act.

As the regulator we are not able to provide individual service providers with bespoke instructions, but by following Ofcom guidance and Codes, providers of online services will be able to assess the risks their services pose to their users, in order to establish what action they may need to take to comply with their Online Safety duties under the Act.

In relation to pornographic content, the duties in the Act are set by UK Government and apply to all services in scope regardless of size. If a service is in scope of the Online Safety Act and features pornography, it will need to use highly effective age assurance to prevent children from accessing that content. It is for the provider to decide how best to do this and which method of age assurance to implement. This could either be all areas of the service, or specific areas of the service which allow the pornographic content. Where a service cannot be accessed by UK users, it would not be in scope of the Act.

As we mentioned in our previous email, we will take a reasonable approach to enforcement with smaller services that present low risk to UK users, only taking action where it is proportionate and appropriate, and targeted only at cases in which action is needed to protect UK users from serious harm. We will also engage with services to explain our concerns and, in most cases, give them an opportunity to remedy our concerns before moving to formal action.

We have also recently released more helpful resources that we hope will be a support to you:

• We have published our first online safety industry bulletin of 2025. As the UK’s online safety regime is now in force, sites and apps must act to better protect users online, especially children. This bulletin sets out what services must do and when and the support and resources we will provide to help you comply with your duties and secure your user’s safety. It also explains the types of action we plan to take to drive better online safety outcomes.
• Our online safety regulations toolkit is now available on the Ofcom website. The toolkit provides a step-by-step guide to help you complete an assessment for the risks of illegal content on your platform. It will also help you to comply with your safety, record-keeping and review duties.
• We have also published a notice about Ofcom’s access to services, for transparency around our ways of working. This notice outlines that we may access services regulated under the Online Safety Act from time to time as part of our work.

Best, Online Safety Team

---

Considerations

Ofcom carefully avoided answering almost all of our questions. They declined to say whether ~185 users was a “significant number”. Several other participants in Ofcom's livestreams also asked what a significant number meant. Every time, Ofcom responded obliquely: there are no numeric thresholds, a significant number could be “small”, Ofcom could target “a one-man band”, and providers are expected to have a robust justification for deciding they do not have a significant number of UK users. It is unclear how anyone could make a robust justification given this nebulous guidance. In their letter, Ofcom also declined to say whether non-commercial services have target markets, or whether pornography poses a “material risk of significant harm”. In short, we have no answer as to whether Woof.group or other Fediverse instances are likely to fall in scope of the OSA.

Ofcom declined to clarify what kinds of acts would qualify as “extreme pornography”, or the evidentiary basis providers may use in adjudicating reports of non-consensual imagery. This makes it difficult, if not impossible, to operationalize the OSA into actionable policy for our moderators.

Woof.group, like almost every Fediverse instance, allows pornography. At present Woof.group federates with thirty-one thousand different instances; these domains therefore also allow their users to see pornography. If these instances are in scope of the OSA, they are legally required to implement highly effective age assurance by July. Ofcom declined to say whether these instances must disable their public web pages, RSS feeds, or APIs. Ofcom also declined to say whether they must disable federation. Similarly, Ofcom declined to say whether file-sharing services like S3, which host an immense volume of porn over public HTTP endpoints, would be blocked come July. It is frankly shocking that Ofcom has not considered this latter question: resources from S3 et al are essential for the operation of much of the modern internet.

Ofcom did offer a positive response to one of our questions: promising to—in most cases—engage with services prior to initiating formal action. This would have been reassuring were it not immediately contradicted by Ofcom's enforcement representatives in today's livestream. Finally, Ofcom declined to elaborate on how they might attempt to enforce UK law against US entities.

What Is Going On Here?

First: none of us are lawyers, and none of this is legal advice.

From Ofcom's responses to Woof.group, and in the livestream Q&A sessions this week, it appears that Ofcom is conscientiously avoiding telling web sites what they need to know to comply with the law. Are services in scope? We can't say. What kind of porn do we need to block? No idea. Is Fediverse as we know it illegal? Who knows! The fact that Ofcom has produced several thousand pages of guidance and yet cannot answer simple questions like “are we likely to be in scope” is striking. We are scrambling to interpret this behavior.

To some extent, Ofcom may not understand how this part of the internet works. Their policy documents and presentations almost exclusively refer to impact on businesses. There seems to be little awareness that much of the web is run by volunteers, individuals, and small, informal coalitions. We have yet to find any policy guidance for federated services, or discussion of the act's impact on RSS feeds and public APIs. Perhaps nobody at Ofcom realized the S3 issue until last week, and now they have to spend a year gaming out how they're going to poke the Amazon Legal Bear.

Another interpretation is that Ofcom, as a regulator, wishes to reserve maximal strategic latitude for future enforcement actions. If they declare a ten-user site “not a significant number”, and a nine-user CSAM ring pops up, Ofcom might find themselves in a bind. On the other hand, if there truly are no real lower bounds, what is the point of having “significant number” language at all? Expecting every five-person gardening forum or neighborhood blog on the planet to perform a seventeen-point formal risk assessment at regular intervals for N foreign governments is patently absurd.

A third possibility is that Ofcom doesn't actually know the answers to these questions. After all, the law doesn't say what “significant” means. And the determination of legality falls to the UK court system, not Ofcom itself. Per the ICJG:

A provider is not usually required to accept the opinions of a third party as to whether content is illegal content. Only a judgment of a UK court is binding on it in making this determination.

The OSA is sweeping new legislation, and there is no body of case law to draw on for the new offenses it defines. Ofcom could be just as much in the dark as us, and planning to grope their way to the fractal boundaries of “extreme pornography” and “in-scope services” through a series of enforcement actions and protracted legal proceedings.

Today's Livestream on Pornography

While Ofcom has avoided our questions, their comments in today's livestream make the picture sound increasingly bleak for Fediverse instances and other small communities. At 6:58, Glossop explained that any pornography on a service would require age assurance—that is to say, facial scanning, verification of bank records, etc.

The act does designate pornographic content as a type of content that is harmful to children and that children need to be prevented from accessing, and that applies across the board... whether it's just one small part of a very broad service that you offer.

And at 35:32, she reiterated:

Whether you are an adult service that only provides that kind of content, or whether you're a social media service that doesn't prohibit that kind of content, the requirement is the same: to use age assurance.

At 8:50, she explained that the presence of pornography on a service, even if the service were quite small and not based in the UK, could cause it to have a “significant number” of UK users, and therefore fall in scope of the OSA.

Importantly, it's not about where the service provider is based, as a company. It's actually about whether your service has UK users on it.... The terminology in the act is a “significant number” of UK users. And in terms of what “significant” means here, it's not just a big number, or a proportionately big number in relation to your total service. It could also mean significant if the level of harm on that service is particularly high, and given the scope of the act is about the protection of children, and the emphasis on types of harmful content including pornography, it is kind of generally likely that a service would be considered to have a “significant number” of UK users in the scope of that question.

Are small services like indie porn studios exempt because of their small scale? Absolutely not. At 38:25, Ofcom explained:

The requirement is if you allow this type of content, you need to use highly effective age assurance to prevent children from accessing it. The part of Ofcom's remit of being a proportionate regulator (which we absolutely are) doesn't have a role in saying “Oh, well maybe you don't have to do highly effective age assurance.” That requirement remains the same. Where our proportionality comes in is thinking about what process you take to implement your highly effective age assurance.... The act makes clear that this is now a cost of business to do that type of content and provide that type of content.

Ofcom's James Proudfoot confirmed at 32:50 that Ofcom intends to go after small web sites that allow pornography:

We are conscious that with highly effective age assurance, everyone needs to implement it in order for this to work, and so we've taken that into account. We won't just be going for big sites, which you might see elsewhere, but also small and medium sites as well when it comes to enforcement action.

At 50:20, Ofcom explained that sites which allow users to view content without logging in could be expected to perform highly effective age assurance on each visitor. It is hard to envision requiring age assurance on public HTTP endpoints for a Mastodon instance—doing so would render the API and federation completely unusable.

If you've got a site that doesn't have any kind of login process, you might consider age-assuring each unique user and doing it each time.

Can sites wait for regulators to reach out before taking action? Ofcom's response to Woof.group said Ofcom would “engage with services to explain our concerns and, in most cases, give them an opportunity to remedy our concerns before moving to formal action.” However, Matthew Hoskings, of Ofcom's enforcement division, cast significant doubt on this picture at 53:45.

Question: When Ofcom notifies a site that they're in breach of the act, are they given a chance to put [age verification] in place by a deadline before being fined?

Hoskings: I think the answer is no. The duties come into force—part five is in force now, and part three comes into July. When we write to you to say you're in breach, that is, “You are in breach”. You need to take steps to be getting yourself compliant... Don't wait until you get that breach letter. Reach out to us, work with us, because once that breach letter is there that is the final, and that is when we start following with enforcement action.

Question: What would Ofcom say to sites that are delaying age assurance measures because none of their competitors have implemented it, and they don't want to be at a commercial disadvantage by complying?

Hoskings: This is across the board. We are looking at big players, we are focused across the industry, whether it be one-man bands, the smaller service, the big companies. We want a level playing field, and we are applying our powers proportionately and fairly.

What Do We Do Now?

We still don't know whether or not Woof.group is in-scope under the OSA. There seem to be two possible worlds:

1. Woof.group is not in scope of the OSA. We are unaffected.
2. Woof.group is in scope. Compliance with the OSA is obviously impossible. Since we (like some ~31,000 other instances) allow pornography, our only option would be to geoblock the UK. Luckily, Ofcom confirmed in yesterday's livestream that geoblocking would satisfy them.

There seems to be no point in performing risk assessments, reviewing content guidelines, collating evidence of illegal harms, producing written procedures, performing compliance training, or taking other compliance measures at this time. Either we aren't in scope and need not jump through these hoops, or we are in scope, must block the UK, and the question becomes similarly moot.

Do we block pre-emptively, or if and when Ofcom asks? This is the ethical question Woof.group's team, like other community forums, have been wrestling with. Ofcom would certainly like sites to take action immediately. As Hoskings warned:

Don't wait until it's too late. That's the message. Once you do get the breach letter, that is when it is too late. The time doesn't start ticking from then. The time is ticking from—for part five services, from January, part three from July.

Blocking pre-emptively might also influence the UK powers-that-be: Ofcom has said that they want the UK public to retain access to internet services, and if services go dark, that could generate political backlash. However, this only works if enough services go dark. Right now most sites seem completely unaware of their risks under the OSA; we face a collective action problem, and Woof.group is diminutive. More pressingly, geoblocking is guaranteed to cut off our existing UK users and many federated instances who are a cherished part of our community. We must balance a large-but-speculative benefit against a smaller, more closely-felt, and certain loss.

There is also the elephant in the room. What Ofcom is trying to do—place all pornography on the web behind robust age assurance—is obviously impossible. Ofcom has finite time, budget, enforcement personnel, and political goodwill. The internet is international, heterogenous, and full of human beings who enjoy sexual speech. Successful enforcement measures are likely to engender adaptive behavior: migration to less-policed platforms, VPNs, robust anonymity and encryption schemes, age assurance countermeasures, and so on. This is not an arms race I think anyone—Ofcom included—expects regulators to win. They may find the task so intractable that we, and other small community forums, never have to care.

We've been debating this internally at Woof.group, bouncing ideas off peers in the UK, and still haven't reached a conclusion. However we do want to share the information we have, and encourage others to evaluate risks and reach out to Ofcom themselves. Ofcom just announced a contact address for services that allow pornography, and it seems some thirty-one thousand of you now have a reason to get in touch: PornSupervision@ofcom.org.uk.

Day 3 - Deep dive: What the online safety duties mean for services that allow pornography – age assurance and beyond, with Q&A on Vimeo

^{player.vimeo.com}