Wikimedia Foundation Challenges UK Online Safety Act Regulations(wikimediafoundation.org)
wikimediafoundation.org
Wikimedia Foundation Challenges UK Online Safety Act Regulations
https://wikimediafoundation.org/news/2025/07/17/wikimedia-foundation-challenges-uk-online-safety-act-regulations/
191 comments
I'm always reminded of this http://news.bbc.co.uk/2/hi/uk_news/politics/7970731.stm
"The Home Secretary's husband has said sorry for embarrassing his wife after two adult films were viewed at their home, then claimed for on expenses."
The follow up article has some fun nuggets too http://news.bbc.co.uk/2/hi/8145935.stm
"The Home Secretary's husband has said sorry for embarrassing his wife after two adult films were viewed at their home, then claimed for on expenses."
The follow up article has some fun nuggets too http://news.bbc.co.uk/2/hi/8145935.stm
Even low-grade encryption was actually forbidden in France for a while in the mid 90s. I remember snickering about the whole thing back then, in a much smaller but also quite similar forum.
https://www.theregister.com/1999/01/15/france_to_end_severe_...
> Until 1996 anyone wishing to encrypt any document had to first receive an official sanction or risk fines from F6000 to F500,000 ($1000 to $89,300) and a 2-6 month jail term. Right now, apart from a handful of exemptions, any unauthorised use of encryption software is illegal.
These two former empires seem/seemed to have an over-inflated sense of importance and ability to control the world.
https://www.theregister.com/1999/01/15/france_to_end_severe_...
> Until 1996 anyone wishing to encrypt any document had to first receive an official sanction or risk fines from F6000 to F500,000 ($1000 to $89,300) and a 2-6 month jail term. Right now, apart from a handful of exemptions, any unauthorised use of encryption software is illegal.
These two former empires seem/seemed to have an over-inflated sense of importance and ability to control the world.
There was also in the 90s the weird period of export control of encryption software from the US, leading to the "this tshirt is a munition" shirts with the algorithm printed on them. And the (thankfully failed) "clipper chip" mandate.
Those controls all still exist. You just get a pass if you’re using “standard crypto”. Or if your implementation is open source.
Export controls still exist, but we're at least a far cry from the days of "This version of Mozilla is illegal to download if you are outside the USA. Please don't do it."
(and before that PGP!)
(and before that PGP!)
Japan was worried about running afoul of these same laws and banned sales of the PS2 in certain countries, I think the same countries we weren't allowed to share advanced crypto with.
https://www.pcmag.com/news/20-years-later-how-concerns-about... | https://web.archive.org/web/20250619030114/https://www.pcmag...
> All that power caught the eye of Japan’s Trade Ministry. In April 2000, they issued an edict[0]: if Sony wanted to ship the PS2 abroad, they would need to request a special permit. The law as written required any exporter who wished to ship hardware with potential military applications worth more than $472 outside the country to obtain permission from the government or face up to five years in prison.
> With a sticker price of $376, that meant any kind of bulk PS2 shipments would run afoul of the law. If the company couldn’t convince their government otherwise, American gamers wouldn’t have a chance to play Ridge Racer V or TimeSplitters on launch day.
> Sony applied for a special export permit to get its new console to the rest of the world, but a few countries were blacklisted. Libya, Iran, Iraq, and North Korea were considered potentially likely to use the console for nefarious purposes. Here in the United States, we got the hardware on October 26, as planned.
[0] http://news.bbc.co.uk/2/hi/asia-pacific/716237.stm | https://web.archive.org/web/20241212131304/http://news.bbc.c...
https://www.pcmag.com/news/20-years-later-how-concerns-about... | https://web.archive.org/web/20250619030114/https://www.pcmag...
> All that power caught the eye of Japan’s Trade Ministry. In April 2000, they issued an edict[0]: if Sony wanted to ship the PS2 abroad, they would need to request a special permit. The law as written required any exporter who wished to ship hardware with potential military applications worth more than $472 outside the country to obtain permission from the government or face up to five years in prison.
> With a sticker price of $376, that meant any kind of bulk PS2 shipments would run afoul of the law. If the company couldn’t convince their government otherwise, American gamers wouldn’t have a chance to play Ridge Racer V or TimeSplitters on launch day.
> Sony applied for a special export permit to get its new console to the rest of the world, but a few countries were blacklisted. Libya, Iran, Iraq, and North Korea were considered potentially likely to use the console for nefarious purposes. Here in the United States, we got the hardware on October 26, as planned.
[0] http://news.bbc.co.uk/2/hi/asia-pacific/716237.stm | https://web.archive.org/web/20241212131304/http://news.bbc.c...
There are no real laws or court rulings protecting crypto, the Department of Commerce simply changed their rules to allow it, and I have no doubt they could easily change them back if the mood struck them.
Zimmerman had a novel defense (selling PGP source code as a book, which should be protected by 1A), but it was never actually tested in court.
Zimmerman had a novel defense (selling PGP source code as a book, which should be protected by 1A), but it was never actually tested in court.
[deleted]
I wonder if the primary purpose of the law was to have a catch-all charge to file against people who stole military equipment? Of course there are charges like espionage and theft, but it seems like it could be a tactic to be able to levy "exporting an encryption device" charges in addition to everything else.
It was a legacy from the era of the enigma machine, where encryption required a dedicated cipher device, rather than something you could do in pure code.
Apple made an advertisement about the PowerMac G4 as a "supercomputer" because of onerous export controls related to encryption way back. It's more cheeky, I think, than serious. But then again, I haven't looked into it beyond just remembering that it happened.
https://www.youtube.com/watch?v=OoxvLq0dFvw
https://www.youtube.com/watch?v=OoxvLq0dFvw
When you go back a few decades, "supercomputer" level performance doesn't seem all that impressive now.
A Raspberry Pi outperforms a Cray-1 supercomputer, for instance.
A Raspberry Pi outperforms a Cray-1 supercomputer, for instance.
>A Raspberry Pi outperforms a Cray-1 supercomputer, for instance.
In terms of compute power this is true. However in terms of design and aesthetics I still find the Cray much more charming than the Pi (even if you start adding fancy cases and so on).
In terms of compute power this is true. However in terms of design and aesthetics I still find the Cray much more charming than the Pi (even if you start adding fancy cases and so on).
The French encryption ban was a moronic aberration that just lasted a few years. Hopefully just like this UK regulation.
It wasn’t relevant to any Apple ads.
It wasn’t relevant to any Apple ads.
From Minitel to the telecomms irrelevance against the US and UK. I'd guess the French investors's would love to kick the nuts of the whole parliament members signing that crap.
Why do you think it's an issue or understanding or intelligence? It's a matter of power and control. Protesting the intelligence of these leaders won't result in any structural change.
If anything, greater intelligence would only accelerate the damage and persuasiveness behind its public consent.
If anything, greater intelligence would only accelerate the damage and persuasiveness behind its public consent.
Why can't these measures be handled via parental control?
Children are using mobiles and tablets almost exclusively, both major providers of which supply tools for parental administration.
Content filtering is already facilitated by existing parental control. Mobile browsers could be made to issue a header if the user is under a certain age. Mobile apps could have access to a flag.
Parents should be responsible for parenting their child - not big tech. Why does it need to be any more complicated than that?
Children are using mobiles and tablets almost exclusively, both major providers of which supply tools for parental administration.
Content filtering is already facilitated by existing parental control. Mobile browsers could be made to issue a header if the user is under a certain age. Mobile apps could have access to a flag.
Parents should be responsible for parenting their child - not big tech. Why does it need to be any more complicated than that?
That's what blows my mind anytime I hear someone complain about all the vile content on the internet today and that we need to protect children. What about "be a parent" is so impossible to do today? Every device and OS has parental controls for a reason. Yeah they aren't perfect but they will prevent 99% of the content from getting to your kids.
It does feel like the online environment is pretty adversarial and hard for parents to deal with. In particular, it seems hard to pick and choose something reasonable. It doesn’t seem totally unreasonable to want some kind of state action to help represent the many parents and encourage creating better reasonable options.
Lots of things that feel relatively common online feel like they would be very alien and weird situations if they happened offline.
Lots of things that feel relatively common online feel like they would be very alien and weird situations if they happened offline.
I agree with you but my emotional reaction is similar to the parent comment because many of these parents vote for the party of "stop big government regulations" and "stop government censorship" while also advocating in general for personal responsibility.
So I'm actually against this because I hate the indirect hypocrisy. I want to teach a lesson to Republicans about using overly generalized principals as a political stance.
So I'm actually against this because I hate the indirect hypocrisy. I want to teach a lesson to Republicans about using overly generalized principals as a political stance.
Grow up in the woods;
Teach the kids to hike and make fire.
Teach the kids to hike and make fire.
There's a cognitive dissonance to the opposition to this:
a) Content controls don't work, what are the government thinking? b) This is parents' problem, they should use content controls.
Individual action doesn't work because it only takes one kid in the class who doesn't have parental controls then everyone loses. There's also obvious workarounds such as VPNs and a teenager walking into a pawn shop with £50 for a second hand smartphone without parental controls.
It also makes no sense that parents can't be bothered to turn on parental controls yet can be bothered to run a national grassroots campaign for this stuff (see e.g. http://smartphonefreechildhood.org)
See also- I Had a Helicopter Mom. I Found Pornhub Anyway: https://www.thefp.com/p/why-are-our-fourth-graders-on-pornhu... 8-year old watches violent porn on friend’s iPad: https://www.thesun.co.uk/fabulous/32857335/son-watched-viole...
Although your idea of an OS-level age flag is also being pushed by the Anxious Generation's Jonathan Haidt, so definitely has merit/traction as an alternative.
a) Content controls don't work, what are the government thinking? b) This is parents' problem, they should use content controls.
Individual action doesn't work because it only takes one kid in the class who doesn't have parental controls then everyone loses. There's also obvious workarounds such as VPNs and a teenager walking into a pawn shop with £50 for a second hand smartphone without parental controls.
It also makes no sense that parents can't be bothered to turn on parental controls yet can be bothered to run a national grassroots campaign for this stuff (see e.g. http://smartphonefreechildhood.org)
See also- I Had a Helicopter Mom. I Found Pornhub Anyway: https://www.thefp.com/p/why-are-our-fourth-graders-on-pornhu... 8-year old watches violent porn on friend’s iPad: https://www.thesun.co.uk/fabulous/32857335/son-watched-viole...
Although your idea of an OS-level age flag is also being pushed by the Anxious Generation's Jonathan Haidt, so definitely has merit/traction as an alternative.
I like to point out in these threads that my first exposure to "pornography" was a cunnilingus scene in Al Franken's political tirade Lies and the Lying Liars Who Tell Them. I was eleven.
I don't think my parents had realized that scene was in the book. But I don't think it matters that much. Kids are going to encounter sex. In a pre-industrial society, it's pretty likely that children would catch adults having sex at some point during their childhood -- even assuming they didn't see their own parents doing it at a very young age. Privacy used to be more difficult. Houses often had one bedroom.
I don't mean to say that content controls are useless. I think it was probably for the better that I wasn't watching tons of porn in middle school. But I don't think that content controls need to be perfect; we don't need to ensure that the kids are never exposed to any pornographic content. As long as it isn't so accessible that the kid is viewing it regularly, it probably isn't the end of the world. Like in the one story, PornHub didn't even have a checkbox to ask if you were eighteen. Just don't do that. I didn't end up downloading porn intentionally myself until about five years after reading that book.
I don't think my parents had realized that scene was in the book. But I don't think it matters that much. Kids are going to encounter sex. In a pre-industrial society, it's pretty likely that children would catch adults having sex at some point during their childhood -- even assuming they didn't see their own parents doing it at a very young age. Privacy used to be more difficult. Houses often had one bedroom.
I don't mean to say that content controls are useless. I think it was probably for the better that I wasn't watching tons of porn in middle school. But I don't think that content controls need to be perfect; we don't need to ensure that the kids are never exposed to any pornographic content. As long as it isn't so accessible that the kid is viewing it regularly, it probably isn't the end of the world. Like in the one story, PornHub didn't even have a checkbox to ask if you were eighteen. Just don't do that. I didn't end up downloading porn intentionally myself until about five years after reading that book.
> Individual action doesn't work because it only takes one kid in the class who doesn't have parental controls then everyone loses.
The response to this, of course, is that many kids will be educated by their responsible parents.
They will know Santa isn't real or what sex is or why sometimes girls and boys kiss other girls and boys.
Are we going to outlaw teaching your own children about life next? Because they might "spread" the knowledge of... The real world they are about to experience and navigate?
The response to this, of course, is that many kids will be educated by their responsible parents.
They will know Santa isn't real or what sex is or why sometimes girls and boys kiss other girls and boys.
Are we going to outlaw teaching your own children about life next? Because they might "spread" the knowledge of... The real world they are about to experience and navigate?
Is there better evidence to the harms of porn than “dopamine” and “lost innocence”? That article written by a 17 year old, I’m old enough to be her parent and I saw hardcore internet porn in 5th grade. This isn’t new. Personally I don’t think it harmed me. But I’m open to hearing studies showing otherwise, not just hand waving.
>Why can't these measures be handled via parental control?
That would be the ideal. Unfortunately, many parents do not have the skills and/or motivation to manage their children's devices.
That would be the ideal. Unfortunately, many parents do not have the skills and/or motivation to manage their children's devices.
For that matter, how many kids manage their parents' devices. Maybe less so today, but for a long time, a lot of children were far more tech savvy than their parents. The contrast between my grandmothers when they were still around was stark. One never fell for anything... the other, I was cleaning malware it felt like quarterly.
My parents for a long time used their neighbor's wifi, despite having their own, because they didn't remember the password.
That said, having the carrier assign certain devices marked as "child" or "adult" or even with a DoB stamp that would change the flag when they became an adult might not be a bad thing. While intrusive would still be better than the forced ID path that some states and countries are striving towards.
My parents for a long time used their neighbor's wifi, despite having their own, because they didn't remember the password.
That said, having the carrier assign certain devices marked as "child" or "adult" or even with a DoB stamp that would change the flag when they became an adult might not be a bad thing. While intrusive would still be better than the forced ID path that some states and countries are striving towards.
That may have been a half decent excuse for parents 2 decades ago, but it isn't very good now when current parents grew up in the computer age with computers at school and in the vast majority of homes and even 90 year olds are using smart phones daily.
Like I said, likely less so today. That said, there are still a LOT of people that can use their devices, but have no understanding of security, configuration, etc. My SO can't even handle a password manager, but she can manage live TikTok chats/streams (or whatever they're called) with ease.
That said, it could definitely be done relatively easily at the carrier level, and a really simple addition to browsers, even if only on mobile devices.
That said, it could definitely be done relatively easily at the carrier level, and a really simple addition to browsers, even if only on mobile devices.
Taking tyrants' words at face value is collaboration in their tyranny.
This is nothing to do with children, those utterances are just bare faced cover for increased surveillance and control.
This is nothing to do with children, those utterances are just bare faced cover for increased surveillance and control.
This is because these measures are not about protecting children.
It's a distraction.
Real objective is to further increase the barrier of entry for SMEs to compete (try start your own forum or any kind of challenger to Facebook et al). Government on the other hand gets a tidy surveillance tool as a sweetener.
So whenever time comes to turn a screw on dissent, the law is ready to be used.
Welcome to British corporate fascism.
It's a distraction.
Real objective is to further increase the barrier of entry for SMEs to compete (try start your own forum or any kind of challenger to Facebook et al). Government on the other hand gets a tidy surveillance tool as a sweetener.
So whenever time comes to turn a screw on dissent, the law is ready to be used.
Welcome to British corporate fascism.
Yes, it is a pretense and the point of mentioning "the children" is to mobilize the child-worshipping demographic who believe, in all cases, that anything that raises any risk to children should be banned, and that this should not be discussed by decent people. The successful child-worshippers also instantly burst into hysterics and aggressive personal attacks when spoken to about the subject (hysterics and tears when they agree, the latter otherwise.) Their success lies in never lowering themselves to discuss anything with anybody. They're here to tell you.
They are an extreme minority of every population (mostly people who aren't interested in politics or civil liberties who enjoy and care about children.) But sensible people are also an extreme minority of the population; we normal people usually aren't so sensible, instead we listen to sensible people and follow their advice.
So the people who want everybody on the internet to identify themselves pit hysterics against measured voices in the media, in order to create a fake controversy that only has to last until the law gets passed. Afterwards, the politicians and commentariat who were directly paid or found personal brand benefit in associating with the hysterics start leaving quotes like: "This isn't what we thought we passed" and "It might be useful to have a review to see if this has gone too far." Then we find out that half the politicians connected with the legislation have connections to an age verification firm which is also an data broker, and has half a billion in contracts with the MoD.
They are an extreme minority of every population (mostly people who aren't interested in politics or civil liberties who enjoy and care about children.) But sensible people are also an extreme minority of the population; we normal people usually aren't so sensible, instead we listen to sensible people and follow their advice.
So the people who want everybody on the internet to identify themselves pit hysterics against measured voices in the media, in order to create a fake controversy that only has to last until the law gets passed. Afterwards, the politicians and commentariat who were directly paid or found personal brand benefit in associating with the hysterics start leaving quotes like: "This isn't what we thought we passed" and "It might be useful to have a review to see if this has gone too far." Then we find out that half the politicians connected with the legislation have connections to an age verification firm which is also an data broker, and has half a billion in contracts with the MoD.
>Why can't these measures be handled via parental control?
Because the government is lying and this is about spying on the populace, not about parental control.
Because the government is lying and this is about spying on the populace, not about parental control.
That's how it should work but you will find that a majority of parents cba rearing their children so they want the state to do it for them. And this extends to so many things in life that the authoritarian grip is only going to get tighter with time.
Note: the following is not arguing in favor of the UK policy, but is a general observation.
I seriously doubt that the majority of parents want the state to raise their children for them.
By arguing about irresponsible or lazy parents you are latching on to the first, most convenient thing that seems to make sense to you. But I think that is a mistake because not only does it perpetuate some kind of distorted sense of reality where parents don't care about their children and want to hand off all responsibility for them, but it distracts you from the real causal issues.
The fact is that humans have for millions of years acted in various levels of coordination to raise and look after children as a group. Modern society has made this all sorts of dysfunctional, but it still exists.
I seriously doubt that the majority of parents want the state to raise their children for them.
By arguing about irresponsible or lazy parents you are latching on to the first, most convenient thing that seems to make sense to you. But I think that is a mistake because not only does it perpetuate some kind of distorted sense of reality where parents don't care about their children and want to hand off all responsibility for them, but it distracts you from the real causal issues.
The fact is that humans have for millions of years acted in various levels of coordination to raise and look after children as a group. Modern society has made this all sorts of dysfunctional, but it still exists.
> parents cba rearing their children
And THAT is the problem that they should be tackling.
And THAT is the problem that they should be tackling.
Ironically any attempt to control this is deemed 'authoritarian' as well.
This is a problem that could be solved with socially funded child care, at least in part. But that's not gonna happen. (Posting from USA; I don't know how this may or may not apply in the UK.)
Either way, if parents had more time to raise their children rather than slave away at jobs to stay above water, I have to think there'd be some improvement in child development.
Either way, if parents had more time to raise their children rather than slave away at jobs to stay above water, I have to think there'd be some improvement in child development.
Not necessarily. If they want to have uneducated children, let them.
That is a terrible attitude about education. You are essentially condemning those kids and future generations to a shittier society and shittier lives.
Maybe so, but it’s better than the alternatives.
A reminder that it is a legal requirement that children get primary education. It is a crime to not give them an education.
We did that for a reason and it is undoubtedly better than the alternative.
We did that for a reason and it is undoubtedly better than the alternative.
To be fair, it is because the state makes it difficult for them to rear children.
Long working hours and both parents working full time means they do not have the time or the energy. Then you have the state offering help, and encouraging parents to drop them off at school first thing for breakfast club, and then keep them there for after school activities.
Long working hours and both parents working full time means they do not have the time or the energy. Then you have the state offering help, and encouraging parents to drop them off at school first thing for breakfast club, and then keep them there for after school activities.
"but you will find that a majority of parents cba rearing their children so they want the state to do it for them"
This is normal and what public education is for. Teaching online safety and sex ed should be considered no different than teaching history
This is normal and what public education is for. Teaching online safety and sex ed should be considered no different than teaching history
> The Wikimedia Foundation shares the UK government’s commitment to promoting online environments where everyone can safely participate. The organization is not bringing a general challenge to the OSA as a whole, nor to the existence of the Category 1 duties themselves. Rather, the legal challenge focuses solely on the new Categorisation Regulations that risk imposing Category 1 duties (the OSA’s most stringent obligations) on Wikipedia.
Guys, this right here is Wikipedia standing. It is that under the current law, Wikipedia would fall under cat 1 rules, even if by the law own admission it should not.
Guys, this right here is Wikipedia standing. It is that under the current law, Wikipedia would fall under cat 1 rules, even if by the law own admission it should not.
I'm skeptical this goes anywhere legally speaking.
The categorisation regulations are a statutory instrument rather than primary legislation, so they _are_ open to judicial review. But the Wikimedia foundation haven't presented an argument as to why the regulations are unlawful, just an argument for why they disagree with them.
It should be noted that even if they succeed (which seems a long shot), this wouldn't affect the main thrust of the Online Safety Act which _is_ primary legislation and includes the bit making the rounds about adult content being locked behind age verification.
The categorisation regulations are a statutory instrument rather than primary legislation, so they _are_ open to judicial review. But the Wikimedia foundation haven't presented an argument as to why the regulations are unlawful, just an argument for why they disagree with them.
It should be noted that even if they succeed (which seems a long shot), this wouldn't affect the main thrust of the Online Safety Act which _is_ primary legislation and includes the bit making the rounds about adult content being locked behind age verification.
The problem with the focus being on porn behind age verification as the main effect, is that it ignores all the other effects. Closing community forums and wikis. Uncertainty about blog comments.
It is actually (as noted in many previous discussion about the Online Safety Act) pushing people to using big tech platforms, because they can no longer afford the compliance cost and risk of running their own.
It is actually (as noted in many previous discussion about the Online Safety Act) pushing people to using big tech platforms, because they can no longer afford the compliance cost and risk of running their own.
> pushing people to using big tech platforms
so big tech platforms will cheerfully embrace it. as expected, major players love regulations.
so big tech platforms will cheerfully embrace it. as expected, major players love regulations.
GDPR killed small and medium online advertising businesses and handed everything to Google and Facebook.
It’s a shame it wasn’t able to get them all.
Frankly, that's their fault for pursuing individually targeted advertising. The sad thing isn't that some small shitty businesses lost out, it's that some large shitty businesses didn't.
And since individually targeted ads perform better and are less expensive it pushes everyone to big US tech platforms.
This isn't small advertisers' faults, the law signed their death warrant. They made local grocery stores more expensive and worse quality but kept Walmart around untouched. No one could predict what would happen.
This isn't small advertisers' faults, the law signed their death warrant. They made local grocery stores more expensive and worse quality but kept Walmart around untouched. No one could predict what would happen.
Those sort of sites already had better moderation than big tech because they’d have their own smaller team of volunteer moderators.
I suspect any smaller site that claims the Online Safety Act was a reason they closed, needed to close due to other complications. For example an art site that features occasional (or more) artistic nudes. Stuff that normal people wouldn’t consider mature content but the site maintainers wouldn’t want to take the risk on.
Either way, whether I’m right or wrong here, I still think the Online Safety Act is grotesque piece of legislation.
I suspect any smaller site that claims the Online Safety Act was a reason they closed, needed to close due to other complications. For example an art site that features occasional (or more) artistic nudes. Stuff that normal people wouldn’t consider mature content but the site maintainers wouldn’t want to take the risk on.
Either way, whether I’m right or wrong here, I still think the Online Safety Act is grotesque piece of legislation.
I think the impact is a lot worse than that. There are still compliance costs especially for volunteer run sites. Ofcom says these are negligible, because they its unlikely to be more than "a few thousand pounds". Then there are the risks if something goes wrong if you have not incorporated.
HN has already has discussed things like the cycling forum that hit down. lobste.rs considered blocking UK IPs. I was considering setting up a forum to replace/complement FB groups I help admin (home education related). This is enough to put me off as I do not want the hassle and risk of dealing with it.
I think what you are missing is that this does not just cover things like porn videos and photos. That is what has been emphasised by the media, but it covers a lot of harmful content: https://www.legislation.gov.uk/ukpga/2023/50/section/62
It took a fair amount of legal analysis to establish blog comments are OK (and its not clear whether off topic ones are). Links to that and other things here: https://www.theregister.com/2025/02/06/uk_online_safety_act_...
HN has already has discussed things like the cycling forum that hit down. lobste.rs considered blocking UK IPs. I was considering setting up a forum to replace/complement FB groups I help admin (home education related). This is enough to put me off as I do not want the hassle and risk of dealing with it.
I think what you are missing is that this does not just cover things like porn videos and photos. That is what has been emphasised by the media, but it covers a lot of harmful content: https://www.legislation.gov.uk/ukpga/2023/50/section/62
It took a fair amount of legal analysis to establish blog comments are OK (and its not clear whether off topic ones are). Links to that and other things here: https://www.theregister.com/2025/02/06/uk_online_safety_act_...
Some good points. And I do agree with your general opinion of this law. Albeit not all of specific points you've made:
> I think the impact is a lot worse than that. There are still compliance costs especially for volunteer run sites. Ofcom says these are negligible, because they its unlikely to be more than "a few thousand pounds". Then there are the risks if something goes wrong if you have not incorporated.
What are these "compliance costs"? There's no forms that need to be completed. Sites don't have to register themselves. For smaller sites, the cost is just what I described: the time and effort of volunteer moderators who already moderate the site. If they're already removing adult content, then there's no extra work for them.
> HN has already has discussed things like the cycling forum that hit down. lobste.rs considered blocking UK IPs. I was considering setting up a forum to replace/complement FB groups I help admin (home education related). This is enough to put me off as I do not want the hassle and risk of dealing with it.
None of this proves your point though. It just proves that some sites are worried about potential overreach. It's an understandable concern but it a different problem to the one the GP was describing in that it doesn't actually make it any harder for smaller forums in any tangible way. Unless you called "spooked" a tangible cost (I do not).
> I think what you are missing is that this does not just cover things like porn videos and photos.
I didn't miss that. But you're right to raise that nonetheless.
There's definitely a grey area that is going to concern a lot of people but no site is going to be punished for mild, or occasional "breaches". What the government are trying to police is the stuff that's clearly inappropriate for under-18s. The UK (and EU in general) tends to pass laws that can be a little vague in definition and trust the police and courts to uphold "the spirit of the law". A little like how US laws can be defined by past cases and their judgments. This ambiguity will scare American sites because it's not how American law works. But the UK system does _generally_ work well. We do have instances where such laws are abused but they're infrequent enough to make national news and subsequently get dropped because of the embarrassment it brings to their department.
That all said, I'm really not trying to defend this particular law. The Online Safety Act is definitely a _bad_ law and I don't personally know of anyone in the UK (outside of politicians) who actually agrees with it.
> I think the impact is a lot worse than that. There are still compliance costs especially for volunteer run sites. Ofcom says these are negligible, because they its unlikely to be more than "a few thousand pounds". Then there are the risks if something goes wrong if you have not incorporated.
What are these "compliance costs"? There's no forms that need to be completed. Sites don't have to register themselves. For smaller sites, the cost is just what I described: the time and effort of volunteer moderators who already moderate the site. If they're already removing adult content, then there's no extra work for them.
> HN has already has discussed things like the cycling forum that hit down. lobste.rs considered blocking UK IPs. I was considering setting up a forum to replace/complement FB groups I help admin (home education related). This is enough to put me off as I do not want the hassle and risk of dealing with it.
None of this proves your point though. It just proves that some sites are worried about potential overreach. It's an understandable concern but it a different problem to the one the GP was describing in that it doesn't actually make it any harder for smaller forums in any tangible way. Unless you called "spooked" a tangible cost (I do not).
> I think what you are missing is that this does not just cover things like porn videos and photos.
I didn't miss that. But you're right to raise that nonetheless.
There's definitely a grey area that is going to concern a lot of people but no site is going to be punished for mild, or occasional "breaches". What the government are trying to police is the stuff that's clearly inappropriate for under-18s. The UK (and EU in general) tends to pass laws that can be a little vague in definition and trust the police and courts to uphold "the spirit of the law". A little like how US laws can be defined by past cases and their judgments. This ambiguity will scare American sites because it's not how American law works. But the UK system does _generally_ work well. We do have instances where such laws are abused but they're infrequent enough to make national news and subsequently get dropped because of the embarrassment it brings to their department.
That all said, I'm really not trying to defend this particular law. The Online Safety Act is definitely a _bad_ law and I don't personally know of anyone in the UK (outside of politicians) who actually agrees with it.
> There's no forms that need to be completed.
One of us has completely misunderstood the legislation.
By my reading - there's a ton of red tape and paperwork. Heck, there's a ton of work even getting to the point of understanding what work you need to do. And dismissing the fear of life-changing financial liability as "being spooked" is not helpful.
I've got a open-source 3D sharing site almost ready to launch and I'm considering geo-blocking the UK. And I live in the UK.
One of us has completely misunderstood the legislation.
By my reading - there's a ton of red tape and paperwork. Heck, there's a ton of work even getting to the point of understanding what work you need to do. And dismissing the fear of life-changing financial liability as "being spooked" is not helpful.
I've got a open-source 3D sharing site almost ready to launch and I'm considering geo-blocking the UK. And I live in the UK.
> By my reading - there's a ton of red tape and paperwork.
It might help if you referenced the section what defines those requirements.
I don’t recall seeing anything that required such red tape unless there was special circumstances after the fact (for example, reporting child porn that was uploaded to your site, or responding to a police or court order).
But these kinds of rules exist for freedom of information et al too.
Maybe I’ve missed something though?
> Heck, there's a ton of work even getting to the point of understanding what work you need to do.
That is a fair point.
Unfortunately it’s also not novel to this legislation. Running any site that allows for public contributions opens one’s self to lots of different laws from lots of different countries. For some counties in the EU, Nazi content is illegal. Different countries have different rules around copyright. Then there’s laws around data protection, consent, and so on and so forth.
This law certainly doesn’t make things any easier but there has been a requirement to understand this stuff for decades already. So it’s a bit of a stretch to say this one new law suddenly makes a burden to run a site insurmountable.
However I do agree with your more general point that it’s getting very hard to navigate all of these local laws at scale.
> And dismissing the fear of life-changing financial liability as "being spooked" is not helpful.
It’s an unfounded fear though, so my language is fair. You’d use the same language about any other unfounded fear.
This is the crux of the point. People are scared, and I get why. But it’s completely unfounded. If people still want to discriminate against UK IPs then that’s their choice as they have to weigh up the risks as they perceive them. But it doesn’t mean it’s any likelier to happen than, for example, being in a plane crash (to cite another fear people overcome daily).
———
That all said, maybe everyone blocking UK IPs could be a good thing. If everyone shows they don’t consider it safe to operate in the UK then our government might consider revoking this stupid law.
It might help if you referenced the section what defines those requirements.
I don’t recall seeing anything that required such red tape unless there was special circumstances after the fact (for example, reporting child porn that was uploaded to your site, or responding to a police or court order).
But these kinds of rules exist for freedom of information et al too.
Maybe I’ve missed something though?
> Heck, there's a ton of work even getting to the point of understanding what work you need to do.
That is a fair point.
Unfortunately it’s also not novel to this legislation. Running any site that allows for public contributions opens one’s self to lots of different laws from lots of different countries. For some counties in the EU, Nazi content is illegal. Different countries have different rules around copyright. Then there’s laws around data protection, consent, and so on and so forth.
This law certainly doesn’t make things any easier but there has been a requirement to understand this stuff for decades already. So it’s a bit of a stretch to say this one new law suddenly makes a burden to run a site insurmountable.
However I do agree with your more general point that it’s getting very hard to navigate all of these local laws at scale.
> And dismissing the fear of life-changing financial liability as "being spooked" is not helpful.
It’s an unfounded fear though, so my language is fair. You’d use the same language about any other unfounded fear.
This is the crux of the point. People are scared, and I get why. But it’s completely unfounded. If people still want to discriminate against UK IPs then that’s their choice as they have to weigh up the risks as they perceive them. But it doesn’t mean it’s any likelier to happen than, for example, being in a plane crash (to cite another fear people overcome daily).
———
That all said, maybe everyone blocking UK IPs could be a good thing. If everyone shows they don’t consider it safe to operate in the UK then our government might consider revoking this stupid law.
In principle you need to have records of your risk assessment(s) and you need to have good T&Cs (like for GDPR, etc). But that's about it for red tape.
Templates have popped up to help with both.
Templates have popped up to help with both.
Compliance costs are a couple of hours at most to do and record the assessments then the effort and discipline to moderate and react quickly to reports. That's it.
A lot of misplaced fear and over-reactions. For instance, lobste.rs could basically safely ignore the whole thing being a small, low risk forum based in the US.
> It took a fair amount of legal analysis to establish blog comments are OK (and its not clear whether off topic ones are)
It looks like it only took someone to actually read the Online Safety Act, as Ofcom's reply kindly points to the section that quite explicitly answers the question.
I don't think that the Online Safety Act is a good development but many of the reactions are over the top or FUD, frankly...
A lot of misplaced fear and over-reactions. For instance, lobste.rs could basically safely ignore the whole thing being a small, low risk forum based in the US.
> It took a fair amount of legal analysis to establish blog comments are OK (and its not clear whether off topic ones are)
It looks like it only took someone to actually read the Online Safety Act, as Ofcom's reply kindly points to the section that quite explicitly answers the question.
I don't think that the Online Safety Act is a good development but many of the reactions are over the top or FUD, frankly...
If you have examples of this happening, please add them to the ORG list: https://www.blocked.org.uk/osa-blocks
I am very skeptical that the Online Safety Act forces community forums and wikis to close. By and large the Act forces forums to have strong moderation and perhaps manual checks before publishing files and pictures uploaded by users, and that's about it.
Likewise, I suspect that most geoblocks are out of misplaced fear not actual analysis.
Likewise, I suspect that most geoblocks are out of misplaced fear not actual analysis.
It has caused many community forums to close, past tense.
Many cited the uncertainty about what is actually required, the potential high cost of compliance, the danger of failing to correctly follow the rules they're not certain about, and the lack of governmental clarity as significant aspects of their decision to close.
The fear may be misplaced, but the UK government has failed to convince people of that.
Many cited the uncertainty about what is actually required, the potential high cost of compliance, the danger of failing to correctly follow the rules they're not certain about, and the lack of governmental clarity as significant aspects of their decision to close.
The fear may be misplaced, but the UK government has failed to convince people of that.
I don't think it is so much a failure of the government to communicate as a vocal opposition to this law that has focussed on and amplified the maximum penalties and caused fear.
Now, I don't think this is a positive law but it is not armageddon, either, and objectively many reactions do seem overblown. Time will tell.
Now, I don't think this is a positive law but it is not armageddon, either, and objectively many reactions do seem overblown. Time will tell.
It was misplaced but the UK government has a long history of incompetence when it comes to legislation regarding the use of technology. So I cannot blame people being erring on the side of caution.
I mean, it’s not like this particular piece of legislation isn’t stupid to begin with. So I cannot blame people for assuming the worst.
I mean, it’s not like this particular piece of legislation isn’t stupid to begin with. So I cannot blame people for assuming the worst.
“Strong moderation” and “manual checks” and pro-active age verification are exactly the burdens that would prevent someone from running a small community forum.
You do not need age verification in the vast majority of cases.
Moderation is part and parcel of running forums and all platforms and software provide tools for this, it's nothing new. If someone is not prepared to read submissions or to react quickly when one is flagged then perhaps running a forum is too much of a commitment for them but I would not blame the law.
In fact I believe that forum operators in the UK already got in legal trouble in the past, long before the Online Safety Act, because they ignored flagging reports.
Moderation is part and parcel of running forums and all platforms and software provide tools for this, it's nothing new. If someone is not prepared to read submissions or to react quickly when one is flagged then perhaps running a forum is too much of a commitment for them but I would not blame the law.
In fact I believe that forum operators in the UK already got in legal trouble in the past, long before the Online Safety Act, because they ignored flagging reports.
Right, so 24 hour coverage is already too expensive for most forums and your position is that small forums should not exist.
Small forums should and can exist. They are not required to have 24 hour coverage.
You said above "If someone is not prepared to read submissions or to react quickly when one is flagged".
Does the Act specify "quickly"? Does several hours count as "quickly"?
Does the Act specify "quickly"? Does several hours count as "quickly"?
Not the OP but I don’t recall the actual law saying 24/7 moderation was required.
Given the UK already has a “watershed” time where terrestrial TV can broadcast mature content between set hours (from 9pm), I cannot see why the same expectation shouldn’t exist that moderation isn’t happening outside of reasonable hours.
Typically with laws in the UK (and EU too) is to use more generalised language to allow the law a little more flexibility to apply correctly for more nuanced circumstances. Such as what is practical for a small forum to achieve when its specialty isn’t anything to do with adult content.
You’ll definitely find examples where such laws are abused from time to time. But they’re uncommon enough that they make national news and create an uproar. Thus the case goes nowhere due to the political embarrassment that department draws to itself.
Though to be clear, I’m not defending this particular law. It’s stupid and shouldn’t exist.
Given the UK already has a “watershed” time where terrestrial TV can broadcast mature content between set hours (from 9pm), I cannot see why the same expectation shouldn’t exist that moderation isn’t happening outside of reasonable hours.
Typically with laws in the UK (and EU too) is to use more generalised language to allow the law a little more flexibility to apply correctly for more nuanced circumstances. Such as what is practical for a small forum to achieve when its specialty isn’t anything to do with adult content.
You’ll definitely find examples where such laws are abused from time to time. But they’re uncommon enough that they make national news and create an uproar. Thus the case goes nowhere due to the political embarrassment that department draws to itself.
Though to be clear, I’m not defending this particular law. It’s stupid and shouldn’t exist.
Reacting quickly means what's proportionate and reasonable. This is quite standard wording for a law.
The Act (section 10 about illegal content) says that "In determining what is proportionate for the purposes of this section, the following factors, in particular, are relevant—
(a) all the findings of the most recent illegal content risk assessment
(b) the size and capacity of the provider of a service."
"24 hour coverage" is the maximum that can be achieved so it's not going to be proportionate in many, if not most, cases. People have to ask themselves if it is proportionate for a one-man gardening forum to react within 5 minutes at 3am, and the answer is not going to be "yes".
Obviously you can also automatically hide a flagged submission until it is reviewed or have keywords-based checks, etc. I believe these are a common functionalities and they will likely develop more (and yes, a consequence might be to push more people towards big platforms).
People need to have a calm analysis, not hysteria or politically-induced obtuseness whatever one might think of this Act. If they are a small and not in the UK they can probably completely ignore in any case.
The Act (section 10 about illegal content) says that "In determining what is proportionate for the purposes of this section, the following factors, in particular, are relevant—
(a) all the findings of the most recent illegal content risk assessment
(b) the size and capacity of the provider of a service."
"24 hour coverage" is the maximum that can be achieved so it's not going to be proportionate in many, if not most, cases. People have to ask themselves if it is proportionate for a one-man gardening forum to react within 5 minutes at 3am, and the answer is not going to be "yes".
Obviously you can also automatically hide a flagged submission until it is reviewed or have keywords-based checks, etc. I believe these are a common functionalities and they will likely develop more (and yes, a consequence might be to push more people towards big platforms).
People need to have a calm analysis, not hysteria or politically-induced obtuseness whatever one might think of this Act. If they are a small and not in the UK they can probably completely ignore in any case.
More detail: https://medium.com/wikimedia-policy/wikipedias-nonprofit-hos...
It seems to be a fairly standard judicial review: if OFCOM(?) class them as "category 1", they are under a very serious burden, so they want the categorization decision reviewed in court.
It seems to be a fairly standard judicial review: if OFCOM(?) class them as "category 1", they are under a very serious burden, so they want the categorization decision reviewed in court.
I think it will be very hard to write a definition that excludes wikipedia and includes (and I am quoting the article) "many of the services UK society is actually concerned about, like misogynistic hate websites".
Very interested how this goes.
Very interested how this goes.
I can't see any language in the statutory instrument suggesting anyone had any intention of applying it to Wikimedia? The most likely outcome is the court will reassure them of that. This might help other people running similar websites by citing the case rather than having to pay for all the experts but isn't going to magically stop it applying to Meta as intended.
It's in the Medium article.
Scroll to "Who falls under Category 1"
https://medium.com/wikimedia-policy/wikipedias-nonprofit-hos...
Scroll to "Who falls under Category 1"
https://medium.com/wikimedia-policy/wikipedias-nonprofit-hos...
Wikimedia hosts what UK puritans consider pornographic content.
A lot of it. Often in high quality and with a permissible license.
I would link to relevant meta pages but I want to be able travel through LHR.
A lot of it. Often in high quality and with a permissible license.
I would link to relevant meta pages but I want to be able travel through LHR.
Musea of fine arts also host what puritans could consider 'pornographic content'. I believe 'Birth of Venus' is the standard go-to example.
To be fair, Wikimedia/Wikipedia also hosts a full copy of "Debbie Does Dallas" does to a fluke of copyright. See: https://en.wikipedia.org/wiki/Debbie_Does_Dallas
I do kind of wonder if it benefits Wikipedia for them to allow so much on commons.
I get it’s hard to distinguish between pornography and something that might have educational merit at the edges, and have a workable policy.
But still I can’t help but think this is not really helping.
I get it’s hard to distinguish between pornography and something that might have educational merit at the edges, and have a workable policy.
But still I can’t help but think this is not really helping.
I don’t think we disagree.
A kid can go to Wikipedia and read https://en.m.wikipedia.org/wiki/Sex
They can also go to the library and read the encyclopedia.
I'm not sure what you're basing that on?
Have the court filings become available?
Of course, the random PR in the OP isn't going to go through their barrister's arguments.
While I agree that the main thrust of the legislation won't be affected either way, the regulatory framework really matters for this sort of thing.
Plus, win or lose, this will shine a light on some the stupidity of the legislation. Lots of random Wikipedia articles would offend the puritans.
Have the court filings become available?
Of course, the random PR in the OP isn't going to go through their barrister's arguments.
While I agree that the main thrust of the legislation won't be affected either way, the regulatory framework really matters for this sort of thing.
Plus, win or lose, this will shine a light on some the stupidity of the legislation. Lots of random Wikipedia articles would offend the puritans.
It won't go anywhere because in British jurisprudence, Parliament is supreme.
I don't like the OSA and associated regulations as much as the next person -- I think we could have gotten a long way by saying you need to include a X-Age-Rating in http responses and calling it a day. The law itself is incoherently long and it's very difficult to know what duties you have.
However, I don't see what the legal basis of Wikimedia's challenge is. The OSA is primary legislation, so can't be challenged except under the HRA, which I don't really see working. The regulations are secondary regulation and are more open to challenge, but it's not clear what the basis of the challenge is. Are they saying the regulations are outside the scope of the statutory authority (doubtful)? You can't really challenge law or regulation in the UK on the basis of "I don't like it".
However, I don't see what the legal basis of Wikimedia's challenge is. The OSA is primary legislation, so can't be challenged except under the HRA, which I don't really see working. The regulations are secondary regulation and are more open to challenge, but it's not clear what the basis of the challenge is. Are they saying the regulations are outside the scope of the statutory authority (doubtful)? You can't really challenge law or regulation in the UK on the basis of "I don't like it".
X-Age-Rating would only work if the server could be sure of the jurisdictions under which the recipient was bound.
To continue the thought experiment though: another implementation would be to list up to N tags that best describe the content being served. You could base these on various agreed tagging systems such as UN ISIC tagging (6010 Broadcasting Pop Music) or UDC, the successor to the Dewey Decimal System (657 Accountancy, 797 Water Sports etc.) The more popular sites could just grandfather in their own tag zoologies.
A cartoon song about wind surfing:
To continue the thought experiment though: another implementation would be to list up to N tags that best describe the content being served. You could base these on various agreed tagging systems such as UN ISIC tagging (6010 Broadcasting Pop Music) or UDC, the successor to the Dewey Decimal System (657 Accountancy, 797 Water Sports etc.) The more popular sites could just grandfather in their own tag zoologies.
A cartoon song about wind surfing:
X-Content-Tags: ISIC:6010 UDC:797 YouTube:KidsTV
There actually was a proposal/standard for this back in the day: https://www.w3.org/PICS/
> X-Age-Rating would only work if the server could be sure of the jurisdictions under which the recipient was bound.
That's no different to the current legislation.
That's no different to the current legislation.
The twitter API used to have a "illegal in France or Germany" field, which was used for known Nazi content.
They should just block all UK gov IPs in protest
As a Brit, ultimately I think this is the only thing that's going to get through to the government and public.
[deleted]
It may well come to that (and the fact that Wikipedia ends up being banned in the UK will potentially bring people to their senses).
exasperaited(3)
In related news, the Labour party is already considering banning VPNs. We almost got like two days of Online Safety Act in effect.
https://www.gbnews.com/politics/labour-ban-vpn-online-safety...
https://www.gbnews.com/politics/labour-ban-vpn-online-safety...
I hate the Online Safety Act as much as the next person, but:
- Labour have made no plans to ban VPNs.
- One MP wanted to add a clause for a government review into the impact of VPNs on the bill after 6 months, with no direction on what that would mean.
- I have no idea if this clause actually got added, but it'd make sense. If you're going to introduce a stupid law you should at least plan to review if the stupid law is having any impact.
- GB news is bottom of the barrel propaganda.
- Labour have made no plans to ban VPNs.
- One MP wanted to add a clause for a government review into the impact of VPNs on the bill after 6 months, with no direction on what that would mean.
- I have no idea if this clause actually got added, but it'd make sense. If you're going to introduce a stupid law you should at least plan to review if the stupid law is having any impact.
- GB news is bottom of the barrel propaganda.
> clause for a government review into the impact of VPNs on the bill after 6 months
thats government speak for deciding to do something about the VPN problem. because there is no way a commission will not find a good reason to ban VPNs when you reach that point, because you could argue they help avoid UK restrictions.
thats government speak for deciding to do something about the VPN problem. because there is no way a commission will not find a good reason to ban VPNs when you reach that point, because you could argue they help avoid UK restrictions.
You're repeating propaganda from a far right newspaper headline, written misleadingly to make it sound like labour have said something recently about VPNs (they haven't)
I don't care where the headline is from. Other places have the same suspicion. There clearly is _some_ concern in Labour that VPNs could be used to bypass the OSA and it doesn't take much imagination to see where this is going.
'Kyle told The Telegraph last week in a warning: "If platforms or sites signpost towards workarounds like VPNs, then that itself is a crime and will be tackled by these codes."'
https://www.tomsguide.com/computing/vpns/what-does-the-labou... :
"In 2022 when the Online Safety Act was being debated in Parliament, Labour explicitly brought up the subject of VPNs with MP Sarah Champion worried that children could use VPNs to access harmful content and bypass the measures of the Safety Act. "
https://www.independent.co.uk/news/uk/politics/vpns-online-s...
Sure. Nothing was said directly right now, but to just take Labour's word for it that they won't go further with these restrictions is really naive.
'Kyle told The Telegraph last week in a warning: "If platforms or sites signpost towards workarounds like VPNs, then that itself is a crime and will be tackled by these codes."'
https://www.tomsguide.com/computing/vpns/what-does-the-labou... :
"In 2022 when the Online Safety Act was being debated in Parliament, Labour explicitly brought up the subject of VPNs with MP Sarah Champion worried that children could use VPNs to access harmful content and bypass the measures of the Safety Act. "
https://www.independent.co.uk/news/uk/politics/vpns-online-s...
Sure. Nothing was said directly right now, but to just take Labour's word for it that they won't go further with these restrictions is really naive.
It may not be recent but it is something that Labour MPs have said before in the context of the OSA.
The Labour think tank Labour Together also recently brought up a manditory goverenment ID called BritCard, ostensibly for government services but to be rolled out else where.
At the same time they've just set up an elite police force to monitor social media.
Labour must know people are rattled by all this, they just published a response to the petiion they recieved.
They're not addressing any concerns though, it's all we know best or shutting down debate with slurs.
In the absence of anything new we just have to take Labour policy on the last things they've said or done.
The Labour think tank Labour Together also recently brought up a manditory goverenment ID called BritCard, ostensibly for government services but to be rolled out else where.
At the same time they've just set up an elite police force to monitor social media.
Labour must know people are rattled by all this, they just published a response to the petiion they recieved.
They're not addressing any concerns though, it's all we know best or shutting down debate with slurs.
In the absence of anything new we just have to take Labour policy on the last things they've said or done.
I think that article references a discussion from 2022 rather than something new as the headline implies.
GB News is about as reliable as Fox News. I suggest you get your news somewhere else.
A lot of people in this thread seem to enjoy the taste of boot and are spending a lot of words trying to say the OSA isn't a big deal. A bit of a sad attitude for a forum called HackerNews. This is massive overreach by the government, we shouldn't have to ID ourselves to message friends on bluesky, read homebrew forums or, soon, use xbox voice chat. The government won't give up this power, it's clearly the thin end of the wedge.
Related: I have just written a brief overview of how I understand the Online Safety Act to apply to owners of forums without 'adult' content, e.g. forums hosted by product companies, about their products.
https://successfulsoftware.net/2025/07/29/the-online-safety-...
https://successfulsoftware.net/2025/07/29/the-online-safety-...
This is full of contradictions and both-sides-of-the-mouth speech. You can't coherently argue for an "open internet" "for everyone", and simultaneously plead exceptionalism for your own website, due its special virtues[0]. An "open internet" for websites with sterling reputations is a closed internet. It's an internet where censorship segregates the desirable from undesirable; where websites must plead their case to the state, "please let me exist, for this reason: ..." That's not what "open" means!
And moreover: WF's special pleading is[1], paraphrased, "because we already strongly moderate in exactly the ways this government wants, so there's no need to regulate *us* in particular". That's capitulation; or, they were never really adverse in the first place.
Wikimedia's counsel is of course pleading Wikimedia's own interests[2]. Their interests are not the same as the public's interest. Don't confuse ourselves: if you are not a centimillionaire entity with sacks full of lawyers, you are not Wikimedia Foundation's peer group.
[0] ("It’s the only top-ten website operated by a non-profit and one of the highest-quality datasets used in training Large Language Models (LLMs)"—to the extent anyone parses that as virtuous)
[1] ("These volunteers set and enforce policies to ensure that information on the platform is fact-based, neutral, and attributed to reliable sources.")
[2] ("The organization is not bringing a general challenge to the OSA as a whole, nor to the existence of the Category 1 duties themselves. Rather, the legal challenge focuses solely on the new Categorisation Regulations that risk imposing Category 1 duties (the OSA’s most stringent obligations) on Wikipedia.")
And moreover: WF's special pleading is[1], paraphrased, "because we already strongly moderate in exactly the ways this government wants, so there's no need to regulate *us* in particular". That's capitulation; or, they were never really adverse in the first place.
Wikimedia's counsel is of course pleading Wikimedia's own interests[2]. Their interests are not the same as the public's interest. Don't confuse ourselves: if you are not a centimillionaire entity with sacks full of lawyers, you are not Wikimedia Foundation's peer group.
[0] ("It’s the only top-ten website operated by a non-profit and one of the highest-quality datasets used in training Large Language Models (LLMs)"—to the extent anyone parses that as virtuous)
[1] ("These volunteers set and enforce policies to ensure that information on the platform is fact-based, neutral, and attributed to reliable sources.")
[2] ("The organization is not bringing a general challenge to the OSA as a whole, nor to the existence of the Category 1 duties themselves. Rather, the legal challenge focuses solely on the new Categorisation Regulations that risk imposing Category 1 duties (the OSA’s most stringent obligations) on Wikipedia.")
This is a fine sentiment, could you also please provide an alternative approach?
The law has passed, Wikipedia has to enforce that law but don’t wish to because of privacy concerns.
What should Wikimedia now do? Give up? Ignore the laws of the UK? Shutdown in the UK? What exactly are the options for wikimedia?
The law has passed, Wikipedia has to enforce that law but don’t wish to because of privacy concerns.
What should Wikimedia now do? Give up? Ignore the laws of the UK? Shutdown in the UK? What exactly are the options for wikimedia?
> "This is a fine sentiment, could you also please provide an alternative approach?"
https://news.ycombinator.com/item?id=3477966 ("Wikipedia blackout page (wikipedia.org)" (2012))
Wikimedia weren't always a giant ambulating pile of cash; they used to be activists. Long ago.
https://news.ycombinator.com/item?id=3477966 ("Wikipedia blackout page (wikipedia.org)" (2012))
Wikimedia weren't always a giant ambulating pile of cash; they used to be activists. Long ago.
> Wikimedia weren't always a giant ambulating pile of cash; they used to be activists. Long ago.
Your point is moot because this wasn’t a WMF initiative, it was an enwiki community initiative which WMF agreed to accommodate.
The history is detailed… on Wikipedia… https://en.wikipedia.org/wiki/Protests_against_SOPA_and_PIPA...
Your point is moot because this wasn’t a WMF initiative, it was an enwiki community initiative which WMF agreed to accommodate.
The history is detailed… on Wikipedia… https://en.wikipedia.org/wiki/Protests_against_SOPA_and_PIPA...
Warn the UK users during the grace period as best as they can.
And after the grace period... yeah, I think blocking UK IPs is the "correct" thing to do. If the government doesn't make them an exception than they'll have to do that, correct or not, anyway.
And after the grace period... yeah, I think blocking UK IPs is the "correct" thing to do. If the government doesn't make them an exception than they'll have to do that, correct or not, anyway.
I think the people of the UK have little or nothing to do with this.
UK is a representative democracy meaning that voters get a voice every X years to vote for a representative that they assume will act in their favour and on their behalf.
What this representative does in their time in power is very much left to the representative and not the voters.
On the other hand, if this were to be a direct democracy then the voters would have been asked before this law was voted on. For example, a referendum might well have been held.
Perhaps a more nuanced approach would be to block all IPs of government organisations - difficult but far more approriate.
UK is a representative democracy meaning that voters get a voice every X years to vote for a representative that they assume will act in their favour and on their behalf.
What this representative does in their time in power is very much left to the representative and not the voters.
On the other hand, if this were to be a direct democracy then the voters would have been asked before this law was voted on. For example, a referendum might well have been held.
Perhaps a more nuanced approach would be to block all IPs of government organisations - difficult but far more approriate.
> Shutdown in the UK?
Yes. This is what every single large company which is subject to this distopian law should do. They should do everything they can to block any traffic from the UK, until the law is repelled.
Yes. This is what every single large company which is subject to this distopian law should do. They should do everything they can to block any traffic from the UK, until the law is repelled.
large companies love this law.
By imposing costs and risk on self hosting, and reducing the number of supplies (because many small and medium companies and organisation will block the UK), it reduces competition.
By imposing costs and risk on self hosting, and reducing the number of supplies (because many small and medium companies and organisation will block the UK), it reduces competition.
The reality is the vast majority of users will just not submit their ID and the large companies will lose most of their UK traffic.
There was a study by Amazon [1] that showed that every 100ms of extra load time of a page cost 1% of revenue. How much revenue do you think adding an ID verification that takes 10 minutes to complete cost???
You think PornHub loves this law???
[1] https://www.conductor.com/academy/page-speed-resources/faq/a...
There was a study by Amazon [1] that showed that every 100ms of extra load time of a page cost 1% of revenue. How much revenue do you think adding an ID verification that takes 10 minutes to complete cost???
You think PornHub loves this law???
[1] https://www.conductor.com/academy/page-speed-resources/faq/a...
Very possibly. It will be an excuse to gather more user data. Will the lost users be the valuable ones for their business model? Also, once people have registered with a site, it imposes a switching cost, so it does favour incumbents over new entrants.
There must be smaller sites in the same business that will block UK users rather than comply.
So, they very likely do.
What is more important is that the tech giants, and social media in particular does love this law. As I pointed out in another comment, and has been reported many times on HN before, they have already gained users as people switch from independent forums to social media, and in the future it will keep competition out.
There must be smaller sites in the same business that will block UK users rather than comply.
So, they very likely do.
What is more important is that the tech giants, and social media in particular does love this law. As I pointed out in another comment, and has been reported many times on HN before, they have already gained users as people switch from independent forums to social media, and in the future it will keep competition out.
The grapevine says that independent sex workers are struggling as a result of the Online Safety Act. Unless the law has significantly reduced the tendency for UK people to engage with internet porn (which I doubt), then yes, PornHub is benefiting from this law.
Independent sex workers upload their content on websites that are affected by the OSA, like PornHub and OnlyFans, this is why they are struggling.
A lot of PornHub's content comes from independants, not big studios.
A lot of PornHub's content comes from independants, not big studios.
Shut down in the UK seems like a reasonable approach.
If UK wants to be more like China: let them.
If UK wants to be more like China: let them.
> Shutdown in the UK?
That might actually be one of the few things that would help.
That might actually be one of the few things that would help.
One of the complaints against OSA is how easy it's proven to circumvent, evidenced by the massive increase in VPN usage.
So it would be interesting to understand if shutting down in the UK would have an impact, now we all had to learn how to circumvent georestrictions this past week.
So it would be interesting to understand if shutting down in the UK would have an impact, now we all had to learn how to circumvent georestrictions this past week.
Laws get challenged and overturned all the time. I doubt it will happen this time, can't have wrongthink.
They can build a solid legal case on their exceptionalism _and_ hope the court uses it as an opportunity to more widely protect the open Internet.
The fact that the letter of the law means you can't have an open Internet isn't their fault.
No one asked for this. Don’t blame parents. This is the government using the Four Horsemen of the Infocalypse to restrict your personal freedoms.
Can anyone explain how Wikipedia supposedly is in Category 1? [1]
And if it marginally is, how come they cannot just turn off their "content recommender system"? Perhaps an example is the auto-generated "Related articles" that appear in the footer on mobile only?
[1] https://www.legislation.gov.uk/uksi/2025/226/regulation/3/ma...
And if it marginally is, how come they cannot just turn off their "content recommender system"? Perhaps an example is the auto-generated "Related articles" that appear in the footer on mobile only?
[1] https://www.legislation.gov.uk/uksi/2025/226/regulation/3/ma...
The definition is:
> In paragraph (1), a “content recommender system” means a system, used by the provider of a regulated user-to-user service in respect of the user-to-user part of that service, that uses algorithms which by means of machine learning or other techniques determines, or otherwise affects, the way in which regulated user-generated content of a user, whether alone or with other content, may be encountered by other users of the service.
Speculating wildly, I think a bunch of the moderation / patroller tools might count. They help to find revisions ("user-generated content") that need further review from other editors ("other users").
There's not much machine learning happening (https://www.mediawiki.org/wiki/ORES), but "other techniques" seems like it'd cover basically-anything up to and including "here's the list of revisions that have violated user-provided rules recently" (https://www.mediawiki.org/wiki/Extension:AbuseFilter).
(Disclaimer: I work for the WMF. I know literally nothing about this court case or how this law applies.)
> In paragraph (1), a “content recommender system” means a system, used by the provider of a regulated user-to-user service in respect of the user-to-user part of that service, that uses algorithms which by means of machine learning or other techniques determines, or otherwise affects, the way in which regulated user-generated content of a user, whether alone or with other content, may be encountered by other users of the service.
Speculating wildly, I think a bunch of the moderation / patroller tools might count. They help to find revisions ("user-generated content") that need further review from other editors ("other users").
There's not much machine learning happening (https://www.mediawiki.org/wiki/ORES), but "other techniques" seems like it'd cover basically-anything up to and including "here's the list of revisions that have violated user-provided rules recently" (https://www.mediawiki.org/wiki/Extension:AbuseFilter).
(Disclaimer: I work for the WMF. I know literally nothing about this court case or how this law applies.)
Perhaps they genuinely believe the mission of collecting all the world’s knowledge is more important than complying with the draconian moral panic of a likely short lived government in an increasingly irrelevant former great power.
Are you saying an algorithmic content recommendation system is an important part of "collecting all the world's knowledge"?
I think one of the most chilling aspects of this roll out has the attempts to shutdown debate about security concerns with handing over biometrics to unknow entities.
That's even to just access mainstream services such as direct messaging on social media sites.
The most high profile example of this is the Technology Secretary Peter Kyle comparing Nigel Farage to a sex offender, specifically Jimmy Saville.
Regardless of what you think of Farrage[1], that's a terrible thing to say. There are ligitimate concerns about this Act.
The ICO is charged with protecting privacy and punishing breaches of personal information due to incompetence. Well they've never prosecuted an organisation for a biometric data breach.
Until the ICO actually has teeth, and uses them, they shouldn't have introduced these restrictions and that's before we even get to the fact that the Act doesn't achieve what it say it will.
1. ...and I have very little positive to say about him but he is still an opposition MP and it is his job to oppose the government.
That's even to just access mainstream services such as direct messaging on social media sites.
The most high profile example of this is the Technology Secretary Peter Kyle comparing Nigel Farage to a sex offender, specifically Jimmy Saville.
Regardless of what you think of Farrage[1], that's a terrible thing to say. There are ligitimate concerns about this Act.
The ICO is charged with protecting privacy and punishing breaches of personal information due to incompetence. Well they've never prosecuted an organisation for a biometric data breach.
Until the ICO actually has teeth, and uses them, they shouldn't have introduced these restrictions and that's before we even get to the fact that the Act doesn't achieve what it say it will.
1. ...and I have very little positive to say about him but he is still an opposition MP and it is his job to oppose the government.
"The organization is not bringing a general challenge to the OSA as a whole, nor to the existence of the Category 1 duties themselves. Rather, the legal challenge focuses solely on the new Categorisation Regulations that risk imposing Category 1 duties (the OSA’s most stringent obligations) on Wikipedia."
I find this a very unprincipled stance.
I find this a very unprincipled stance.
I'm surprised they haven't deployed a big banner à la Jimmy Wales begging for donations to UK users re this law yet
I think most Wikimedia users would consider it inapropriate to mix fundraising and public policy initiatives.
They previously did a 24 hour blackout to protest SOPA.
https://en.wikipedia.org/wiki/Protests_against_SOPA_and_PIPA...
https://en.wikipedia.org/wiki/Protests_against_SOPA_and_PIPA...
Literally more then a decade ago. Also they didn't mix it together with fundraiser.
I believe public policy initiatives are already Wikimedia's second-biggest expenses, after salaries, so I don't see how that would be much more different than usual fundraising except for making it more transparent.
In 2023 (most recent year i could find a tax statement for) Wikimedia foundation had a budget of $178,588,294. They spent $92,616 of it on lobbying. That is 0.05% of their budget. So i think its pretty clear its not their second biggest expense.
https://upload.wikimedia.org/wikipedia/foundation/d/d9/Wikim...
https://upload.wikimedia.org/wikipedia/foundation/d/d9/Wikim...
All this is of course bullshit. The only response that would have a chance of succeeding would have been if most websites collectively just blocked everyone from the UK. Imagine if 60-70% of the internet just stopped working for UK People. The law would be toppled tomorrow.
Every Company that implemented any compliance is a traitor to the free internet and should be treated as such.
Every Company that implemented any compliance is a traitor to the free internet and should be treated as such.
The UK is the perfect target - globally relevant enough to make the news, small enough that its a financial rounding error. Take action, carry through with the threat and if your product actually matters - attitudes can change globally.
While the law would not be toppled tomorrow, the companies of the internet need to stop being so desperate for small scraps of money and eyeballs.
The internet might be free if companies instead of trying to skirt laws and regulations just operated where they are welcome. Good for the internet but bad for the VCs so it wont happen.
While the law would not be toppled tomorrow, the companies of the internet need to stop being so desperate for small scraps of money and eyeballs.
The internet might be free if companies instead of trying to skirt laws and regulations just operated where they are welcome. Good for the internet but bad for the VCs so it wont happen.
I live in the UK. Please for the love of all that is sweet and holy DO THIS! The only way our politicians will learn is if the public outcry is so fierce it makes them fear for their jobs.
A UK internet blockade might just get this going.
A UK internet blockade might just get this going.
The issue here is that the internet is dominated by large companies that have a huge incentive to use this as a way to ensure regulatory capture of the free internet.
I'm not following the logic, how would this work?
Take Reddit as an example: Reddit became big after Digg fucked up their mainpage and has replaced most hobby forums and discussions on the internet. A competitor to it would have to implement a lot of compliance stuff like age verification and that would be very expensive, making it harder for a competitor to be bootstrapped. That's why Reddit has an incentive to support such regulation, even if it costs them a lot. Once implemented, competition becomes harder and harder.
Aaah, got you, thanks. I'd incorrectly assumed "this" in your original post meant Wikimedia's challenge, rather than the OSA itself.
The large tech companies benefited immensely from relative few regulations in the 2000-2010s. Once they are established, they are happy to comply with regulations which will make it more difficult for competitor to even exist since complying with regulations is often prohibitively expensive for new player.
It is known colloquially as "Pulling up the ladder behind you".
https://en.wikipedia.org/wiki/I%27m_alright,_Jack
It is known colloquially as "Pulling up the ladder behind you".
https://en.wikipedia.org/wiki/I%27m_alright,_Jack
This law could be brought down overnight by Meta if they introduced age-control for WhatsApp and suddenly people couldn't message their own children.
But of course Meta carved out their own exception in the law, so this law benefits Meta at the cost of alternatives.
But of course Meta carved out their own exception in the law, so this law benefits Meta at the cost of alternatives.
I think that's kind of the joke as well, because WhatsApp (being totally unmoderated and opaque) is probably the exact place you'd want to enact age controls, especially in groups.
It's like the government thought long and hard about how to make the restrictions the most inconvenient and with the largest number of gaps in the approach.
It's like the government thought long and hard about how to make the restrictions the most inconvenient and with the largest number of gaps in the approach.
Most websites, for most people, are big tech. Big tech loves this regulation because imposing compliance costs reduces competition.
The problem is, that both pornhub and facebook also love underage (well, too young) users, because those users will stay there.
Cutting off UK for a few weeks won't cause that much damage but might help them in the long run.
Cutting off UK for a few weeks won't cause that much damage but might help them in the long run.
These laws don't cause any problems for PornHub or Facebook. People are moving from independent forums to Facebook.
"Every Company that implemented any compliance is a traitor to the free internet and should be treated as such."
What would be the punishment for that?
What would be the punishment for that?
> What would be the punishment for that?
On a legal level? None. On a personal level? Don't give them money or your business. Avoid them completely or ensure you use ad blockers on their sites and throw away accounts if necessary. Do not contribute to their content.
In short: you take whatever they give you, and you give nothing in return.
On a legal level? None. On a personal level? Don't give them money or your business. Avoid them completely or ensure you use ad blockers on their sites and throw away accounts if necessary. Do not contribute to their content.
In short: you take whatever they give you, and you give nothing in return.
Vote with your feet.
https://en.wikipedia.org/wiki/Foot_voting
https://en.wikipedia.org/wiki/Foot_voting
>Every Company that implemented any compliance is a traitor to the free internet and should be treated as such.
Companies can be fined £18 million pounds or 10% of revenue, whichever is greater. If you feel like being the first test case, be my guest.
Companies can be fined £18 million pounds or 10% of revenue, whichever is greater. If you feel like being the first test case, be my guest.
All companies could easily just block UK Users instead.
They could. But it is the world's 6th largest economy.
The headline seems a little misleading. From the article:
> The Wikimedia Foundation shares the UK government’s commitment to promoting online environments where everyone can safely participate. The organization is not bringing a general challenge to the OSA as a whole, nor to the existence of the Category 1 duties themselves. Rather, the legal challenge focuses solely on the new Categorisation Regulations that risk imposing Category 1 duties (the OSA’s most stringent obligations) on Wikipedia.
> The Wikimedia Foundation shares the UK government’s commitment to promoting online environments where everyone can safely participate. The organization is not bringing a general challenge to the OSA as a whole, nor to the existence of the Category 1 duties themselves. Rather, the legal challenge focuses solely on the new Categorisation Regulations that risk imposing Category 1 duties (the OSA’s most stringent obligations) on Wikipedia.
Is Wikipedia actually Category 1?
Seems to require an algorithmic feed to be Category 1 - https://www.legislation.gov.uk/ukdsi/2025/9780348267174
Seems to require an algorithmic feed to be Category 1 - https://www.legislation.gov.uk/ukdsi/2025/9780348267174
How is "algorithmic feed" related to safety? Or is it, along with seemingly arbitrary numbers like 7 or 34 millions, a way to target a specific platform for those who are afraid to spell the name explicitly?
One of the main motivations for this law was pro-suicide and pro-anorexia content being pushed to teenage girls. In particular Molly Russell's death received a lot of press coverage and public outrage at tech companies. The coroner's report basically said Instagram killed her. https://en.m.wikipedia.org/wiki/Death_of_Molly_Russell
Of course if you get your news from HN then the motivation is actually something to do with limiting discussion of immigration or being dystopian just because.
But yes, if they could just name Instagram and TikTok they probably would.
Of course if you get your news from HN then the motivation is actually something to do with limiting discussion of immigration or being dystopian just because.
But yes, if they could just name Instagram and TikTok they probably would.
Is search results 'an algorithmic feed'.
The phrase they actually use is "content recommender system". The definition is in the link; you could maybe see some search features falling into it but I don't see how Wikipedia as it exists now is Category 1.
Their homepage certainly is.
The homepage is manually edited isn't it?
There have been no edits for the last 6 days; then 18 days prior to that. I don't think so.
You're correct that the wikicode on the main page only gets touched rarely. It is mostly transcluding templates, which do get altered more regularly!
So the hearing was on 22+23rd, is there a writeup of how it went and when we might hear the outcome?
Yep case was heard last week but no decision returned yet:
https://www.edinburghnews.scotsman.com/news/uk/online-safety...
https://www.edinburghnews.scotsman.com/news/uk/online-safety...
This is a failure of Operating System Vendors, in my opinion.
If Operating Systems had a way for parents to adequately monitor/administer the machines of their children, this would not be such a huge, massive hole, in which to pour (yet more) human rights abuses.
Parents have the right to have an eye on their children. This is not repressive, it is not authoritarian, it is a right and a responsibility.
The fact that I can't - easily, and with little fuss - quickly see what my kids are viewing on their screens, is the issue.
Sure, children have the right to privacy - but it is their parents who should provide it to them. Not just the state, but the parents. And certainly, the state should not be eliminating the rest of society's privacy in the rush to prevent parents from having oversight of - and responsibility for - the online activities of their children.
The fact is, Operating System Vendors would rather turn their platforms into ad-vending machines, than actually improve the means by which the computers are operated by their users.
It would be a simple thing to establish parent/child relationship security between not just two computers, but two human beings who love and trust each other.
Kids will always be inquisitive. They will always try to exceed the limits imposed upon them by their parents. But this should not be a reason for more draconian control over consenting adults, or indeed individual adults. It should be a motivating factor to build better computing platforms, which can be reliably configured to prevent porn from having the detrimental impact many controllers of society have decided is occurring.
Another undeniable fact, is that parents - and parenting - get a bad rap. However, if a parent and child love and trust each other, having the ability to quickly observe the kids computing environment in productive ways, should be being provided, technologically.
When really, we should be building tools which strengthen parent/child relationships, we are instead eradicating the need for parents.
Unpopular opinion, I know: but Thats The Point.
If Operating Systems had a way for parents to adequately monitor/administer the machines of their children, this would not be such a huge, massive hole, in which to pour (yet more) human rights abuses.
Parents have the right to have an eye on their children. This is not repressive, it is not authoritarian, it is a right and a responsibility.
The fact that I can't - easily, and with little fuss - quickly see what my kids are viewing on their screens, is the issue.
Sure, children have the right to privacy - but it is their parents who should provide it to them. Not just the state, but the parents. And certainly, the state should not be eliminating the rest of society's privacy in the rush to prevent parents from having oversight of - and responsibility for - the online activities of their children.
The fact is, Operating System Vendors would rather turn their platforms into ad-vending machines, than actually improve the means by which the computers are operated by their users.
It would be a simple thing to establish parent/child relationship security between not just two computers, but two human beings who love and trust each other.
Kids will always be inquisitive. They will always try to exceed the limits imposed upon them by their parents. But this should not be a reason for more draconian control over consenting adults, or indeed individual adults. It should be a motivating factor to build better computing platforms, which can be reliably configured to prevent porn from having the detrimental impact many controllers of society have decided is occurring.
Another undeniable fact, is that parents - and parenting - get a bad rap. However, if a parent and child love and trust each other, having the ability to quickly observe the kids computing environment in productive ways, should be being provided, technologically.
When really, we should be building tools which strengthen parent/child relationships, we are instead eradicating the need for parents.
Unpopular opinion, I know: but Thats The Point.
Mobile operating systems have very great children controls. You should research the topic yourself and you will see.
I'm a parent, I have researched it, and found it not great because it still involves third parties and doesn't promote local control/anonymity without involving some external entity - i.e. Apple requires accounts, Google still gets its metrics, etc.
Unless you've got some specific better examples?
Unless you've got some specific better examples?
Too bad they can't prevent fully grown adults from acting like children.
This told me all I needed to know about her level of understanding of complex topics. It only went downhill from there.