The Online Safety Bill (UK); what are your thoughts?

[Matt N]

Hi guys. In recent days, the much-hyped Online Safety Bill, a hang-over from the Tory government that is possibly one of the most far-reaching pieces of internet legislation ever, came into force in the UK on Friday: https://www.bbc.co.uk/news/articles/c0epennv98lo

For those not aware of what the bill legislates, here’s a link that should explain the basic gist: https://www.burges-salmon.com/our-thinking/online-safety-act-an-overview/

With this being one of the most far-reaching pieces of internet legislation ever, I’d be intrigued to ask this particular group of internet users: what do you think of it?

I don't want to sound right-wing, but I'll admit that I'm not sure if I agree with this legislation.

I completely get the sentiment behind it. Very few people would disagree that current legislation makes the internet too unrestricted for children and teenagers; some of the statistics (for example, 50% of 13-year-olds have seen "hardcore, misogynistic pornography") are quite sobering. Something definitely needs to change.

However, I'm not sure that this legislation is the answer, for a couple of reasons.

Firstly, I have my concerns about the rather blunt way in which the legislation seemingly forces any site with "user-generated content" to abide by the very draconian requirements. Yes, the likes of Facebook and X come to mind, but sites like Wikipedia are also getting pulled into this and are threatening to restrict their service in the UK, and smaller sites like CoasterForce are also covered by the legislation (indeed, I’m aware that the Advertisements forum had to disappear earlier this year as a direct result of the legislation). I fear that the blunt way in which this legislation has been implemented could potentially make many discussion boards shut up shop or pair back their services. Forums like CoasterForce have been an absolutely brilliant thing for me, and I wouldn't want other enthusiasts of anything to miss out on such a brilliant thing because of some ham-fisted legislation that reached too far.

Secondly, I also have my concerns about the idea of mandatory age verification on adult sites. It's a sound idea on paper; it's adult content, so people should be verified like they are to buy beer. But I don't think it's quite that simple in practice. Age verification on a website is much more complex and introduces many more minefields than age verification in a shop, nightclub or similar in-person environment. In the in-person environment, you flash your driving licence, passport or whatever at the shop assistant, and they likely forget your information almost as soon as you've made your purchase or obtained entry to your business. But the online world does not forget that easily. Any age verification process on a website would store the information given for verification in some capacity, likely in some kind of database. Now some will say "if you have nothing to hide, you have nothing to fear"... but I'm not sure I agree. Data breaches are a legitimate threat for any database, and while pornography is legal and many adults consume it, I'm quite sure that most, if not all, users of adult sites would not want their usage information from these sites to be paired to personally identifiable information and leaked in a data breach. A database of age verification information that would almost definitely be identifiable paired with usage information from adult sites sounds like it's asking for a ransomware or sextortion attack... budding cyber criminals will absolutely love that! And frankly, I think there are also questions to be asked about privacy; there's a definite argument that this would strongly impede many people's privacy even before you take the data breach potential into account.

So for the reasons given, I'm definitely unsure on whether I agree with this legislation. I don't deny that the intention is noble, and I agree with the sentiment, but I think it's too far-reaching and has privacy implications, and I'm not sure it's the answer to this issue. I wonder if the answer should lie in legislation more specific to children and teenagers and/or larger social media sites, perhaps with regard to parental controls.

What does anybody else think? I’d be really interested to know.

 

[Hixee]

My thoughts in brief: Decent idea in principle. Poorly implemented.

Given a VPN (or fake ID from Google Images/etc) bypasses all of the safeguards within seconds, AND that it's relying on 'random' external companies offering the verification service, means it's effectively pointless and a good way to have all your personal data leaked in a few months time.

CF has had to comply, @Ian and I wrote the Risk Assessment back at the start of the year and will update it annually for compliance, so there should be little-to-no impact on everyday users. A few backend changes to 'tick the box' and we're good to go. The reason we've not posted anything about it is that it's so minor in the grand scheme of things for us, that it felt like it didn't warrant it.

 

[Matt N]

CF has had to comply, @Ian and I wrote the Risk Assessment back at the start of the year and will update it annually for compliance, so there should be little-to-no impact on everyday users. A few backend changes to 'tick the box' and we're good to go. The reason we've not posted anything about it is that it's so minor in the grand scheme of things for us, that it felt like it didn't warrant it.

It’s good to hear that it has had a relatively minimal impact on CF. I know some discussion boards have closed as a result of the costs of compliance, and I know that there have been concerns raised about smaller discussion boards prior to the implementation of the legislation.

Out of curiosity; if you’re able to divulge this information, what sort of hoops does the CF site management now have to jump through as a result of the legislation? Some people have implied that a lot of new steps have been put into place as requirements, but others have implied that the new requirements are less stringent.

The only change I’ve really noticed from the user end is the disappearance of the Advertisements forum, for reasons I’ll admit I’m not quite sure of.

 

[Hixee]

It’s good to hear that it has had a relatively minimal impact on CF. I know some discussion boards have closed as a result of the costs of compliance, and I know that there have been concerns raised about smaller discussion boards prior to the implementation of the legislation.

Out of curiosity; if you’re able to divulge this information, what sort of hoops does the CF site management now have to jump through as a result of the legislation? Some people have implied that a lot of new steps have been put into place as requirements, but others have implied that the new requirements are less stringent.

The only change I’ve really noticed from the user end is the disappearance of the Advertisements forum, for reasons I’ll admit I’m not quite sure of.

Part of the reason you've barely noticed any changes is that the legislation doesn't really affect us. We've complied more through a case of "easier to do than the argument down the line", rather than it really being an issue for us. It's stuff like raising the minimum signup age, reducing the amount of info displayed on your public profile, a few tweaks to the reporting process and new signup messages, etc. Things that you won't likely notice.

Removing the Advertisements and Comments forums was a way of reducing the likelihood of someone posting something "off topic" in the grand scheme of CF. Notwithstanding that it attracted a lot of spam, it's easier for the Risk Assessment if you can say "we have no sub-forums where people can post content like this", rather than make a load more faff to manage it. This forum (Anything Goes) and General Polls are a bit easier to police as they see less traffic - albeit the use of the Advertisements forum had already dropped off a lot over the years.

We haven't got any real additional cost associated with this (yet), as the age verification software isn't mandatory for our 'risk profile' and so it's things we can manage ourselves. Many more specialist forums (best examples I've heard are smaller/local addiction support based forums, but I bet there are plenty of others) will have had a harder time - which I think is a huge oversight of the OSA in it's current form.

We haven't shared this widely, not because I think any of it is secret, per se, more that it's quite boring really. Of course, @Ian or @furie may come in and delete/edit my posts if they think I'm oversharing our implementation.

 

[DJ Tripper]

The legislation is about 30 years too late. It's an absolute joke and shameful that our leaders have done nothing about it until now.

Having said this I don't know anything about the actual legislation itself. I just think that the fact noone has done anything to restrict access to what can be horrific content until now is a compete and utter failure.

 

[East Coast Mariner]

Well, my gut instinct is not a good one, but I'll try to be a bit balanced about it. What the Act describes as "illegal content" is of course disgusting, and I don't think many people would object to a crackdown on it. But it goes without saying, they should have been doing that anyway. I also concede that there genuinely are "new offences" (the ones that came into effect 31 January 2024) that were difficult to conceive of when the Web was new, such as cyberflashing or epilepsy trolling. With those, I say "About time".

Perhaps controversially, I do not think legal erotica is an enormous issue, and you can see the problems with the age checks coming a mile off. It reminds me of the Horizon Post Office scandal, where the problem should have been obvious, but no one seemed to put two and two together. As ever, MPs vote with no care about the collateral damage.

However, perhaps the biggest red flag for me is the mention of "misinformation":

How the Act tackles Misinformation and Disinformation

Category 1 services will also need to remove certain types of mis- and disinformation if they are prohibited in their terms of services.

Misinformation is being unintentionally wrong, whereas disinformation is being deliberately wrong, i.e. lying. Well, I agree with them about deliberate lies, and when I see members of the last government in prison, I'll believe they mean it too! As for misinformation, who is the Government to be an arbiter of truth? In recent years I have found it far more beneficial to listen to alternative media rather than anything mainstream. What they call "misinformation" is often simply an inconvenient truth. I say this: No theory, idea or opinion should ever be censored.

When they say Category 1, they define that as "Large user-to-user services", so I assume they mean Twitter, Facebook, YouTube etc. And that is what I fear this is really about. The Government has lied to us, in the most serious fashion. They know we're onto them. When they decide to pull their next stunt, our only real power is non-belief, non-compliance and talking to each other about it. And this Act could take away that last one. Remember, free speech is not just the ability to say what you like, it's also the right to hear other people's arguments. With that in mind, I prefer to keep deciding what is "misinformation" for myself.

 

[Nitefly]

There’s lots of interesting aspects to this

First, many people assume the ‘ongoing concern’ with porn is a ‘moral’ one. It’s not: ‘internet porn’ is pretty much dreadful for the mental health of persons of all ages, especially children. It’s like junk food; our minds are not “built” to deal with the abundance of ‘supernormal goodies’ and even moderate indulgence can result in ‘getting fat’. But unlike junk food or gambling, it’s unlimited, free, available to everyone - including children - on demand and barely talked about.

This video - albeit long - should be a mandatory watch for everyone before they engage with it. Or really, everyone should watch it, period - as it covers other aspects of addiction and ‘knowledge is power’. It’s a fascinating watch, even if you don’t engage in porn:

(P.s. some of the YouTube comments on this vid - along the lines of ‘this video saved my life’ - are indicative of the problem)

As for the decision to go ahead with age verification, it is a calculated and well-judged one, IMO. It is well known that VPNs can skip the verification process and any adult can get around this ‘barrier’ with ease. This is known to the Government. But for young children that don’t have a means of discretely paying for a VPN, this presents a welcome hurdle.

Thus the practical effect of the legislation is achieved: adults will continue to act as they already do, whereas fewer children will become exposed to harmful content.

The more challenging parts of the legislation relate to the misinformation offences. By the letter of the legislation, this could even extend to criminalising ‘barbed / edgy’ jokes and satire. In practice though, there is the well-known barrier of, well, ‘practice’. It will be difficult to convince a jury that the messagor intended to cause non-trivial psychological harm, beyond all reasonable doubt, unless that is obviously the case from facts surrounding the character and their activities. This in turn impacts how the CPS will prosecute. I expect courts will further narrow the scope and enable decent “I was being humorous - sorry” defences (in turn limiting prosecution), whilst “I WaS jUsT jOkInG” defences will rightly go in the bin based on ancillary evidence regarding the character of the messagor. Thus the letter of the legislation is only half of the story, as is the case for all ‘harm’ based offenses.

[p.s. There is a quite a lot of decent academic material exploring when harmful actions should be criminalised - if you google Joel Fiendburg that will send you down a big rabbit hole, if you’re interested]

I have lots more to say on this topic… but that’s plenty from me.