6 ms·

My cursory understanding of the ruling is that it applies if you have several million users in the UK... [1] Is that the case here (and it just happens that I

My cursory understanding of the ruling is that it applies if you have several million users in the UK... [1] Is that the case here (and it just happens that I have no clue what this particular site is about) ? Or am I grossly misunderstanding the act (very likely I guess since IANAL) ? [1] https://www.onlinesafetyact.net/analysis/categorisation-of-services-in-the-online-safety-act/ https://www.onlinesafetyact.net/analysis/categorisation-of-s... ------------------------------------------- Ofcom’s advice to the Secretary of State Ofcom submitted their advice – and the unerpinning research that had informed it – to the Secretary of State on 29 February 2024 and published it on 25 March. In summary, its advice is as follows: Category 1 Condition 1: Use a content recommender system; and Have more than 34m UK users on the U2U part of the service Condition 2: Allow users to forward or reshare UGC; and Use a content recommender system; and Have more than 7m UK users on the U2U part of the service Ofcom estimates that there are 9 services captured by condition 1 and 12-16 likely to be captured by condition 2. There is one small reference in the annex that the 7m+ monthly users threshold corresponds to the DSA (A6.15) Category 2a (search) Not a vertical search service; and Have more then 7m UK users Ofcom estimates that there are just 2 search services that currently sit (a long way) above this threshold but that it is justified to put it at this level to catch emerging services. Category 2b (children) Allow users to send direct messages; and Have more than 3m UK users on the U2U part of the service Ofcom estimates that there are “approximately 25-40 services” that may meet this threshold. -------------------------------------------

boznz 1y ago
A 250+ page law will have so many edge cases I doubt you would want to test it especially in a country with a government that has recently cracked down and arrested people for online "crimes". Sad the UK government has descended to this level of stupidity.
rafram 1y ago
Ofcom’s “Does the Online Safety Act apply to your service?” questionnaire [1] doesn’t use those thresholds, and it makes it sound like the law would apply to any site with paying customers in the UK. [1]: https://ofcomlive.my.salesforce-sites.com/formentry/RegulationChecker https://ofcomlive.my.salesforce-sites.com/formentry/Regulati...
- magicalhippo 1y ago
  Just ran through the questionnaire, and it's crystal clear that anything that resembles a typical web forum will need to follow this law. No thresholds as you mention. Doesn't need paying customers as far as I could see, it's enough you have UK visitors.
landl0rd 1y ago
I just basically struggle with the concept of "x people form our country chose to talk to your web server (hosted elsewhere, responds to anybody) so we now claim jurisdiction (with possible criminal penalties) over that server (hosted elsewhere) and you (who lives elsewhere)."
- arlcode 1y ago
  That particular approach is actually pretty sensible if you (as a law maker) want to get any results. Otherwise everyone from small sites to Facebook would just shop around jurisdictions and formally operate their websites from wherever fits them best. And if a service is used by citizens of your country it makes sense to scale requirements by the impact it is having on them. This particular law may not be great overall but I've got no issues with this method. As a site provider outside the UK it's trivially easy to avoid liability (by blocking people)
  - landl0rd 1y ago
    Except we're not dealing with one of the web servers running out of reg-shopped countries where you can host just about anything. We're dealing with stuff that's legal as-is in most developed countries, including America. Aside from the basic question of whether it's ethical to regulate in that way (you're correct it's practical, but there are plenty of things that get results but are morally wrong) it doesn't bear on this case.
    - arlcode 1y ago
      I think this is a heavy handed law which entrenches big tech companies. However I'd argue that from the UK perspective any of these developed countries would be considered reg-shoped. They don't consider other countries' laws as sufficient to protect their citizens (which I probably wouldn't agree with). I'm struggling to see a better approach to make sure any law applicable to online services is actually effective. It seems like there are only a few options: 1. Only pass globally agreed upon laws (which is basically nothing and not realistic) 2. Only regulate domestic providers (which would severely disadvantage them and not resolve the underlying issues) 3. Block all foreign services (which is even more drastic). In the end a states' power is tied to its territory and the people living within it. If not being active in that state at all releases you from it's laws I would consider this appropriate. This is on the UK to fix (or not fix) for themselves.
semiquaver 1y ago
> the ruling what ruling are you referring to? This is about the Online Safety Act, an act of parliament.
- phtrivier 1y ago
  Sorry, I've chosen the wrong word here. I meant the law.
Hizonner 1y ago
Those are thresholds for extra requirements. https://www.ofcom.org.uk/siteassets/resources/documents/consultations/category-1-10-weeks/263963-categorisation-research-and-advice/categorisation-research-and-advice.pdf https://www.ofcom.org.uk/siteassets/resources/documents/cons... Everybody (who's not specifically exempted by Schedule 1, which has nothing to do with what you linked to) gets a "duty of care".Everybody has to do a crapton of specific stupid (and expensive) administrative stuff. Oh, and by the way you'd better pay a lawyer to make sure that any Schedule 1 (or other) exemption you're relying on actually applies to you. Which they may not even be able to say because of general vagueness and corner cases that the drafters didn't think of. Also, it's not a "ruling". It's a law with some implementing regulations.
- phtrivier 1y ago
  My bad, thanks for the clarification.
speerer 1y ago
Your source is a 2024 piece about recommendations that had been made, not about how the law turned out.
x0x0 1y ago
That's an incorrect understanding. It creates a range of requirements for essentially any service with users in the UK if there is UGC or messaging. Then there are additional requirements applied to 3 classes of services: Category 1, 2A, 2B. The latter have the thresholds as discussed above. But, as usual, poorly written. eg a "Content Recommendation System" -- if you choose, via any method, to show content to users, you have built a recommendation system. See eg wikimedia's concern that showing a picture of the day on a homepage is a bonafide content recommendation system. The definition > (2)In paragraph (1), a “content recommender system” means a system, used by the provider of a regulated user-to-user service in respect of the user-to-user part of that service, that uses algorithms which by means of machine learning or other techniques determines, or otherwise affects, the way in which regulated user-generated content of a user, whether alone or with other content, may be encountered by other users of the service. https://www.legislation.gov.uk/uksi/2025/226/regulation/3/made/data.html https://www.legislation.gov.uk/uksi/2025/226/regulation/3/ma... If you in any way display UGC, it's essentially impossible not to do that. Because you pick which UGC to display somehow.

boznz 1y ago

A 250+ page law will have so many edge cases I doubt you would want to test it especially in a country with a government that has recently cracked down and arrested people for online "crimes". Sad the UK government has descended to this level of stupidity.

rafram 1y ago

Ofcom’s “Does the Online Safety Act apply to your service?” questionnaire [1] doesn’t use those thresholds, and it makes it sound like the law would apply to any site with paying customers in the UK. [1]: https://ofcomlive.my.salesforce-sites.com/formentry/RegulationChecker https://ofcomlive.my.salesforce-sites.com/formentry/Regulati...

magicalhippo 1y ago
Just ran through the questionnaire, and it's crystal clear that anything that resembles a typical web forum will need to follow this law. No thresholds as you mention. Doesn't need paying customers as far as I could see, it's enough you have UK visitors.

landl0rd 1y ago

I just basically struggle with the concept of "x people form our country chose to talk to your web server (hosted elsewhere, responds to anybody) so we now claim jurisdiction (with possible criminal penalties) over that server (hosted elsewhere) and you (who lives elsewhere)."

arlcode 1y ago
That particular approach is actually pretty sensible if you (as a law maker) want to get any results. Otherwise everyone from small sites to Facebook would just shop around jurisdictions and formally operate their websites from wherever fits them best. And if a service is used by citizens of your country it makes sense to scale requirements by the impact it is having on them. This particular law may not be great overall but I've got no issues with this method. As a site provider outside the UK it's trivially easy to avoid liability (by blocking people)
- landl0rd 1y ago
  Except we're not dealing with one of the web servers running out of reg-shopped countries where you can host just about anything. We're dealing with stuff that's legal as-is in most developed countries, including America. Aside from the basic question of whether it's ethical to regulate in that way (you're correct it's practical, but there are plenty of things that get results but are morally wrong) it doesn't bear on this case.
  - arlcode 1y ago
    I think this is a heavy handed law which entrenches big tech companies. However I'd argue that from the UK perspective any of these developed countries would be considered reg-shoped. They don't consider other countries' laws as sufficient to protect their citizens (which I probably wouldn't agree with). I'm struggling to see a better approach to make sure any law applicable to online services is actually effective. It seems like there are only a few options: 1. Only pass globally agreed upon laws (which is basically nothing and not realistic) 2. Only regulate domestic providers (which would severely disadvantage them and not resolve the underlying issues) 3. Block all foreign services (which is even more drastic). In the end a states' power is tied to its territory and the people living within it. If not being active in that state at all releases you from it's laws I would consider this appropriate. This is on the UK to fix (or not fix) for themselves.

semiquaver 1y ago

> the ruling what ruling are you referring to? This is about the Online Safety Act, an act of parliament.

phtrivier 1y ago
Sorry, I've chosen the wrong word here. I meant the law.

Hizonner 1y ago

Those are thresholds for extra requirements. https://www.ofcom.org.uk/siteassets/resources/documents/consultations/category-1-10-weeks/263963-categorisation-research-and-advice/categorisation-research-and-advice.pdf https://www.ofcom.org.uk/siteassets/resources/documents/cons... Everybody (who's not specifically exempted by Schedule 1, which has nothing to do with what you linked to) gets a "duty of care".Everybody has to do a crapton of specific stupid (and expensive) administrative stuff. Oh, and by the way you'd better pay a lawyer to make sure that any Schedule 1 (or other) exemption you're relying on actually applies to you. Which they may not even be able to say because of general vagueness and corner cases that the drafters didn't think of. Also, it's not a "ruling". It's a law with some implementing regulations.

phtrivier 1y ago
My bad, thanks for the clarification.

speerer 1y ago

Your source is a 2024 piece about recommendations that had been made, not about how the law turned out.

x0x0 1y ago

That's an incorrect understanding. It creates a range of requirements for essentially any service with users in the UK if there is UGC or messaging. Then there are additional requirements applied to 3 classes of services: Category 1, 2A, 2B. The latter have the thresholds as discussed above. But, as usual, poorly written. eg a "Content Recommendation System" -- if you choose, via any method, to show content to users, you have built a recommendation system. See eg wikimedia's concern that showing a picture of the day on a homepage is a bonafide content recommendation system. The definition > (2)In paragraph (1), a “content recommender system” means a system, used by the provider of a regulated user-to-user service in respect of the user-to-user part of that service, that uses algorithms which by means of machine learning or other techniques determines, or otherwise affects, the way in which regulated user-generated content of a user, whether alone or with other content, may be encountered by other users of the service. https://www.legislation.gov.uk/uksi/2025/226/regulation/3/made/data.html https://www.legislation.gov.uk/uksi/2025/226/regulation/3/ma... If you in any way display UGC, it's essentially impossible not to do that. Because you pick which UGC to display somehow.