Comment by phtrivier | Hacker News Reader

Comment by phtrivier | Hacker News Reader

Parent Full thread

My cursory understanding of the ruling is that it applies if you have several million users in the UK... [1]

Is that the case here (and it just happens that I have no clue what this particular site is about) ?

Or am I grossly misunderstanding the act (very likely I guess since IANAL) ?

[1] https://www.onlinesafetyact.net/analysis/categorisation-of-s...

-------------------------------------------

Ofcom’s advice to the Secretary of State

Ofcom submitted their advice – and the unerpinning research that had informed it – to the Secretary of State on 29 February 2024 and published it on 25 March. In summary, its advice is as follows: Category 1

Condition 1:

    Use a content recommender system; and
    Have more than 34m UK users on the U2U part of the service

Condition 2:

    Allow users to forward or reshare UGC; and
    Use a content recommender system; and
    Have more than 7m UK users on the U2U part of the service

Ofcom estimates that there are 9 services captured by condition 1 and 12-16 likely to be captured by condition 2. There is one small reference in the annex that the 7m+ monthly users threshold corresponds to the DSA (A6.15) Category 2a (search)

    Not a vertical search service; and
    Have more then 7m UK users

Ofcom estimates that there are just 2 search services that currently sit (a long way) above this threshold but that it is justified to put it at this level to catch emerging services. Category 2b (children)

    Allow users to send direct messages; and
    Have more than 3m UK users on the U2U part of the service

Ofcom estimates that there are “approximately 25-40 services” that may meet this threshold.

-------------------------------------------

Those are thresholds for extra requirements.

https://www.ofcom.org.uk/siteassets/resources/documents/cons...

Everybody (who's not specifically exempted by Schedule 1, which has nothing to do with what you linked to) gets a "duty of care".Everybody has to do a crapton of specific stupid (and expensive) administrative stuff. Oh, and by the way you'd better pay a lawyer to make sure that any Schedule 1 (or other) exemption you're relying on actually applies to you. Which they may not even be able to say because of general vagueness and corner cases that the drafters didn't think of.

Also, it's not a "ruling". It's a law with some implementing regulations.

My bad, thanks for the clarification.

Ofcom’s “Does the Online Safety Act apply to your service?” questionnaire [1] doesn’t use those thresholds, and it makes it sound like the law would apply to any site with paying customers in the UK.

[1]: https://ofcomlive.my.salesforce-sites.com/formentry/Regulati...

Just ran through the questionnaire, and it's crystal clear that anything that resembles a typical web forum will need to follow this law. No thresholds as you mention. Doesn't need paying customers as far as I could see, it's enough you have UK visitors.

I just basically struggle with the concept of "x people form our country chose to talk to your web server (hosted elsewhere, responds to anybody) so we now claim jurisdiction (with possible criminal penalties) over that server (hosted elsewhere) and you (who lives elsewhere)."

Realistically they can't, unless the service owner lives in a country with an extradition treaty with the UK, and that country has an equivalent law in place. But most service operators don't want to deal with that stress, so they will just IP block the UK and Brits who know how to use a VPN will just keep using the service.

I wouldn't be surprised if this ends up being a topic in trade negotiations with the US in the future though, since this is a trade barrier that imposes significant regulatory cost on US companies for content that is legal in the US. Eg. the proscribed categories of illegal content include knives and firearms, hate, etc.

That particular approach is actually pretty sensible if you (as a law maker) want to get any results.

Otherwise everyone from small sites to Facebook would just shop around jurisdictions and formally operate their websites from wherever fits them best.

And if a service is used by citizens of your country it makes sense to scale requirements by the impact it is having on them.

This particular law may not be great overall but I've got no issues with this method. As a site provider outside the UK it's trivially easy to avoid liability (by blocking people)

Except we're not dealing with one of the web servers running out of reg-shopped countries where you can host just about anything. We're dealing with stuff that's legal as-is in most developed countries, including America. Aside from the basic question of whether it's ethical to regulate in that way (you're correct it's practical, but there are plenty of things that get results but are morally wrong) it doesn't bear on this case.

I think this is a heavy handed law which entrenches big tech companies.

However I'd argue that from the UK perspective any of these developed countries would be considered reg-shoped.

They don't consider other countries' laws as sufficient to protect their citizens (which I probably wouldn't agree with).

I'm struggling to see a better approach to make sure any law applicable to online services is actually effective.

It seems like there are only a few options:

1. Only pass globally agreed upon laws (which is basically nothing and not realistic)

2. Only regulate domestic providers (which would severely disadvantage them and not resolve the underlying issues)

3. Block all foreign services (which is even more drastic).

In the end a states' power is tied to its territory and the people living within it. If not being active in that state at all releases you from it's laws I would consider this appropriate.

This is on the UK to fix (or not fix) for themselves.

Hey, it worked for the GDPR...

Your source is a 2024 piece about recommendations that had been made, not about how the law turned out.

That's an incorrect understanding. It creates a range of requirements for essentially any service with users in the UK if there is UGC or messaging.

Then there are additional requirements applied to 3 classes of services: Category 1, 2A, 2B. The latter have the thresholds as discussed above.

But, as usual, poorly written. eg a "Content Recommendation System" -- if you choose, via any method, to show content to users, you have built a recommendation system. See eg wikimedia's concern that showing a picture of the day on a homepage is a bonafide content recommendation system.

The definition

> (2)In paragraph (1), a “content recommender system” means a system, used by the provider of a regulated user-to-user service in respect of the user-to-user part of that service, that uses algorithms which by means of machine learning or other techniques determines, or otherwise affects, the way in which regulated user-generated content of a user, whether alone or with other content, may be encountered by other users of the service.

https://www.legislation.gov.uk/uksi/2025/226/regulation/3/ma...

If you in any way display UGC, it's essentially impossible not to do that. Because you pick which UGC to display somehow.

A 250+ page law will have so many edge cases I doubt you would want to test it especially in a country with a government that has recently cracked down and arrested people for online "crimes". Sad the UK government has descended to this level of stupidity.

> the ruling

what ruling are you referring to? This is about the Online Safety Act, an act of parliament.

Sorry, I've chosen the wrong word here. I meant the law.

Reply on news.ycombinator.com