UK Online Safety Regulations and impact on Forums

The points systems sounds rather confusing! So if all of a group of members had 4 points and one of them reported a post and it went for manual moderation, then it would disappear and no one else could report it, is that right? I don't really get this threshold thing. If I just want reported posts to go to manual moderation.
 
Thanks. I've just downloaded it. Reports point threshold is automatically set at 10. So If I set that to one and then don't tick the box for the user group, then anyone can report and it'll just go to moderation is that right? Which would be ok for now as don't have members back on yet so I'm just testing :-) Presumably if I want to limit it to a group of members, then I set up a user group, tick the box and set permissions for that usergroup to 1 and 1 is that right?
 
Thanks. Well that worked :) In the approval queue and my phone beeped to say there was a report (vip email beep). Can't see if the post was removed or not though as I'm signed in as admin so need to set up a spare account to test it.
 
Yes that works well. Only thing I thought though, is if it's the first post in a thread, then the whole thread would go to the approval queue, not just the post. Is that right?

Just wondering how it would work if I'm actually online though on the forum, and someone presses the report as there'd be no need to move it to the approval queue then. Previously a member would just message me but DM's are off now. Also - what is the API key link for after buying the addon do you know?
 
Last edited:
Ok. So assuming no age verification and possible child members, I have

1) Moderation sorted - email pings me if a report is made, user reports send a post for manual review.
2) Content Scanning for illegal harms.
3) Potentially have link scanning for illegal harms in the pipeline

Still need to sort

a) Removal of exif data from photos (this addon was mentioned but doesn't sound too popular recently .... some people have had issues https://xenforo.com/community/threads/image-optimizer-for-xf-2-0-paid.140261/page-38). Just wondering if there's anything else?
b) Updating Terms and Rules with all the new OSA info and Complaints Procedure. Has anyone done this yet? Also I've only ever had the basic pre-installed terms and rules. Editing it doesn't look that simple - assume it needs to be coded somehow?
c) Could do with a youtube solution so it doesn't suggest alternative videos after the embed has finished - still thinking about that.
d) Set up censor word list - I believe there's a list somewhere on here? Also if I add "Instagram" to the list will it stop Instagram hyperlinks/embeds?

And have a query about user profiles. It was something mentioned in the OSA stuff about people getting info about other people from their user profiles. Where can you set restrictions for what info people can put in their profiles?
 
Last edited:
Potentially have link scanning for illegal harms in the pipeline
Who are you afraid of is going to post illegal links? Surely your regular members won't do that.

I don't let anyone post links until they have made 10 posts on the forum (which upgrades their usergroup) - any links posted before that time go into the moderated queue automatically using the spam settings built into XF.

This catches everything - links, urls, video embeds. No need for anything else fancy.
 
I was wondering how much effort all this is really taking.
meet the local MP soon on this topic. If anyone wants to share issues public/privately on how this has impact them, any worries and concerns, costs/time taken so far etc etc feel free and I will condense and share.
And was reminded that @robt did kindly raise it with their MP. So I thought I'd do a quick "reading time check" for all the Children's guidance linked to by Ofcom, ie:

a-summary-of-our-decisions.pdf
childrens-access-assessments-guidance.pdf
childrens-register-of-risks-2.pdf
childrens-register-of-risks-glossary-2.pdf
childrens-risk-assessment-guidance-and-childrens-risk-profiles-2.pdf
codes-at-a-glance.pdf
guidance-on-content-harmful-to-children-2.pdf
guidance-on-highly-effective-age-assurance-part-3-guidance-.pdf
protection-of-children-code-of-practice-for-search-services.pdf
protection-of-children-code-of-practice-for-user-to-user-services--2.pdf
volume-1-overview-scope-and-regulatory-approach.pdf
volume-2-the-causes-and-impacts-of-online-harms-to-children.pdf
volume-3-assessing-the-risks-of-harms-to-children-online.pdf
volume-4-what-should-services-do-to-mitigate-the-risks-of-online-harms-to-children.pdf
volume-5-annexes.pdf
volume-6-illegal-harms-further-consultation-user-controls.pdf

Turns out that little lot would, at 200 words per minute, (which is a slower rate than average, but seemed fair for more legal type documents like these where you are doing a bit of back and forth) would take you 65.68 hours to read. Assuming you work 9-5 with an hour for lunch 9.38 working days. So essentially one person two solid working weeks to actually read everything they are supposed to read!

So even on UK minimum wage you'd have "spent" ~£980 just reading the documentation before you'd even started to figure out how you might implement it. Let's be realistic you are probably not, if you ran a company, going to give this job to the most junior person on minimum wage in the company so you'll have chalked up a couple of grand before you even start properly. Now lets assume you run a site as a hobby and have "day job", maybe you get a couple of hours reading in each night after a hard day at the coal face, well it'll take you the first month of your three month deadline for implementation to even read the documentation properly!
 
Last edited:
The points systems sounds rather confusing! So if all of a group of members had 4 points and one of them reported a post and it went for manual moderation, then it would disappear and no one else could report it, is that right? I don't really get this threshold thing. If I just want reported posts to go to manual moderation.
I was thinking, something better might be if members can rate the type of report. Normal reports are as normal, but maybe a special report for something that is obvious harm then any of the trusted members can report it as such and that post goes into moderation queue.
 
The closest I've seen to "types of reports" are these add-ons.


and


Which has a queues feature that I think might do a similar if less user focused task.

I keep meaning to try the first add-on at some point. Certainly I'd love to see the report system mature into more of a ticket based system in particular the features I'd like to see (I normally have Report Improvements and Warning Improvements installed as standard) are:
  • categories both for the user to select and to filter against for staff
  • ranking/scoring of some sort for reports
  • setting due dates / deadlines for reports with escalation actions (eg email admin, increase ranking, etc)
  • essentially the crowd-moderation type features discussed above (with additional escalation actions)
  • ability to assign reports to multiple users by group
If we were really going for wish listing then being able to do more of a dialog with the reporter would be nice - perhaps flagging a comment in the report as visible to the reporter and each user would have somewhere other than their notifications to see content they had reported. Anyhow I digress.
 
Who are you afraid of is going to post illegal links? Surely your regular members won't do that.

I don't let anyone post links until they have made 10 posts on the forum (which upgrades their usergroup) - any links posted before that time go into the moderated queue automatically using the spam settings built into XF.

This catches everything - links, urls, video embeds. No need for anything else fancy.
I highly doubt there would ever be any illegal links :-) But it's to show, on a risk assessment, that it's been mitigated for. On a site that children could access, with only one moderator who isn't there all the time. ie automated moderation.

Ticking a box and means I can assess "low risk" for hyperlinks.
 
Last edited:
I was wondering how much effort all this is really taking.

And was reminded that @robt did kindly raise it with their MP. So I thought I'd do a quick "reading time check" for all the Children's guidance linked to by Ofcom, ie:

a-summary-of-our-decisions.pdf
childrens-access-assessments-guidance.pdf
childrens-register-of-risks-2.pdf
childrens-register-of-risks-glossary-2.pdf
childrens-risk-assessment-guidance-and-childrens-risk-profiles-2.pdf
codes-at-a-glance.pdf
guidance-on-content-harmful-to-children-2.pdf
guidance-on-highly-effective-age-assurance-part-3-guidance-.pdf
protection-of-children-code-of-practice-for-search-services.pdf
protection-of-children-code-of-practice-for-user-to-user-services--2.pdf
volume-1-overview-scope-and-regulatory-approach.pdf
volume-2-the-causes-and-impacts-of-online-harms-to-children.pdf
volume-3-assessing-the-risks-of-harms-to-children-online.pdf
volume-4-what-should-services-do-to-mitigate-the-risks-of-online-harms-to-children.pdf
volume-5-annexes.pdf
volume-6-illegal-harms-further-consultation-user-controls.pdf

Turns out that little lot would, at 200 words per minute, (which is a slower rate than average, but seemed fair for more legal type documents like these where you are doing a bit of back and forth) would take you 65.68 hours to read. Assuming you work 9-5 with an hour for lunch 9.38 working days. So essentially one person two solid working weeks to actually read everything they are supposed to read!

So even on UK minimum wage you'd have "spent" ~£980 just reading the documentation before you'd even started to figure out how you might implement it. Let's be realistic you are probably not, if you ran a company, going to give this job to the most junior person on minimum wage in the company so you'll have chalked up a couple of grand before you even start properly. Now lets assume you run a site as a hobby and have "day job", maybe you get a couple of hours reading in each night after a hard day at the coal face, well it'll take you the first month of your three month deadline for implementation to even read the documentation properly!
It is indeed, burdensome. It makes me think they just want smaller, non profit sites to just shut down. They want everything on the internet to conform. Behind it is this attitude that every site on the internet is potentially harmful. Which just isn't the case at all. So it is like big brother. I don't like it at all. Yes it makes everyone with a user to user site, think about all the terrible things that go on on the internet (which you don't see, never come across and don't really want to think about). It's extremely heavy-handed.

Which was why my gut reaction was - just get age verification and get on with life as before. But it's not that simple with the very large costs involved. And something grates generally about using big commercial companies for it.
 
Last edited:
I highly doubt there would ever be any illegal links :-) But it's to show, on a risk assessment, that it's been mitigated for. On a site that children could access, with only one moderator who isn't there all the time. ie automated moderation.

Ticking a box and means I can assess "low risk" for hyperlinks.
But so does sending all posts with links to the moderation queue until members have passed a certain threshold.

This is what I do at the moment and it's caught everything since I first set it up.
 
But so does sending all posts with links to the moderation queue until members have passed a certain threshold.

This is what I do at the moment and it's caught everything since I first set it up.
I know and it should be enough. If I did that though, my site would be classed as medium risk. To be low risk, all hyperlinks need to be manually checked or use automation for checking. They have no idea what forums are like I think. Whether it would matter if the site was medium risk or not, I’m not sure, but it’s likely to bring a whole load more mitigations to comply with if it is. The whole point being, my site was perfectly safe before. Main thing is good spam protection.

As yours doesn’t come under possible child users, your mitigation levels might be less.
 
Whether it would matter if the site was medium risk or not, I’m not sure, but it’s likely to bring a whole load more mitigations to comply with if it is.
I vaguely seem to recall reading something about sites with multiple (?) medium risks needing to contact Ofcom. I'll have to see if I can find that stuff again once I've done the Children's Risk assessment, so don't quote me on it, but there was certainly consequences of not being low or negligible risk. It'd be good to know what the outcome of the risk assessments really are - beyond what you probably already knew beforehand!
 
Not sure. The only things that came up to do after the toolkit were person named. TOS and reporting organisations. Along the way it gave an idea of what you needed to do if you wanted to be classed as low risk, I thought it was just category 1 and 2n that had to report back to Ofcom, or sites over 70,000 members
 
Last edited:
It’ll be a combination of site size and risk factors. Your risk factors are probably low as your site isn’t reievant to children. Did you try the digital toolkit?
 
This document says just category 1 and 2a to submit to Ofcom. Doesn’t mention site size. However there are some different things related to sites over 70,000 - the digital toolkit should help with that.

Incidentally this document mentions the child risk assessment. There’s a question “when do I need to do a child risk assessment” and the answer is - you do it contemporaneously.

Whatever that means. Ie you’re supposed to do it now/at the same time, from the current guidance? despite their being no digital toolkit yet.

 
Back
Top Bottom