“CAUTION: THIS CONTENT MAY CONTAIN NUTS” — Age Verification, Threat Models, Content Labelling, use of “NSFW” labels & Overblocking

I’ve spent weeks if not months attempting to explain to civil society organisations why the Online Safety Act victimises platforms — even large commercial platforms — and how the OSA makes it hard if not impossible for them to adopt age verification without massive negative consequences for their user.

I think I have finally nailed it:

Nut allergies (and other food allergies) are not a laughing matter, they can cause anything from mild discomfort to full anaphylactic shock and hospitalisation, if not death. Obviously this has led to a threat model amongst food vendors of informing the people who eat their products that this product contains nuts, or that this product was produced in a factory which handles nuts and or other allergens. If you make a habit of looking at food labels you have probably seen something like this, and it’s tremendously useful not least for closed environment like aircraft where people who cater for airlines choose not to select peanuts or peanut-adjacent foods in case one of the passengers is sensitive to airborne allergens. Such vagueness is probably a huge pain for people who do have such allergies, but they would probably rather know than not.

NSFW?

Thus with “NSFW” – Not Safe For Work – which is a long-standing label for content that simply would not be safe to be seen on the work screen in most work environments, probably a very least leading to disciplinary measures if not being fired. It is intentionally advisory: you are at liberty to view the content if you choose, but beyond that point all of the responsibility and liability rests upon your own head.

The advisory NSFW label has been the primary means of classifying unsafe-for-work content (food) or forums (…factory which handles…) for more than 30 years (both on Web and USENET, if not before or elsewhere) and responsibility for access/consumption has been upon the user who is expected to have read the label.

But now the UK Government rides in with a demand:

• that all providers who may offer
• to British people
• some food/content
• that may contain nuts
• then the provider must proactively obtain a legal affirmation from the consumer that they have no relevant allergy
• on pain of huge fines in case of failure

…the inevitable result will be that anything labelled even potentially nut-adjacent will be blocked from sale to British people.

This is a problem because nothing in the food industry is geared-up to provide absolute per-food-item guarantees of nut-freedom, and mass production in general-purpose mills and factories prevents meaningful individual labelling of items or even food batches as being guaranteed-nut-free. The only way to guarantee nut-free content is to prohibit nut-adjacency at all points of the production process, which is only really possible for people fulfilling specialist needs.

Tech Impact

So here we are: the UK has essentially banned general-purpose processing of internet content in case it contains nuts, unless the user signs a legal form to say that they are okay with nuts. The UK government has declared that all British consumption (rather than creation) needs to be traceable; I wonder who that really benefits?

But also: sites like Reddit or Twitter have 15 to 20 year histories of deploying this model of information labelling, and the UK Government (a small, parochial regulator, even though it does not see itself that way) has demanded something which is not economic to provide in a liberty-protecting way. There’s a 20-year corpus of content and communities, some of which are labelled NSFW, and either the company can pause everything and go implement a complete reconsideration of all existing and future content in terms of the Online Safety Act provisions in such a way as to have regard of free speech, or else they can just slap hard age controls on anything which is labelled NSFW and let Britain suffer the consequences.

As far as cost-benefit judgements go, I cannot fault their decision. I propose that neither should you.

Codicil

A friend observed, unsympathetically:

Food allergy labeling has degenerated into companies covering their asses. Everything “may contain nuts”.

…to which my response is “…and everything on the internet may contain porn, at least from the perspectives of either consumers or people of a censorial nature.”

In society we are bad at having practical discussions of “allowable quantities of allergens and pollutants”, and this is considerably more challenging when subjective metrics of psychological harm resulting from internet content are being brought to bear.

There is no addressing the “just one drop of adult content is enough to warp a child’s fragile little mind” problem, but in the matter of free speech we can certainly look at what tools we have available and what tools we do not have available to protect us, and adjust our expectations accordingly.

And we would still rather know, than not. End-user information labelling is still a viable and meaningful and useful approach towards information labelling. The problem that regulators have suddenly demanded wholesale, impractical and uneconomic reengineering of how information on the internet is labelled, is a regulatory failure to “read the room”.

Footnote: you can read this metaphor as naughty as you like; I shall refrain from doing so because it’s too good to waste as a joke…