Neil Brown
@neil@mastodon.neilzone.co.uk  ·  activity timestamp 2 days ago

A gentle reminder that, if you run a regulated user-to-user service within the scope of Part 3 of the UK's , which falls within the requirement to put in place highly-effective age assurance (which does not apply to all services), you have just a few more days - until 25 July - to do so.

If you are not sure, start with a child access assessment, and then, if needed, a child risk assessment.

Most problematically, I have zero recommendations for a tried-and-tested, Free / open source, data protection compliant, age assurance system.

If you cannot implement age assurance, you might want to look at ways to lessen the risk, to escape the requirement.
awoodland
@awoodland@fosstodon.org  ·  activity timestamp 2 days ago
@neil have you looked at the legal basis that early adopters are relying upon in practice for the additional data processing yet? I'm struggling to work this out because there seems to be obvious flaws in pretty much anything I can come up with mentally. (Performance of contact seems like the least wrong one perhaps? But if I had a contract yesterday that you can't honour today that might start to stray into areas that would be "unfair")
Neil Brown
@neil@mastodon.neilzone.co.uk  ·  activity timestamp 2 days ago
@an0key

There is an unresolved question whether a self-hosted, single-user, fedi instance falls within scope of Part 3 at all, in terms of the definition of "user".

The same issue would dictate whether there were any "child" users.

But, pragmatically, in terms of what I've seen from you and your own instance, I cannot see any credible argument that you would be required to implement age assurance.