The UK’s global censorship bureau, Ofcom, will tomorrow fine SaSu, an American mental health discussion forum, £1 million (update: the Provisional Decision from two months ago said £1,000,000, but it seems they knocked £50k off the top in the Confirmation Decision so it’s now £950k) for content that Ofcom’s own investigators could only access by using a VPN to circumvent SaSu’s UK IP geoblock – automated measures that block known UK IP address ranges. Geoblocks are imperfect but they are, for the most part, effective. SaSu’s geoblock was a measure that Ofcom itself had accepted, and acknowledged in a public statement, only six months ago.
Today’s fine is the result of 197 known censorship demands that Ofcom has directed into the United States in the past twelve months: more than one censorship demand every two days, for a year, aimed at American companies operating on American soil under American law. SaSu is but one target among hundreds. The fine is as much a message to the other 196 as it is a penalty against SaSu.
The People London Knows Exist, But Chooses Not to See
SaSu is an American forum on which chronically depressed users discuss depression, recovery, suicidal ideation, and suicide itself.
The forum’s right to exist is protected by the First Amendment to the United States Constitution. Its users’ rights to use it are similarly protected.
There are literally millions of posts on the site, each one a small thought written down by some lonely person, somewhere, who wants to be heard and who, for whatever reason, feels that they have nowhere else to go. Ofcom’s Confirmation Decision cherry-picks the worst of the content on this site and ignores the rest. It also mischaracterizes the site and its purpose.
Ofcom, UK activist groups, and politicians have described SaSu as a “suicide website.” Sir Keir Starmer even brought up this case, using that language, on live television, in a meeting with President Trump at Turnberry. This description is a half-truth at best – and an easy one for the media to repeat ad infinitum until it becomes conventional wisdom. The actual purpose of the site is slightly more nuanced: its users, who are overwhelmingly chronically depressed, use the site to talk about their feelings, anonymously or pseudonymously, without running the risk of (1) familial or social ostracism, (2) adverse employment determinations, or (3) involuntary commitment (being “sectioned,” as the Brits describe it).
Unburdened by stigma, talk they do, in considerable quantities. Publicly available data indicate that roughly half the site’s content, over 45,900 threads and 1.2 million posts, consists of suicidal people discussing topics other than suicide, including mental health recovery resources (consisting of 12,400 threads and 130,000 posts). Because the topic of suicide is heavily censored on literally every other web platform, this website is, as far as I can tell, the only option available when a suicidal person wishes to discuss these issues without risking getting bundled into a van by some men in white coats, possibly losing one’s livelihood, and one’s freedom.
In both the UK and the United States, mental health professionals have the power, if they feel a person is a danger to themselves, to place anyone under an emergency psychiatric hold; in the United States, that is customarily for a period of 72 hours. In the United Kingdom, an emergency “assessment” hold can last 28 days, with a “treatment” hold capable of lasting for a further six months.
This leaves suicidal people feeling trapped: if they keep their emotions to themselves, they are locked in a prison with themselves and have nowhere to share them and let off steam. If they talk to a mental health professional, they risk having their lives completely dismantled. The forum thus serves as a kind of halfway house between being completely alone and seeking help – where people can discuss their feelings openly, without being judged, without being censored, and without risking the complete loss of their liberty or their livelihood, and becoming a temporary or semi-permanent ward of the state.
That is the theory. This is what you find out when you listen to what the forum’s users are saying instead of trying to shut them up.
Censors in London, as well as the institutional government healthcare apparatus at the NHS, appear to have no interest in listening to the perspectives of the many living users of the site, many of whom use it to criticize inadequate provision for mental healthcare or their fear of accessing healthcare, such as the user quoted above.
This is despite the fact that these site users are the very people who the censors, through their actions, claim to protect. The censors and their NGO partners decided the site was evil, decided its users were brainless automata with no agency who needed to be saved from themselves, decided that silencing these users and taking their rights was the best way to achieve that objective, and never once asked those users what the site means to them or what they would lose if the site were destroyed.
Another user, quoted above, did what the mental health system tells the mentally ill to do – seek help. The result was involuntary confinement, confiscation of his personal property, coerced interaction with people he experienced as cruel, and release contingent on denying that he felt the way he actually felt. The German healthcare system did not treat this patient. It forced him (or her) to lie so that the state health bureaucracy could tick a box and tell itself that it had done its job.
Perhaps the state should provide its own judgement-free safe spaces for these conversations. At the moment, it does not, and SaSu, like it or not, is the only place this person can speak without risking the same thing happening again.
That does not mean I approve of much of the content on SaSu; I, quite emphatically, as a Catholic, do not. This is the most difficult subject matter I have ever dealt with as an attorney, and in terms of taking on the representation, it is one that I have felt most deeply conflicted about. This is not a client I would have normally taken in the course of commercial practice. However, the gravity of Ofcom’s attempts to censor Americans – 197 separate intrusions into our country in the last year, as mentioned above – combined with the fact that no one else was prepared to defend the company compelled me to get involved.
David Goldberger, Floyd Abrams, and James Donovan set the standard that working lawyers should aspire to in situations such as this. The canons of ethics advise us that, to the extent we volunteer to take on a particular cause pro bono, we should not discriminate based on our personal feelings about a particular client (see, e.g., Model Code of Prof’l Responsibility EC 2-27 (1980) – “History is replete with instances of distinguished and sacrificial services by lawyers who have represented unpopular clients and causes. Regardless of his personal feelings, a lawyer should not decline representation because a client or a cause is unpopular or community reaction is adverse.”)
It is perhaps easier for my former colleagues in BigLaw, who need to get new client instructions through multiple tiers of risk-averse management committee review, to forget this, but, formally, our profession requires this. It is not optional. It is what lawyers are supposed to do. Representing a website which is virtually unknown in the United States where it lawfully operates, but which is extremely unpopular in a foreign country 3,000 miles away, is, by that standard, a fairly small ask compared to considerably hotter cases, such as the Skokie, Pentagon Papers, or Rudolf Abel cases, taken by public interest lawyers in the past.
I consider myself fortunate that suicidal ideation is not an issue I personally have to grapple with. Many people, including most of this forum’s posters, are not so fortunate. But even they, under our constitutional tradition, deserve to have the ability to receive and impart information about their feelings, without being censored, regardless of my personal feelings on this subject, and regardless of the British government’s opinions, too.
One thing Ofcom excels at is picking politically unpopular enforcement targets. For the four companies who openly refused Ofcom’s orders in 2025, most of which were among Ofcom’s earliest targets, the number of lawyers who stepped forward to try to stop Ofcom – out of the 1.3 million lawyers in the United States – can be counted on one hand (four, to be exact – apart from yours truly, Ron Coleman is co-counsel on the 4chan case in the D.D.C., Matthew Hardin also represents Kiwi Farms, and Colin Crossman was my coauthor, and the lead legislative draftsman, of the Wyoming GRANITE Act).
Much of the content on the sites selected for Ofcom’s early target list is, by the standards held by many if not most right-thinking people, objectionable. Of all the targets on the Online Safety Act’s enforcement target, I think most lawyers would agree that SaSu is the most politically radioactive of the bunch.
First Amendment lawyers are not in the business of winning popularity contests, however. We are in the business of defending Americans’ civil rights, especially when no one else is willing to do so. SaSu, as a forum, is capable of being described as many things. One accurate description is that the site is wholly and exclusively American. Consequently, SaSu’s choice to host this content – and the overwhelming majority of what users post – is lawful expression under the First Amendment, which protects the right of Americans to receive and impart information on controversial and difficult subjects, including this one.
No one would represent SaSu. It is the duty of our profession that someone does. Rights that no lawyer will defend cease to exist.
Ofcom’s VPN Problem
Unlike other Ofcom targets, who refused Ofcom’s orders outright, SaSu – while objecting strenuously to Ofcom’s attempts to censor it in public – nonetheless bent over backwards to accommodate the UK regime while preserving, to the maximum possible extent, its users’ constitutional rights. SaSu voluntarily geoblocked the United Kingdom in the summer of 2025. Ofcom accepted the geoblock in October 2025.
Three weeks later, following pressure from the Molly Rose Foundation, Mental Health Foundation, and allied advocacy groups (and a coordinated media campaign apparently run in concert with those groups, as their quotes all managed to find their way into embargoed stories that ran only a few hours after we were notified of Ofcom’s decision), and exactly six days after pressure was directly applied on Ofcom by Parliament to reopen the file, Ofcom inexplicably reversed its decision and ceased communications with SaSu – read, it stopped communicating with a cooperative but publicly unhappy target – and proceeded to conduct an investigation of its own.
Nothing about the geoblock Ofcom had already approved changed during that time. The only thing that changed was the presence of extreme levels of political pressure on the agency. Ofcom conducted an investigation of SaSu and did not request further changes to the geoblock during that time. That investigation culminated in a Provisional Decision to fine the company on 27 February 2026, and the Confirmation Decision today.
[Update: this blog post was posted exactly one hour after Ofcom notified us of its intent to issue the Confirmation Decision on the evening of May 12th. As expected, an enormous coordinated media campaign, quoting Ofcom and its NGO allies, and featuring stories in Reuters, the Guardian, the BBC, and elsewhere, was published early on the morning of May 13th.]
The problem Ofcom had, of course, is that SaSu complied with Ofcom’s directives and the geoblock Ofcom approved of, functioning at all relevant times in exactly the manner that Ofcom approved, never went down.
The Provisional Decision described SaSu’s geoblock – the one Ofcom previously approved of – as a “purported” geoblock. The Provisional Decision was reviewed by SaSu’s legal team immediately upon receipt. During that review, we found, buried deep in the document and its footnotes, that Ofcom’s evidence-gathering in this case was based on deliberate circumvention of the geoblock, both by Ofcom investigators and by the NGOs, including the Molly Rose Foundation and the Mental Health Foundation, working in concert with them, several of which have publicly called for SaSu’s destruction and the arrest of its operators.
In every relevant documented instance of access to SaSu cited in the Provisional Decision, for every shred of evidence gathered after Ofcom’s November volte-face on whether to accept a geoblock, Ofcom or its partners required a VPN. The bulk, if not the entirety, of Ofcom’s evidentiary file was gathered via VPN use.
Put another way: Ofcom, in this enforcement action, proved only one thing: the geoblock worked. Ofcom’s inability to access the site without first using a VPN proves it. Ofcom did not disclose this fact in its media push associated with the Provisional Decision.
The media drive after the provisional decision, one where Ofcom asserted that the geoblock was “ineffective or inconsistently maintained,” was incorrect. Ofcom’s own documents showed they were unable to get to the site without deliberate circumvention with a VPN. A geoblock that is “ineffective” is not also one which requires a VPN to get around. Their investigative methodology completely undermined their investigative conclusions.
Rather than publishing the Provisional Decision immediately (although copies were furnished to neutral observers in civil society and the press), we instead offered Ofcom an offramp.
This letter will become very important when you read the update at the bottom of this post dated May 13th.
As we wrote to Ofcom on March 2nd, 2026:
Ofcom (Ofcom only),
This law firm writes to make further representations following additional consultation with our client and a further review of your Provisional Decision.
I am advised that the onboarding flow referenced in your Provisional Decision at paragraphs 3.61 and 3.62 is not accessible to UK users from UK IP addresses. This issue was raised in yesterday’s correspondence, and, as mentioned, this law firm independently confirmed it. A hotfix is being pushed to the onboarding flow to remove UK IP addresses from the SSVerify application, even though UK Internet users cannot access that page and the SSVerify function is mainly an anti-spam feature.
Second, for the record, that the site mirror referenced in the Provisional Decision was taken down immediately after Ofcom raised the issue. This is consistent with a pattern of cooperation with Ofcom’s requests prior to October 2025, when Ofcom ceased making requests and elected to proceed with enforcement action.
Third, and most significantly, following a complete review of the Provisional Decision, the overwhelming majority of Ofcom’s recent site assessments and investigative activity appears to have been conducted via VPN. Paragraph 4.4(d) states that the January 2026 assessments were conducted “with the use of a VPN.” Paragraph 4.4(e) confirms the same for the February 2026 assessment. At paragraph 4.3, Ofcom states that it “did not deem it appropriate to register for the sites with false details” and instead relied on third-party organisations (being, the Mental Health Foundation and the Molly Rose Foundation) to register accounts. These entities, too, appear to have been unable to access any part our client’s site without first using a VPN. See paragraphs 5.26(c) and (d).
The implication of the above is plain. Our client implemented a UK geoblock at Ofcom’s request. That geoblock, far from being a “purported geoblock,” works, otherwise Ofcom would not have required a VPN to access the site. Ofcom accepted and approved of the geoblock in public statements in October 2025. Ofcom inexplicably reversed course in November 2025. My client did not advertise VPN services to UK users on its UK Error 451 page. The plain language of the Provisional Decision suggests that neither Ofcom nor its NGO partners could access the site or create accounts without first utilising deliberate circumvention measures, chiefly a VPN, to bypass the geoblock. Real-world testing easily confirms this.
The evidence supporting the Provisional Decision was gathered not by observing what UK users can access, but by circumventing the very measure Ofcom asked our client to implement and which our client implemented under Ofcom’s supervision. Ofcom now seeks to penalise our client for Ofcom’s own circumvention of that measure, which my client made sure was active and functional for the entirety of this investigation.
Our client has not rolled back or removed any of the remedial measures described above throughout Ofcom’s yearlong investigation. Our client has cooperated with every request Ofcom made, immediately or shortly after it was made, to facilitate its exit from Ofcom’s claimed regulatory perimeter. Despite these efforts, Ofcom now seeks to drag my client back into its perimeter. My client’s position on that point is very consistent with its prior statements: it is in the United States and is not subject to Ofcom’s jurisdiction.
The appropriate course is for Ofcom to recognise the effectiveness of these measures and close this investigation or put it into long-term monitoring as before.
Our client reserves all rights.
My client was fastidious in leaving the geoblock up, in part, because it expected that Ofcom would try to fine it anyway and proving that Ofcom’s decisions were political in nature would illustrate to other Americans why the UK’s censorship regime must be opposed.
In delivering its Confirmation Decision Ofcom will meet our expectations. The organization answers to politics.
Keep in mind that, under U.S. law, SaSu violates no law. It is completely within its rights to ignore Ofcom’s demands entirely and choose to allow users to access the site, without restriction, from anywhere on Earth.
Notwithstanding this, 72 hours after the Provisional Decision was issued in February, SaSu responded to Ofcom’s findings by modifying an anti-spam feature on the site so that UK users could not even create accounts and post on the site, even if they had circumvented the national geoblock to view the site via VPN (in which case the entire public area of the site would be visible). The anti-spam feature is not visible to UK users who have not already circumvented the geoblock with the use of a VPN. These measures were taken voluntarily.
Ofcom’s Inconsistent Enforcement Problem
In five other cases – Krakenfiles, Nippydrive, Nippyshare, Nippyspace, and Duplanto – Ofcom closed its investigations after the target geoblocked the UK, citing its own enforcement guidance and describing the cases as no longer an “administrative priority.” SaSu geoblocked the UK months before any of these entities did. SaSu implemented additional measures beyond what any of them did. Yet, today, Ofcom fined SaSu £1 million.
The distinction between SaSu and the other five is not legal, procedural, or technical. It is political. SaSu is the bête noire of the UK’s “online safety” community, the example the Prime Minister raised with the President of the United States when asked to justify the OSA, the nemesis of NGOs with influence in Westminster, and the one website, if no other website on the Internet, that the Online Safety Act was designed to destroy. SaSu was Ofcom’s first-ever enforcement target under the OSA. But, as Ofcom has since learned, the OSA cannot destroy SaSu, because SaSu is American.
The procedural record establishes a pattern every other American target of Ofcom enforcement should now understand: there is no geoblock sufficient to satisfy Ofcom, no good-faith compliance sufficient to close an Ofcom investigation, and – for any company engaged in constitutionally protected expression that the UK, which does not protect free speech, would outlaw – no remedy available under UK law, if Ofcom decides that you are a priority political target.
Any American company that cooperates with Ofcom may have its cooperation used as evidence against it. Any American who protests Ofcom’s overreach may have its protests used against it, something which was also true of the 4chan Confirmation Decision. Any American whose lawyers object on jurisdictional grounds to Ofcom’s extraterritorial overreach may have those, entirely legally correct, statements used against it as aggravating factors, something which was also true in the 4chan Confirmation Decision. Any American company that complies may be told that its compliance was a pretense to avoid enforcement. Any negotiated determination to close an investigation that Ofcom makes may be reversed if that determination becomes politically inconvenient.
Ofcom’s contention that it, by masquerading as American traffic, places an American website within British jurisdiction is the same thing as saying that British regulators can regulate any American website, regardless of whether it is accessible in the UK.
This approach will not survive first contact with American rules around service of process or non-recognition of foreign regulatory fines that offend the Constitution. I also do not think this expansive view of Ofcom’s jurisdiction survives first contact with a judicial review of the exercise of its powers under the Online Safety Act itself. That judicial review will, however, need to come on some other day for some other company with enough of a UK footprint to make the EV of appearing in the jurisdiction a worthwhile exercise. In SaSu’s case, the First Amendment is its only content regulator, and until such time as Ofcom is willing to submit to American jurisdiction and test the enforceability of its orders before an American judge, Ofcom’s orders carry no force in the United States.
For everyone else looking at this case as a teachable moment, I think the key takeaway is that what Ofcom is doing here – a type of regulatory Calvinball – is precisely the sort of capricious state action, and punitive retaliation, that the Founders sought to abolish with the First Amendment.
For SaSu, compliance had the same consequences as refusal. If there is sufficient political demand, there is no escaping the UK’s claimed regulatory perimeter; Ofcom will purport to have jurisdiction over your speech no matter where you are in the world, and no matter what measures you take to exclude the UK from your service.
If they will fine a U.S. website £1 million after it comprehensively geoblocks the entire country, effectuating the most severe remedy that a British court could impose under the Online Safety Act (a so-called access restriction order), only done voluntarily, they can find a reason to fine you. Every future American target of Ofcom’s Online Safety Act enforcement should proceed accordingly.
The UK’s Suicide Policy Problem
As to the policy question, debates about the wisdom of permitting suicide discussion spaces online have raged for over 20 years, as a review of academic literature on the topic reveals. This is not a new issue. The issue is not settled. Nor is SaSu the first site that has ever addressed this particular user community. Critics of laws banning forums like SaSu, such as Australia’s Suicide Related Material Offences Act 2005, argue that such laws “[cast] the criminal net too widely” and “inappropriately [interfere] with the autonomy of those who wish to die” on the one hand, and proponents of those laws arguing that the social benefits of those laws may “raise awareness” and “mobilize community efforts to combat” suicide.
It bears mentioning that the Australian law has had certain unintended consequences, such as, for example, prohibiting telehealth providers from providing online or telephonic counseling in relation to (perfectly lawful in certain Australian states) assisted dying advice, with all counseling required to be conducted in person. The UK’s current position seems to be similarly self-contradictory, in that the House of Commons and the Government are trying to get an assisted dying bill enacted at the same time as Ofcom is being pressured to destroy SaSu.
This, while Switzerland is assisting a British citizen who cannot bear to live with a medically-assisted suicide, after that British citizen chose to end her life after living with chronic depression for four years following a terrible personal tragedy. Yet we hear not a peep from the Westminster media and NGO class which has made the destruction of SaSu their life’s work. Presented with a case where an actual medical clinic, run by actual people with names and addresses, actually facilitated the killing of a depressed but otherwise healthy British citizen, presumably sending communications into the United Kingdom for this purpose, these NGOs have absolutely nothing to say.
It is difficult to reconcile Ofcom’s position (one shared by allied NGOs) that suicide may not be talked about online with the government’s current position that it should be carried out under state supervision with taxpayer funding (or, for that matter, the government’s continuing diplomatic relations with Switzerland or failure to issue arrest warrants for the Swiss doctors involved). The only way to resolve this contradiction is to understand that the people who currently run the UK are fine with suicide, but only in circumstances where it is under the direct control of the total state which controls birth, health, education, work, speech, and yes, even death.
I decline to concede the moral high ground to Ofcom and the UK on this issue. The UK’s current political leadership does not object to suicide. It objects to unsupervised suicide that it does not get to take utilitarian and political measurements on and, only when it is politically acceptable, approve.
Or this:
The UK has made its policy choices: in this case, that the 3 million posts on this site should disappear, its users be silenced, and, provided the Assisted Dying bill can make it through the Lords in some future attempt after this one, that suicide be the exclusive province of the National Health Service. That does not make the UK’s recent policy choices, on either speech or death, the right ones for the entire world.
The UK’s policy choices are certainly not the right policy choices for the United States, which made very different policy choices 234 years ago when we ratified the First Amendment to the Constitution, a framework that mandates that the 3 million posts on this site should remain and that its users should be permitted to continue to speak, free from state interference – and where assisted dying is still illegal in 36 states, a state of affairs that at least some of SaSu’s users doubtlessly object to, strenuously, as is their right.
On each of these matters, speech and death, our two countries are in the process of making opposite choices. Only one of these countries now seeks to impose its choices on the other. The country doing the imposing is the UK. The nature of the imposition is that the UK wants to seize Americans’ free speech rights on the Internet, by telling us what server configurations we must run.
The Matter of the First Amendment
It is true that Ofcom is free to determine how it wishes to exercise its powers in its jurisdiction, even if the exercise of those powers will generate no measurable results. That is their right.
It is also true that the only forum in which SaSu’s speech rights, and its continued right to exist as a discussion forum, can be adjudicated in is an American court. That is my client’s right. That is the forum Ofcom must appear in, as a plaintiff, if it wishes to override that right. If we have learned anything from Ofcom’s enforcement record to date – which has a 98.2% noncompliance rate from foreign targets, measured in terms of fines issued vs fines collected – the British Internet regulator is in the habit of overreaching into places and countries where its authority does not travel and where refusal of its orders is lawful or even, for example in the case of the United States, constitutionally protected. If Ofcom attempts to cross the pond – although I am virtually certain it will not – we will be ready and waiting for it.
My client will, in all probability, continue geoblocking the UK, despite being on the receiving end of Ofcom’s extrajudicial and extraterritorial punishment. Whether it continues to do so is my client’s choice, not Ofcom’s. For the rest of us in the U.S. observing this enforcement action, it suffices to note that, without American judicial cooperation, Ofcom’s power to regulate speech has a limit.
That limit is twelve nautical miles off the United Kingdom’s coastline, and neither the First Amendment, nor my client, nor any other American is within it. Even geoblocking is not enough to remind the UK’s Internet censor of the limits of its power, because the UK and Europe want control of the world’s Internet. No company who resists will be forgiven for doing so, however obscure that site may be.
The UK’s current rulers will not stop trying to destroy the First Amendment online until America makes them stop.
Update, 13 May 2026 – How Ofcom Circumvented the Geoblock – Not Once, But Twice
I have read the Confirmation Decision. Ofcom responds to our representations of March 1st 2026 with the following:
Read: the site is, indeed, blocked, but Ofcom still managed to get in by “using log-in details provided by the Mental Health Foundation.”
Hold onto that thought for a second.
Let me walk you through this.
- Ofcom picks SaSu as its first enforcement target in February 2025.
- Correspondence over summer and autumn 2025 eventually leads to SaSu geoblocking the UK.
- Ofcom publicly accepts SaSu’s geoblock as an acceptable remedy in an announcement in October 2025.
- UK activist groups who wanted SaSu fined go nuclear on Ofcom in late October 2025. Ofcom changes its posture and opens an investigation in November 2025.
- Ofcom communicates nothing further until the end of February, 2026.
- Ofcom gathers evidence on the site in January and February 2026, using VPNs.
- Ofcom implicitly concedes, in its Provisional Decision dated 27 February 2026, that a user cannot register an account on the site or see an onboarding flow from a UK IP address.
- Section 5.26(c) of the Provisional Decision shows that, at some point in December of 2025, one of Ofcom’s NGO allies, the Mental Health Foundation, used a VPN to bypass the geoblock and create access credentials. This is six months into the geoblock being live and two to three months after Ofcom’s acceptance of the geoblock and abrupt reversal. An image of this may be found earlier in this post.
- Ofcom communicates its Provisional Decision on 27 February 2026.
- SaSu’s tiny legal team ingests the 100-odd page Provisional Decision, in full, in 72 hours in an effort to be responsive to Ofcom’s complaints. We also alert the press, civil society organizations, and our government.
- On March 1st, three days after the Provisional Decision issues, on a Sunday night, SaSu locks down the attack vector that the Mental Health Foundation used to register on the site by modifying an anti-spam feature on the site, the SSVerify function, mentioned in the Provisional Decision to ensure no new UK users can register on the site with UK IPs, even after they have already circumvented the geoblock with a VPN.
- This does not mean UK VPN users cannot see the site; it only means they cannot post. If an Internet user can use a VPN and access the site from a U.S. IP, that user can see the site.
- So the state of play, as of March 1st, 2026, is that a UK user arriving at the site for the first time (a) cannot access the site’s content without a VPN and (b) even with a VPN, cannot create new logins that would allow them to authenticate and post.
- On March 2nd, we reply to Ofcom. Ofcom is advised that its investigative methodology is flawed and that every factual finding in the Provisional Decision was based on access that was facilitated by geoblock circumvention using VPNs, both by it and by its NGO allies. This is highly suggestive that Ofcom is unable to build a case for enforcement without circumventing the geoblock.
- Ofcom is also informed about the changes to the onboarding flow that have been implemented in response to the Provisional Decision.
- Geoblocking is not employed for active authenticated sessions because it could potentially break the site. The problem of circumvention was what my client offered to fix on March 2nd, to which Ofcom offered no substantive response.
- After March 1st, it should not be possible for a UK resident approaching the site for the first time to (a) see the site at all or (b) create those authentication details without first intentionally circumventing the geoblock.
- After March 1st, a UK resident can see the site if he or she uses a VPN.
- After March 1st, a UK resident cannot create new login credentials, even with a VPN, unless that user possesses a significant degree of technical aptitude and the ability to access the SSVerify feature through a proxy server in another country which is not labeled as a VPN and presents itself as non-UK site traffic.
- After March 1st, the practical effect is that SaSu is, in effect, closed for most new UK users unless they have an extremely high degree of technical proficiency – a level of proficiency that no geoblock would be able to stop.
- In May of 2026, Ofcom, which still does not have credentials of its own, uses the Mental Health Foundation’s credentials, which were obtained by circumventing the geoblock in force in December with a VPN, to log in to the site. Keep in mind that UK users have never, for the entire duration of the block since July of 2025, been able to see the onboarding flow to create account credentials unless they deliberately circumvent the geoblock.
- Instead of requesting further changes or conducting further analysis, Ofcom proceeds to issue a fine anyway.
- Ofcom thus used the output of December’s geoblock circumvention by the Mental Health Foundation to circumvent the additional security measures that SaSu put in place on March 1st and communicated to Ofcom on March 2nd.
- Put another way, Ofcom is using the Mental Health Foundation’s deliberate geoblock circumvention to enable Ofcom’s own geoblock circumvention with false credentials, and then using the fact of Ofcom’s own circumvention to argue that the new, more aggressive geoblock that SaSu put in place in March, in response to Ofcom’s own investigative process, is insufficient.
- Ofcom concealed the identity of the account that circumvented the geoblock, giving SaSu no opportunity to remediate.
- Ofcom responded to those changes with silence. Ofcom had the opportunity to ask for further changes. It didn’t.
- It remains the case that the site cannot be accessed by a new user, or by Ofcom, except by deliberate circumvention of the access controls that Ofcom approved in October of 2025.
- Ofcom continues to fail to demonstrate that it can, today, access the site without deliberate circumvention of some type.
Summing up,
- Ofcom approved a geoblock in October.
- Ofcom reversed course on its approval following pressure from activists in November.
- MHF created that account by bypassing the geoblock with a VPN in December. This is stated explicitly in Paragraph 5.26(c) of the Provisional Decision.
- Ofcom told SaSu about this on February 27th.
- Three days later, SaSu made changes to close off the vector by which MHF bypassed the geoblock. It communicated these changes to Ofcom immediately.
- Ofcom refused to respond.
- In May, Ofcom asked MHF for the credentials to the MHF account, presumably the same one that bypassed the geoblock in December.
- In May, Ofcom logged into the MHF account.
- Ofcom did not, at any point in this process, tell SaSu to close off this additional vector or otherwise communicate to SaSu that its proposed solution, which SaSu communicated to Ofcom in writing, was inadequate.
- Ofcom can’t replicate access to the site without deliberately circumventing the geoblock again. If it can, now would be the time to explain how.
- It follows that Ofcom cannot say the site is accessible “without a VPN” because the MHF account, in order to be created in the first place, required the use of a VPN.
- The client pushed a hotfix today to address the issue anyway. All Ofcom had to do was ask.
The problem today, when the Confirmation Decision was issued, is exactly the same as it was two months ago when the Provisional Decision was issued. Ofcom’s entire evidentiary chain eventually leads back to the fact that, at some point, Ofcom or parties working in concert with it circumvented the geoblock using a VPN. But for that VPN access, neither Ofcom nor its partners would be able to access the site at all.
As I said when writing v1 of this post yesterday, the geoblock works, and it has worked for nearly a year. Ofcom couldn’t find a violation, so it seems, based on the evidence I have seen from the documentation, that they borrowed some login credentials from friends – who had already circumvented the block – in order to engineer one.
The fact that the geoblock is working largely as described been extensively validated by third parties trying to access the site today.
And the process of obtaining the login credentials Ofcom is relying on to make its determination, today, requires considerably more circumvention than simply spinning up a VPN – although spinning up a VPN is itself a deliberate circumvention, and the only way for a new user to even see the site from the UK at all.
Acquiring credentials to post requires multiple circumvention steps – a VPN plus a proxy server. Viewing, or posting after acquiring credentials, only requires one step – a VPN. Ofcom is complaining here about credentials that can only be obtained through the harder, multi-step circumvention procedure. Neither is something an ordinary UK user who is not voluntarily and intentionally choosing to exit the OSA panopticon does.
Ofcom is, in effect, complaining that SaSu failed to shut the barn door with respect to horses who have already bolted. Ofcom found a hole the size of a micrometer, one which has since been closed, and is trying to drive a truck through it.
Ofcom will, in due course, release detailed justifications for this enforcement action running to hundreds of pages. The length is not evidence of strength. The technical reality that is behind that decision – that the geoblock works and Ofcom, starting from scratch, is not able to access the site at all without first utilizing a circumvention measure – undermines the entire enforcement, which is why the long version of the decision will spend hundreds of pages obscuring that simple fact.
So, in terms of Ofcom’s claim about this matter, which states unambiguously that the site is available without access to a VPN,
A more correct answer would be,
“With NGO-supplied login details obtained by previously circumventing the geoblock, an authenticated session can be reached from a UK IP without invoking a VPN at the moment of login, although for a UK user to obtain authentication credentials it would require completing a multi-step circumvention process that requires using circumvention measures that go beyond VPNs, as login credentials cannot be generated when accessing the site by VPN. Ofcom itself would not, today, be able to access the site in the manner it claims to be able to without using that multi-step circumvention process, utilization of which would effectively require Ofcom to misrepresent itself as non-UK AND non-VPN web traffic.“
I challenge Ofcom, using the current state of the site, to try to gain access to it, de novo, without using a VPN. If it can do that (and, as the evidence shows, it can’t), then and only then can we have a conversation about effective or ineffective geoblocking. That was the conversation we were trying to have with Ofcom for six months. They did not want to have that conversation; they wanted to enforce.
Conclusions
Keeping the above fact pattern in mind, this is what Ofcom told the Guardian today:
Knowing what you now know, would you say that quote is an accurate description of this state of affairs?
Ofcom deliberately chose to not respond to my client’s site updates, and to proceed with a fine instead of a conversation about what further technical measures were required to satisfy it.
The point, of course, is that no further technical measures could satisfy Ofcom in this case. The agency is using the flimsiest of excuses to justify the enforcement actions that its political patrons demand. Ofcom and the NGOs had embargoed media stories ready-to-go this morning in a wide range of outlets and platforms. None of those stories mentioned the fact that Ofcom still can’t find a way to access the site without deliberately circumventing the block that Ofcom once found acceptable but now claims is inadequate. Effective geoblocking is not the point of the exercise; the point is to be seen to punish the target. The fine is confirmed, the constituencies are satisfied. They will get their scalp. (Whether they can enforce it in America is another matter.)
Cognizant that Ofcom is still flexing its powers in an attempt to get the rest of the American tech industry to fall into line, Ofcom appears to have forgotten that my client’s cooperation in this case was voluntary. There are limits to that cooperation, and those limits have, after this, likely been reached. The only way to block a UK user from this site in a manner that would satisfy Ofcom is to actively KYC users on a rolling basis, which my client is not obligated to do and is not going to do.
My hunch is that Ofcom will take this fact pattern, seek a blocking order in a UK court, and, as Ofcom’s point of view is the only one an English court will ever hear in this case, likely get it.
It will be difficult to advise a client to voluntarily engage with Ofcom in the future. It certainly didn’t do this client any good this time around.
Postscript, 14 May 2026
Thus ends Ofcom’s first-ever attempted enforcement action under the UK Online Safety Act 2023.