Online Safety Act: llegal Content Risk and Children's Access Assessments, 2025

[admin]

This Forum is covered by the new Online Safety Act as it is a user-to-user service with significant numbers of users in the UK.

Check if the regulations apply: https://ofcomlive.my.salesforce-sites.c ... ionChecker
How to comply: https://www.ofcom.org.uk/os-toolkit/che ... to-comply/

Text structure copied from the Ofcom template Word document provided by the toolkit above.

Service name: Cycling UK Forum
Service type: User-to-user (U2U) service
Completion date: 21 Jan 2025, 5 Feb 2025.
Next review/update date: See below in Step 4.
Reason for review: Initial review for the new Online Safety Act.
Completed by: Anthony Cartmell <ajcartmell@fonant.com>
Named person responsible for the risk assessment: Anthony Cartmell
Approved by (governance and accountability channels): Dominic Kelly, Head of Digital Services, Cycling UK <dominic.kelly@cyclinguk.org>

Step 1: U2U and Search Risk Profiles and risk factors

1. Is your service any of these types?
☐ Social media service
☐ Messaging service
☐ Gaming service
☐ Adult service
🗹 Discussion forum or chat room
🗹 Marketplace or listing service
☐ File-sharing or file storage service
☐ None of the above

Note: The listings "for sale" are provided free of charge as "small ads": the Forum does not take any part in the actual sale or purchase of items.

2. Do child users access some or all of the service?
Yes, possibly, but this is not a service designed for, or particularly attractive to, children.

3. Does your service include any of these user identification functionalities?
🗹 User profiles
☐ Anonymous user profiles or users without accounts
☐ None of the above

Note: The Forum is available to users without accounts, but only to read content, not to add to it; there is no way to identify such users.

4. Does your service include any of these user networking functionalities?
☐ Users can connect with other users
☐ Users can form closed groups or send group messages
🗹 None of the above

5. Does your service include any of these user communication functionalities?
☐ Livestreaming (either open or closed channels)
🗹 Direct messaging (including ephemeral direct messaging)
☐ Encrypted messaging
🗹 Commenting on content
🗹 Posting or sending images or videos (either open or closed channels)
☐ Posting or sending location information
☐ Re-posting or forwarding content
☐ None of the above

Note: "Direct messaging" is highly limited by the phpBB forum software: it enables limited user-to-user contact in the form of "private posts". Users can only read these by visiting the forum and logging into their accounts.

6. Does your service allow users to post goods and services for sale?
Yes

7. Does your service include any of the following functionalities that allow users to find or encounter content? Tick all that apply.
🗹 Searching for user-generated content
🗹 Hyperlinking
☐ None of the above

8. Does your service use content or network recommender systems?
No

Search service Risk Profile and risk factors

Not relevant. Search facility is only for internal Forum content.

Step 2: U2U and Search: Assess the risk of harm

Terrorism
Risk level: Negligible
Risk factors considered: Extremely unlikely to occur on a public cycling-specific forum. Relatively low numbers of visitors compare with large online user-to-user services.
Additional characteristics considered: None.
Existing controls considered: Active moderation team, user reporting functionality.
Evidence: 18 years of use without such content being posted, to the best of moderators' knowledge and belief.

Child sexual exploitation and abuse (CSEA)
Risk level: Negligible
Risk factors considered: Extremely unlikely to occur on a public cycling-specific forum, very few child users. Relatively low numbers of visitors compare with large online user-to-user services.
Additional characteristics considered: None.
Existing controls considered: Active moderation team, user reporting functionality.
Evidence: 18 years of use without such content being posted, to the best of moderators' knowledge and belief. No signs of children posting or visiting the Forum in any significant number.

Image-based child sexual abuse material (U2U only)
Risk level: Low‡
Risk factors considered: Extremely unlikely to occur on a public cycling-specific forum. Relatively low numbers of visitors compare with large online user-to-user services.
Additional characteristics considered: None.
Existing controls considered: Active moderation team, user reporting functionality.
Evidence: 18 years of use without such content being posted, to the best of moderators' knowledge and belief.

Child sexual abuse material URLs (U2U only)
Risk level: Low‡
Risk factors considered: Extremely unlikely to occur on a public cycling-specific forum. Relatively low numbers of visitors compare with large online user-to-user services.
Additional characteristics considered: None.
Existing controls considered: Active moderation team, user reporting functionality.
Evidence: 18 years of use without such content being posted, to the best of moderators' knowledge and belief.

Grooming (Child sexual abuse and exploitation) (U2U only)
Risk level: Low‡
Risk factors considered: Extremely unlikely to occur on a public cycling-specific forum, very few child users. Relatively low numbers of visitors compare with large online user-to-user services.
Additional characteristics considered: None.
Existing controls considered: Active moderation team, user reporting functionality.
Evidence: 18 years of use without such content being posted, to the best of moderators' knowledge and belief. No signs of children posting or visiting the Forum in any significant number.

Hate
Risk level: Negligible
Risk factors considered: Extremely unlikely to occur on a public cycling-specific forum. Relatively low numbers of visitors compare with large online user-to-user services.
Additional characteristics considered: None.
Existing controls considered: Active moderation team, user reporting functionality.
Evidence: 18 years of use without such content being posted, to the best of moderators' knowledge and belief.

Harassment, stalking, threats and abuse offences
Risk level: Negligible
Risk factors considered: Extremely unlikely to occur on a public cycling-specific forum. Relatively low numbers of visitors compare with large online user-to-user services.
Additional characteristics considered: None.
Existing controls considered: Active moderation team, user reporting functionality.
Evidence: 18 years of use without such content being posted, to the best of moderators' knowledge and belief. Unpleasant/personal posts have been removed by moderators, but nothing that gets into illegal territory.

Controlling or coercive behaviour
Risk level: Negligible
Risk factors considered: Extremely unlikely to occur on a public cycling-specific forum. Relatively low numbers of visitors compare with large online user-to-user services.
Additional characteristics considered: None.
Existing controls considered: Active moderation team, user reporting functionality.
Evidence: 18 years of use without such content being posted, to the best of moderators' knowledge and belief.

Intimate image abuse
Risk level: Negligible
Risk factors considered: Extremely unlikely to occur on a public cycling-specific forum. Relatively low numbers of visitors compare with large online user-to-user services.
Additional characteristics considered: None.
Existing controls considered: Active moderation team, user reporting functionality.
Evidence: 18 years of use without such content being posted, to the best of moderators' knowledge and belief.

Extreme pornography offence
Risk level: Negligible
Risk factors considered: Extremely unlikely to occur on a public cycling-specific forum. Relatively low numbers of visitors compare with large online user-to-user services.
Additional characteristics considered: None.
Existing controls considered: Active moderation team, user reporting functionality.
Evidence: 18 years of use without such content being posted, to the best of moderators' knowledge and belief.

Sexual exploitation of adults
Risk level: Negligible
Risk factors considered: Extremely unlikely to occur on a public cycling-specific forum. Relatively low numbers of visitors compare with large online user-to-user services.
Additional characteristics considered: None.
Existing controls considered: Active moderation team, user reporting functionality.
Evidence: 18 years of use without such content being posted, to the best of moderators' knowledge and belief.

Human trafficking
Risk level: Negligible
Risk factors considered: Extremely unlikely to occur on a public cycling-specific forum. Relatively low numbers of visitors compare with large online user-to-user services.
Additional characteristics considered: None.
Existing controls considered: Active moderation team, user reporting functionality.
Evidence: 18 years of use without such content being posted, to the best of moderators' knowledge and belief.

Unlawful immigration
Risk level: Negligible
Risk factors considered: Extremely unlikely to occur on a public cycling-specific forum. Relatively low numbers of visitors compare with large online user-to-user services.
Additional characteristics considered: None.
Existing controls considered: Active moderation team, user reporting functionality.
Evidence: 18 years of use without such content being posted, to the best of moderators' knowledge and belief.

Fraud and financial services offences
Risk level: Negligible
Risk factors considered: Extremely unlikely to occur on a public cycling-specific forum. Relatively low numbers of visitors compare with large online user-to-user services.
Additional characteristics considered: None.
Existing controls considered: Active moderation team, user reporting functionality.
Evidence: 18 years of use without such content being posted, to the best of moderators' knowledge and belief. Some minor disagreements about sales of bikes and parts, where contact was initiated from the For Sale boards.

Proceeds of crime
Risk level: Negligible
Risk factors considered: Extremely unlikely to occur on a public cycling-specific forum. Relatively low numbers of visitors compare with large online user-to-user services.
Additional characteristics considered: None.
Existing controls considered: Active moderation team, user reporting functionality.
Evidence: 18 years of use without such content being posted, to the best of moderators' knowledge and belief.

Drugs and psychoactive substances
Risk level: Negligible
Risk factors considered: Extremely unlikely to occur on a public cycling-specific forum. Relatively low numbers of visitors compare with large online user-to-user services.
Additional characteristics considered: None.
Existing controls considered: Active moderation team, user reporting functionality.
Evidence: 18 years of use without such content being posted, to the best of moderators' knowledge and belief.

Firearms, knives and other weapons
Risk level: Negligible
Risk factors considered: Extremely unlikely to occur on a public cycling-specific forum. Relatively low numbers of visitors compare with large online user-to-user services.
Additional characteristics considered: None.
Existing controls considered: Active moderation team, user reporting functionality.
Evidence: 18 years of use without such content being posted, to the best of moderators' knowledge and belief.

Encouraging or assisting suicide (or attempted suicide)
Risk level: Negligible
Risk factors considered: Extremely unlikely to occur on a public cycling-specific forum. Relatively low numbers of visitors compare with large online user-to-user services.
Additional characteristics considered: None.
Existing controls considered: Active moderation team, user reporting functionality.
Evidence: 18 years of use without such content being posted, to the best of moderators' knowledge and belief.

Foreign interference offence
Risk level: Negligible
Risk factors considered: Extremely unlikely to occur on a public cycling-specific forum. Relatively low numbers of visitors compare with large online user-to-user services.
Additional characteristics considered: None.
Existing controls considered: Active moderation team, user reporting functionality.
Evidence: 18 years of use without such content being posted, to the best of moderators' knowledge and belief.

Animal cruelty
Risk level: Negligible
Risk factors considered: Extremely unlikely to occur on a public cycling-specific forum. Relatively low numbers of visitors compare with large online user-to-user services.
Additional characteristics considered: None.
Existing controls considered: Active moderation team, user reporting functionality.
Evidence: 18 years of use without such content being posted, to the best of moderators' knowledge and belief.


‡ Those risk levels above that are assessed as "Low" are considered "Negligible" but the Ofcom guidance suggests that these can only be assessed as "Negligible" in very specific circumstances that don't apply here.


Step 3: U2U and Search: Decide measures, implement and record

Illegal content Codes of Practice measures

Measure: ICU A2
Description: Individual accountable for illegal content safety duties and reporting and complaints duties.
Status: Implemented
Date measure takes/took effect: 21 Jan 2025
Relevant code: CSEA, Terrorism, Other duties
Relevant duties: Section 10(2), (3), and (5) to (9)Section 20(2)* Section 21(2)† and (3)†
Date record made: 21 Jan 2025

Measure: ICU C1
Description: Having a content moderation function to review and assess suspected illegal content.
Status: Implemented
Date measure takes/took effect: 2017
Relevant code: CSEA, Terrorism, Other duties
Relevant duties: Section 10(2) and (3), Section 21(2)(b)†
Date record made: 21 Jan 2025

Measure: ICU C2
Description: Having a content moderation function that allows for the swift take down of illegal content.
Status: Implemented
Date measure takes/took effect: 2017
Relevant code: CSEA, Terrorism, Other duties
Relevant duties: Section 10(2) and (3), Section 21(2)(b)†
Date record made: 21 Jan 2025

Measure: ICU D1
Description: Enabling complaints.
Status: Implemented
Date measure takes/took effect: 2017
Relevant code: CSEA, Terrorism, Other duties
Relevant duties: Section 20(2), Section 21(2)(a)†
Date record made: 21 Jan 2025

Measure: ICU D2
Description: Having easy to find, easy to access and easy to use complaints systems and processes.
Status: Implemented
Date measure takes/took effect: 2017
Relevant code: CSEA, Terrorism, Other duties
Relevant duties: Section 20(2), Section 21(2)(c)†
Date record made: 21 Jan 2025

Measure: ICU D7
Description: Appropriate action for relevant complaints about suspected illegal content.
Status: Implemented
Date measure takes/took effect: 2017
Relevant code: CSEA, Terrorism, Other duties
Relevant duties: Section 10(3), Section 21(2)(b)†
Date record made: 21 Jan 2025

Measure: ICU D9
Description: Appropriate action for relevant complaints which are appeals – determination(services that are neither large nor multi risk).
Status: Implemented
Date measure takes/took effect: 2017
Relevant code: CSEA, Terrorism, Other duties
Relevant duties: Section 21(2)(b)†
Date record made: 21 Jan 2025

Measure: ICU D10
Description: Appropriate action for relevant complaints which are appeals – action following determination.
Status: Implemented
Date measure takes/took effect: 2017
Relevant code: CSEA, Terrorism, Other duties
Relevant duties: Section 21(2)(b)†
Date record made: 21 Jan 2025

Measure: ICU D11 not applicable: no proactive technology used.

Measure: ICU D12
Description: Appropriate action for all other relevant complaints.
Status: Implemented
Date measure takes/took effect: 2017
Relevant code: CSEA, Terrorism, Other duties
Relevant duties: Section 21(2)(b)†
Date record made: 21 Jan 2025

Measure: ICU D13
Description: Exception: manifestly unfounded complaints.
Status: Implemented
Date measure takes/took effect: 2017
Relevant code: CSEA, Terrorism, Other duties
Relevant duties: Section 21(2)(b)†
Date record made: 21 Jan 2025

Measure: ICU G1
Description: Terms of service: substance (all services).
Status: Implemented
Date measure takes/took effect: 2017
Relevant code: CSEA, Terrorism, Other duties
Relevant duties: Section 10(5) and (7), Section 21(3)†
Date record made: 21 Jan 2025

Measure: ICU G3
Description: Terms of service: clarity and accessibility.
Status: Implemented
Date measure takes/took effect: 2017
Relevant code: CSEA, Terrorism, Other duties
Relevant duties: Section 10(8), Section 21(3)†
Date record made: 21 Jan 2025

Measure: ICU H1
Description: Removing accounts of proscribed organisations.
Status: Implemented
Date measure takes/took effect: 2017
Relevant code: Terrorism
Relevant duties: Section 10(2) and (3)
Date record made: 21 Jan 2025

* So far as it relates to illegal content.
† So far as relating to the complaints set out in section 21(4).


Alternative measures

None.

Step 4: U2U and Search: Report, review, and update risk assessments

Date of next annual risk assessment: 1 April 2026
Confirmation findings of the illegal content risk assessment have been reported, and recorded: Yes, here.
Date the findings of the illegal content risk assessment were reported, and recorded: 5 February 2025.

Information on how you take appropriate steps to keep the risk assessment up to date (for example, a written policy): Review should any content be posted that might change the above risk assessment. Annual review on 1 April each year.

EDITED 2025-02-10: Improved grammar/readability of note to answer 3 in step 1; Changed "as far as moderators have noticed" to "to the best of moderators' knowledge and belief" in various places; changed "No obvious signs of children posting..." to "No signs of children posting..." in various places.

[admin]

Children’s Access Assessment

[See: https://www.ofcom.org.uk/online-safety/ ... sessments/]

Stage 1:

Is it possible for children to access the service or part of it? Yes

Note: the forum is public, and "accessing the service" includes visiting the site without logging in or posting. We don't have any age verification tools, or limits on the ages of people viewing the forum.

Stage 2:

Are there a significant number of children who are users of the service? No

Note: as far as we can tell. Impossible to know whether site visitors are aged under 18 or not, all we have is an IP address.

Is the service of a kind likely to attract a significant number of children? No

Note: children do really like riding bicycles, but they're probably not that interested in reading this Forum - we don't have child-specific content.

Result: No need to carry out a Children's Risk Assessment.