4chan and Kiwi Farms Challenge UK's Online Safety Act in Federal Court: A Test of International Internet Regulation

4chan and Kiwi Farms Challenge UK's Online Safety Act in Federal Court: A Test of International Internet Regulation

Two controversial US-based platforms take legal action against UK regulator Ofcom, claiming constitutional violations and extraterritorial overreach

In a significant legal challenge to international internet regulation, 4chan and Kiwi Farms have filed a lawsuit in US federal court against the United Kingdom's Office of Communications (Ofcom) over enforcement of the UK's Online Safety Act. The case, filed on August 27, 2025, represents a direct confrontation between US constitutional free speech protections and the UK's expanding digital safety regulations.

Background: The UK's Online Safety Act

The Online Safety Act 2023 creates new duties of care for online platforms, requiring them to take action against illegal content and content that could be harmful to children. Platforms failing these duties face fines of up to £18 million or 10% of their annual turnover, whichever is higher. The legislation came into effect in phases, with illegal content duties enforced from March 17, 2025, and child safety requirements from July 25, 2025.

The Act also empowers Ofcom to block access to particular websites and requires age verification for accessing various forms of potentially harmful content, including adult material and forums related to self-harm.

UK vs. 4chan: A Digital Sovereignty Showdown
How Britain’s Online Safety Act Sparked an International Legal Battle Over Free Speech and Jurisdiction The United Kingdom’s ambitious attempt to regulate the global internet has collided head-on with American free speech principles, creating an unprecedented international legal standoff that could reshape how nations enforce digital laws across borders. The

The lawsuit, filed in the US District Court for the District of Columbia, involves 4Chan Community Support LLC and Lolcow LLC, the corporate entities behind 4chan and Kiwi Farms respectively. Both entities argue they are wholly based in the US, have no operations in the United Kingdom, and are therefore not subject to UK laws.

The platforms' legal team makes several constitutional arguments:

First Amendment Violations: The lawsuit claims that threats and fines received from Ofcom "constitute foreign judgments that would restrict speech under U.S. law". The complaint states that "Where Americans are concerned, the Online Safety Act purports to legislate the Constitution out of existence".

Extraterritorial Overreach: The lawsuit describes Ofcom as an "industry-funded global censorship bureau" and argues that "Ofcom's ambitions are to regulate Internet communications for the entire world, regardless of where these websites are based or whether they have any connection to the UK".

Jurisdictional Challenges: In a pointed historical reference, Kiwi Farms stated in a letter responding to Ofcom's demands that "Parliament does not have that authority. That issue was settled, decisively, 243 years ago in a war that the UK's armies lost and are not in any position to relitigate".

Timeline of Enforcement Actions

The legal dispute has escalated over several months:

March 2025: Ofcom wrote to Kiwi Farms requiring it to "carry out an illegal content risk assessment" and submit the record by April 17, 2025.

June 2025: Ofcom began investigating 4chan over alleged violations of the Online Safety Act.

August 13, 2025: Ofcom announced a provisional decision stating that 4chan had "contravened its duties" and began charging the site a penalty of roughly $26,000 daily. According to the platforms' lawyer, Ofcom provisionally decided to impose a £20,000 fine "with daily penalties thereafter" for as long as the site fails to comply.

August 27, 2025: The formal lawsuit was filed in US federal court.

Preston Byrne of Byrne & Storm, P.C., representing both platforms, stated: "American citizens do not surrender our constitutional rights just because Ofcom sends us an e-mail. In the face of these foreign demands, our clients have bravely chosen to assert their constitutional rights".

Byrne told the BBC that "Ofcom's notices create no legal obligations in the United States" and described the regulator's investigation as part of an "illegal campaign of harassment" against US tech firms.

Ofcom's Position

An Ofcom spokesperson responded: "We are aware of the lawsuit. Under the Online Safety Act, any service that has links with the UK now has duties to protect UK users, no matter where in the world it is based. The Act does not, however, require them to protect users based anywhere else in the world".

According to the filing, Ofcom has written twice to Kiwi Farms, beginning with a March letter telling it to comply with Online Safety Act duties. Ofcom has declined to comment while its investigation continues.

Broader Implications for Internet Regulation

This case highlights growing tensions between different national approaches to internet governance. The complaint noted that "foreign governments have targeted American and non-European entrepreneurs with legal threats for conduct lawful in their home countries—for instance, France's 2024 arrest of Telegram founder Pavel Durov and its 2025 case against X Corp".

The lawsuit calls attention to "the messiness involved with trying to restrict access to specific websites or to force companies to comply with age verification laws" when dealing with platforms operating across international boundaries.

Women’s Safety App Tea Suffers Massive Data Breach, Users’ IDs Exposed on 4chan
Privacy Nightmare Hits Viral Dating Safety Platform UPDATE - July 28, 2025: Second Breach Exposes Over One Million Private Messages The Crisis Deepens: A More Serious Security Failure Revealed Just days after our initial report on the Tea app’s data breach, 404 Media has uncovered a second, far more devastating

Enforcement Challenges

Legal experts have noted the practical difficulties Ofcom faces in enforcing penalties against offshore providers. Emma Drake, partner of online safety and privacy at law firm Bird and Bird, told the BBC that "Enforcing against an offshore provider is tricky" but noted that "Ofcom can instead ask a court to order other services to disrupt a provider's UK business, such as requiring a service's removal from search results or blocking of UK payments".

If those measures prove insufficient, "Ofcom can even ask that ISPs be ordered to block UK access" to the platforms.

What the Platforms Seek

The lawsuit requests the court to block Ofcom from issuing further demands without going through proper international legal channels and to declare the Online Safety Act's enforcement efforts unenforceable in the United States. It also seeks a permanent injunction against any future attempts by Ofcom to impose UK regulations on the plaintiffs.

The Broader Context

The Online Safety Act has proven controversial domestically, with a petition calling for its repeal attracting over 500,000 signatures on the UK Parliament petitions website. Following its enactment, there was also a significant rise in downloads of VPN services by UK users seeking to circumvent age verification requirements.

Reform UK leader Nigel Farage has called the Act "borderline dystopian" and said he would repeal it if elected to government, while fellow Reform leader Zia Yusuf described the legislation as "an assault on freedom".

However, supporters of the Act, including Prime Minister Sir Keir Starmer, have said it is necessary to protect children from harmful online content such as "suicide sites," with the National Crime Agency also insisting the legislation is necessary to safeguard children from online harms.

Digital Compliance Alert: UK Online Safety Act and EU Digital Services Act Cross-Border Impact Analysis
Executive Summary: Two major digital regulatory frameworks have reached critical implementation phases that demand immediate compliance attention from global platforms. The UK’s Online Safety Act entered its age verification enforcement phase on July 25, 2025, while escalating tensions between US officials and EU regulators over the Digital Services Act highlight

What's Next

This case represents an early test of how international courts will handle conflicts between national internet regulations and constitutional protections in other jurisdictions. The outcome could set important precedents for how online platforms operating globally navigate conflicting regulatory requirements.

As the lawsuit puts it, the case stands as "a direct confrontation between two visions of the internet: one based on the US constitutional tradition of free speech and open access, and another that embraces government-mandated safety regimes that can be weaponized to silence speech on a global scale".

The case will likely be closely watched by other platforms operating internationally and by regulators worldwide as they grapple with the challenges of governing a borderless internet within the constraints of national sovereignty and constitutional law.

This story continues to develop as the legal proceedings unfold in federal court.

Navigating the Global Data Privacy Maze: A Strategic Imperative for Modern Businesses
In today’s interconnected world, the landscape of data privacy legislation is rapidly evolving, moving far beyond the borders of the European Union’s General Data Protection Regulation (GDPR). What was once a regional standard has now become a global blueprint, making a comprehensive cross-regulatory compliance strategy not just beneficial, but absolutely

Read more

The SharePoint Hack That Changed Global Cybersecurity: Inside Microsoft's MAPP Crisis

The SharePoint Hack That Changed Global Cybersecurity: Inside Microsoft's MAPP Crisis

A comprehensive investigation into the 2025 breach that compromised 400+ organizations and forced Microsoft to restructure its vulnerability sharing program Introduction In July 2025, the cybersecurity world witnessed a watershed moment when Chinese state-sponsored attackers exploited critical, unpatched vulnerabilities in Microsoft SharePoint. The breach, which followed shortly after Microsoft shared

By Breached Company
Warlock Ransomware: The Critical Infrastructure Threat Redefining Global Cybersecurity in 2025

Warlock Ransomware: The Critical Infrastructure Threat Redefining Global Cybersecurity in 2025

A comprehensive analysis of the ransomware-as-a-service operation that has compromised over 400 organizations worldwide through sophisticated SharePoint exploitation Executive Summary The emergence of Warlock ransomware in mid-2025 has fundamentally reshaped the global cybersecurity landscape, representing a new paradigm in the sophistication and scale of ransomware operations. Operating as a ransomware-as-a-service

By Breached Company
DOGE SSA Data Security Breach: A Case Study in Government Contractor Access and Insider Threats

DOGE SSA Data Security Breach: A Case Study in Government Contractor Access and Insider Threats

Executive Summary A whistleblower complaint filed by Charles Borges, Chief Data Officer at the Social Security Administration (SSA), alleges that Department of Government Efficiency (DOGE) personnel created unauthorized copies of the NUMIDENT database—containing personal information for over 300 million Americans—in cloud environments lacking independent security controls and oversight

By Breached Company