The bill in your admin channel isn't law

A member of the House of Lords introduced a bill on 7 September 2026 that, read literally, would require every Mastodon server reachable from the UK to hold a licence from Ofcom. The document is real. It is also not law, not close to law, and the most important word in its title is the one people keep dropping when they share it: it is a Bill, not an Act.

The version circulating in admin channels is labelled the “Social Media Platforms (Ofcom Licensing) Act 2026.” No such Act exists. What exists is the Social Media Platforms (Ofcom Licensing) Bill [HL], catalogued as Bill 4285 on the UK Parliament website and sponsored by Baroness Floella Benjamin. The “[HL]” tag means it started in the House of Lords, the unelected upper chamber. It has had one first reading - which in the Lords is a formality with no debate and no vote - and nothing else. Nobody has argued it. Nobody has amended it. Nobody has agreed a single clause.

That distinction is not pedantry. It changes what a UK admin should do this week from “take your server offline” to “read the text and watch the calendar.”

What the bill would actually require

The mechanism is licensing. The bill says a person must not operate a “social media platform” available to users in the United Kingdom unless authorised by a licence from Ofcom. Operating without one would be an offence. Ofcom would be able to attach binding conditions to a licence and, if an operator breached them, suspend or revoke it.

The problem is the definition. A “social media platform” is drawn as any platform whose sole or significant purpose is letting users create, share, discover or consume user-generated content, and which lets users find, interact with or follow the accounts of people they are not communicating with privately. That is a functional description of Mastodon. It is also a functional description of a single-user instance you run for yourself, a five-person instance for a hobby club, and Meta’s entire estate. The text does not distinguish between them by size, revenue, or user count.

So yes - taken at face value, the bill would make running a small Mastodon server without an Ofcom licence a criminal act. That is a real reading of a real document. It is also the reason the bill, in its current form, is a blunt instrument: it is a good-faith attempt at a specific problem, written broadly enough to catch the small operators it was never aimed at. That over-breadth is exactly the kind of thing committee scrutiny exists to sand down, if the bill ever reaches committee.

Why “private member’s bill” is the whole story

Bills come in two practical categories that matter here. Government bills get parliamentary time because the government controls the schedule. Private members’ bills - sponsored by an individual MP or peer rather than a minister - get almost none. A Lords-originated private member’s bill is at the far end of that spectrum. It has to clear the Lords, then find a sponsor and a slot in the Commons, then survive every stage in both houses before the session ends. Most run out of time long before that. The base rate for this category becoming law without government support is close to zero.

There is one path that changes the odds: the government decides it likes the idea and either adopts the bill or folds its provisions into a government bill with proper drafting and proper time. That has happened before with online-harms measures. It is the scenario worth tracking. Until there is a signal the government wants this - a supportive statement from a minister, or the idea appearing in a government bill - the correct threat level is “monitor,” not “migrate your instance to Ireland.”

Baroness Benjamin has a long record campaigning on child online safety, which tells you the intent behind the bill and also why it is worded to cast a wide net. Intent is not the same as enacted law. Right now this is a marker being laid down, not a rule you can be prosecuted under.

The law that already applies to your server

Here is the part the panic buries: there is already a UK law that governs Mastodon instances, it is already in force, and Ofcom is already the regulator. It is the Online Safety Act 2023. If you run a UK-based instance, that is the thing with actual teeth today - not the September bill.

The Act’s uncomfortable feature for Fediverse operators is scope. It regulates “user-to-user services,” and Ofcom has read that term broadly enough that even visitors to a public timeline can count as users. Lawyers who have looked at this - including the team at decoded.legal and admins who have published their own assessments - land in the same place: it makes little sense to apply the full weight of the Act to someone hosting an instance for a dozen friends, but based on the definitions you cannot rule it out, because Fediverse users on other servers interact with yours. Ambiguity is the risk, not a clear ban.

The illegal-harms duties took effect in 2025. In practice that means Ofcom expects even small user-to-user services to have done, and documented, a risk assessment for illegal content, and to give users a way to report it.

The Online Safety Act is not the only law already touching your instance, either, and knowing the full map keeps you from over-reacting to the one bill in the news. If you take donations, you are likely an “information society service” under the eCommerce Regulations, which obliges you to publish basic contact details but hands you a real liability shield for user content. The Defamation Act 2013 gives you a defence for statements you did not post, provided you respond to valid notices. UK GDPR turns on whether you process data as a business and whether you target UK users - a hobby instance run for friends usually falls outside its material scope. None of these are new, none were triggered by the September bill, and all of them reward the same habits: publish who you are, moderate promptly, and write down what you decided.

What to do this month if you run a UK instance

The bill needs nothing from you yet. The Online Safety Act does. These are the concrete steps admins who have already worked through this have taken, and none of them require a lawyer:

• Write an illegal-content risk assessment and publish or file it. For a small instance the honest conclusion is usually “low risk,” and Ofcom’s own framing is proportionate - a documented low-risk conclusion is a defensible position. The failure mode is not reaching that conclusion; it is never doing the assessment at all.
• Make reporting work. Mastodon ships with report-post and report-account tools. Confirm they function and that reports reach you. That single feature satisfies most of the “let users report illegal content” expectation out of the box.
• Publish terms of service and a privacy policy that state what content is not allowed and how you handle it. This also strengthens your position under the eCommerce Regulations, which shield you from liability for user content if you act quickly once you are aware of it.
• Name an accountable person. For a one-admin instance that is you. Write it down. The single most common finding in security and compliance work is that nobody owns the risk; the fix is naming a human, not buying a tool.
• Set a hard rule for the worst content. Child sexual abuse material goes to the National Crime Agency or the Internet Watch Foundation, not just a delete button. Content tied to proscribed organisations gets removed and the account blocked. Have that decided before you ever have to make it at 2am.
• Defederate deliberately. Blocking servers that host racist or illegal content is both good moderation and evidence that you take your duties seriously. Keep a note of why you blocked what.

Most of this is a few hours of writing, once. It also happens to be the same work that would put you in a stronger position if the licensing bill - or a government version of it - ever did advance.

What to watch, and when to actually worry

Three signals tell you whether this moves from a Lords marker to a real obligation. First, a second reading being scheduled with government time behind it, rather than the bill sitting untouched after first reading. Second, a minister saying anything supportive on the record, or the licensing idea surfacing inside a government bill. Third, Ofcom updating its Online Safety Act guidance in a way that narrows or removes the small-operator ambiguity - that would change your real obligations faster than any private member’s bill.

If none of those happen, the bill dies quietly at the end of the session, as most in its category do, and the only thing that ever governed your server was the Act that already does.

The move for a UK Mastodon admin today is not to shut down. It is to spend an afternoon on the Online Safety Act paperwork you already owe, bookmark the Parliament page for Bill 4285, and get on with running your server.

Sources: Social Media Platforms (Ofcom Licensing) Bill [HL] - UK Parliament; Digital Watch Observatory; decoded.legal - Notes on operating Fediverse services under English law; Ben Tasker - Online Safety Act assessment for a Mastodon instance.