The Poisonous Tree

A reminder to everyone that starting tomorrow, we are being forced to block access to any IP address that geolocates to the state of Mississippi for legal reasons while we and Netchoice continue fighting the law in court. People whose IP addresses geolocate to Mississippi will only be able to access a page that explains the issue and lets them know that we'll be back to offer them service as soon as the legal risk to us is less existential.

The block page will include the apology but I'll repeat it here: we don't do geolocation ourselves, so we're limited to the geolocation ability of our network provider. Our anti-spam geolocation blocks have shown us that their geolocation database has a number of mistakes in it. If one of your friends who doesn't live in Mississippi gets the block message, there is nothing we can do on our end to adjust the block, because we don't control it. The only way to fix a mistaken block is to change your IP address to one that doesn't register as being in Mississippi, either by disconnecting your internet connection and reconnecting it (if you don't have a static IP address) or using a VPN.

In related news, the judge in our challenge to Tennessee's social media age verification, parental consent, and parental surveillance law (which we are also part of the fight against!) ruled last month that we had not met the threshold for a temporary injunction preventing the state from enforcing the law while the court case proceeds.

The Tennesee law is less onerous than the Mississippi law and the fines for violating it are slightly less ruinous (slightly), but it's still a risk to us. While the fight goes on, we've decided to prevent any new account signups from anyone under 18 in Tennessee to protect ourselves against risk. We do not need to block access from the whole state: this only applies to new account creation.

Because we don't do any geolocation on our users and our network provider's geolocation services only apply to blocking access to the site entirely, the way we're implementing this is a new mandatory question on the account creation form asking if you live in Tennessee. If you do, you'll be unable to register an account if you're under 18, not just the under 13 restriction mandated by COPPA. Like the restrictions on the state of Mississippi, we absolutely hate having to do this, we're sorry, and we hope we'll be able to undo it as soon as possible.

Finally, I'd like to thank every one of you who's commented with a message of support for this fight or who's bought paid time to help keep us running. The fact we're entirely user-supported and you all genuinely understand why this fight is so important for everyone is a huge part of why we can continue to do this work. I've also sent a lot of your comments to the lawyers who are fighting the actual battles in court, and they find your wholehearted support just as encouraging and motivating as I do. Thank you all once again for being the best users any social media site could ever hope for. You make me proud and even more determined to yell at state attorneys general on your behalf.

I'll start with the tl;dr summary to make sure everyone sees it and then explain further: As of September 1, we will temporarily be forced to block access to Dreamwidth from all IP addresses that geolocate to Mississippi for legal reasons. This block will need to continue until we either win the legal case entirely, or the district court issues another injunction preventing Mississippi from enforcing their social media age verification and parental consent law against us.

Mississippi residents, we are so, so sorry. We really don't want to do this, but the legal fight we and Netchoice have been fighting for you had a temporary setback last week. We genuinely and honestly believe that we're going to win it in the end, but the Fifth Circuit appellate court said that the district judge was wrong to issue the preliminary injunction back in June that would have maintained the status quo and prevented the state from enforcing the law requiring any social media website (which is very broadly defined, and which we definitely qualify as) to deanonymize and age-verify all users and obtain parental permission from the parent of anyone under 18 who wants to open an account.

Netchoice took that appellate ruling up to the Supreme Court, who declined to overrule the Fifth Circuit with no explanation -- except for Justice Kavanaugh agreeing that we are likely to win the fight in the end, but saying that it's no big deal to let the state enforce the law in the meantime.

Needless to say, it's a big deal to let the state enforce the law in the meantime. The Mississippi law is a breathtaking state overreach: it forces us to verify the identity and age of every person who accesses Dreamwidth from the state of Mississippi and determine who's under the age of 18 by collecting identity documents, to save that highly personal and sensitive information, and then to obtain a permission slip from those users' parents to allow them to finish creating an account. It also forces us to change our moderation policies and stop anyone under 18 from accessing a wide variety of legal and beneficial speech because the state of Mississippi doesn't like it -- which, given the way Dreamwidth works, would mean blocking people from talking about those things at all. (And if you think you know exactly what kind of content the state of Mississippi doesn't like, you're absolutely right.)

Needless to say, we don't want to do that, either. Even if we wanted to, though, we can't: the resources it would take for us to build the systems that would let us do it are well beyond our capacity. You can read the sworn declaration I provided to the court for some examples of how unworkable these requirements are in practice. (That isn't even everything! The lawyers gave me a page limit!)

Unfortunately, the penalties for failing to comply with the Mississippi law are incredibly steep: fines of $10,000 per user from Mississippi who we don't have identity documents verifying age for, per incident -- which means every time someone from Mississippi loaded Dreamwidth, we'd potentially owe Mississippi $10,000. Even a single $10,000 fine would be rough for us, but the per-user, per-incident nature of the actual fine structure is an existential threat. And because we're part of the organization suing Mississippi over it, and were explicitly named in the now-overturned preliminary injunction, we think the risk of the state deciding to engage in retaliatory prosecution while the full legal challenge continues to work its way through the courts is a lot higher than we're comfortable with. Mississippi has been itching to issue those fines for a while, and while normally we wouldn't worry much because we're a small and obscure site, the fact that we've been yelling at them in court about the law being unconstitutional means the chance of them lumping us in with the big social media giants and trying to fine us is just too high for us to want to risk it. (The excellent lawyers we've been working with are Netchoice's lawyers, not ours!)

All of this means we've made the extremely painful decision that our only possible option for the time being is to block Mississippi IP addresses from accessing Dreamwidth, until we win the case. (And I repeat: I am absolutely incredibly confident we'll win the case. And apparently Justice Kavanaugh agrees!) I repeat: I am so, so sorry. This is the last thing we wanted to do, and I've been fighting my ass off for the last three years to prevent it. But, as everyone who follows the legal system knows, the Fifth Circuit is gonna do what it's gonna do, whether or not what they want to do has any relationship to the actual law.

We don't collect geolocation information ourselves, and we have no idea which of our users are residents of Mississippi. (We also don't want to know that, unless you choose to tell us.) Because of that, and because access to highly accurate geolocation databases is extremely expensive, our only option is to use our network provider's geolocation-based blocking to prevent connections from IP addresses they identify as being from Mississippi from even reaching Dreamwidth in the first place. I have no idea how accurate their geolocation is, and it's possible that some people not in Mississippi might also be affected by this block. (The inaccuracy of geolocation is only, like, the 27th most important reason on the list of "why this law is practically impossible for any site to comply with, much less a tiny site like us".)

If your IP address is identified as coming from Mississippi, beginning on September 1, you'll see a shorter, simpler version of this message and be unable to proceed to the site itself. If you would otherwise be affected, but you have a VPN or proxy service that masks your IP address and changes where your connection appears to come from, you won't get the block message, and you can keep using Dreamwidth the way you usually would.

On a completely unrelated note while I have you all here, have I mentioned lately that I really like ProtonVPN's service, privacy practices, and pricing? They also have a free tier available that, although limited to one device, has no ads or data caps and doesn't log your activity, unlike most of the free VPN services out there. VPNs are an excellent privacy and security tool that every user of the internet should be familiar with! We aren't affiliated with Proton and we don't get any kickbacks if you sign up with them, but I'm a satisfied customer and I wanted to take this chance to let you know that.

Again, we're so incredibly sorry to have to make this announcement, and I personally promise you that I will continue to fight this law, and all of the others like it that various states are passing, with every inch of the New Jersey-bred stubborn fightiness you've come to know and love over the last 16 years. The instant we think it's less legally risky for us to allow connections from Mississippi IP addresses, we'll undo the block and let you know.