Mississippi’s age assurance law puts decentralized social networks to the test

An overly broad age assurance law in Mississippi is leading to arguments about which platforms — Bluesky, Mastodon, or others — offer the best solution for avoiding crackdowns on internet freedoms.

The company that makes the Bluesky social app announced last week that it would block access to its service in the state of Mississippi, rather than comply with the new age verification law. In a blog post, the company explained that, as a small team, it lacked the resources to implement the substantial technical changes required by the law, and it raised concerns about the law’s broad scope and potential privacy implications.

The law, HB 1126, requires platforms to implement age verification for all users before they can access social networks like Bluesky. Recently, the Supreme Court justices decided to block an emergency appeal that would have prevented the law from going into effect as the legal challenges it faces played out in the courts. This forced Bluesky to make a decision of its own: either comply or risk hefty fines of up to $10,000 per user.

Users in Mississippi soon scrambled for a workaround, which tends to involve the use of VPNs.

However, others questioned why a VPN would be the necessary solution here. After all, decentralized social networking was meant to reduce the control and power the state — or any authority — would have over these social platforms.

On Mastodon, the decentralized social network running the ActivityPub protocol, founder Eugen Rochko responded to the announcement from Bluesky by taking a bit of a potshot at the rival social network.

“And this is why real decentralization matters,” he wrote. “There is nobody that can decide for the fediverse to block Mississippi.”

This prompted a response from Techdirt founder and Bluesky board member Mike Masnick, who said Rochko’s statement was “potentially misleading.”

“Both because others can host their own views of the network,” he pointed out. “But also will the largest instances, which you run, be willing to pay the $10k/user fines in Mississippi? Because the state can still go after instances, no?” (He’s referring to the large instance, or server, called mastodon.social, which Rochko also runs.)

TechCrunch reached out to Mastodon to confirm whether it would comply with the law on the mastodon.social instance, and we didn’t hear back by time of publication. But the law was written in a way that a Mastodon instance could seemingly become a target — as could a “message board,” “chat room,” “landing page,” “video channel,” or “main feed,” it states.

Rochko and Masnick then engaged in a rather spicy back-and-forth, as others chimed in, with Rochko accusing Bluesky of having all its infrastructure run by one U.S. company — meaning Bluesky PBC, the company behind the Bluesky social app. He also said that it was “interesting” that this was the only time someone from Bluesky had said anything to him about “working together” — i.e. to fight such legislation — since Bluesky’s launch nearly two years ago.

“Well, I believe you have my e-mail address,” Rochko wrote.

The truth, as is often the case, lies somewhere in the middle.

Unlike Mastodon, which connects thousands of decentralized servers over the ActivityPub protocol, Bluesky uses a different protocol (AT Protocol or AT Proto for short), which focuses more on account portability and decentralized moderation. Instead of allowing people to run their own servers to create a community, Bluesky lets people run their own versions of the bits and pieces that make up its social networking infrastructure, like the PDS (personal data server), relay, moderation lists, or algorithm.

That said, Bluesky is still the largest entity to operate a PDS, given that the network is still fairly new. That means the majority of Bluesky’s users are relying on its own infrastructure. However, a community called Blacksky recently spun up its own PDS, so things are progressing on that front. And there are others, as well as independently run relays and appviews, which are portions of Bluesky infrastructure.

In the meantime, these turf battles don’t do anything to help the users of Mississippi who have been locked out of their preferred social networks.

Working around the Mississippi block

Without using a VPN, some users in the state report they’ve been able to access Bluesky through third-party clients like Graysky, Skeets, Klearsky, TOKIMEKI, Flashes, or forked versions of the Bluesky app, like Deer.social or Zeppelin.

Rudy Fraser, Blacksky founder, confirmed to TechCrunch that his community doesn’t plan on blocking any users based on where they’re located, anywhere in the world.

There’s also a sideloaded version of Bluesky available, which was uploaded to the alternative app distribution platform AltStore. To sideload, first install AltStore on Mac or Windows with permissions and developer mode enabled. Then press the “+” button, type in “https://smanthasam.github.io/bskyms/alt.json” (without quotes), press the button next to “BlueskyMS,” and press add. This adds the source to your AltStore so you can browse to the sideloaded Bluesky app and install it.

For those in Mississippi in need of a read-only version of Bluesky, Anartia‘s search engine is available.

Still, these workarounds aren’t necessarily permanent solutions, as the makers of the apps and clients have to decide for themselves whether they want to risk becoming a popular alternative for users in Mississippi that could catch legislators’ attention. As it stands, the law broadly affects services that allow users to create profiles, post content, and interact with others on a social networking service — a broad definition.

If Bluesky client applications don’t run their own PDS to host user data, it may perhaps be considered to be only offering clients — and therefore should not be affected. But explaining the intricacies of how a PDS works to a judge might prove difficult, too.

Mississippi is not the only state looking to add an age assurance layer to the internet. Other laws are in various stages in Arizona, Wyoming, South Dakota, and Virginia. The latter is particularly challenging, as it includes a time limit for usage of social media sites.

In any event, the diaspora of social networking alternatives at least makes enforcement of this type of legislation a bit more difficult, compared with a traditionally centralized network like Facebook or Instagram. That’s a step in the right direction for decentralization, regardless of your network of choice.

But overly broad laws also advantage the larger centralized platforms, which easily have the resources to comply, while smaller services like Bluesky just have to opt out.