We can’t remove what we can’t read.

We can't remove what we can't read.

uOS receives, from time to time, reports from government hotlines (NCMEC, INHOPE member hotlines, AFA France, CSEA, and others) concerning content that users of uOS store. These reports generally contain perceptual hashes (PhotoDNA or equivalent) and a user_pub or account identifier.

We have to make a decision on these reports even though we cannot verify the content they reference — our servers only see ciphertexts we cannot decrypt.

Our policy

1. 01
   No action on bare reports.We take no removal, suspension, or alert action on the basis of an unverified CSAM report. The historical false-positive rate of CSAM hash databases in operational use is non-trivial: in Ireland's 2024 operational data, approximately 11% of reports turned out to be erroneous. Acting blind on this signal would mean persecuting innocent users.
2. 02
   Action only on judicial order.We act on a CSAM report only when it is backed by an order or decision from a judicial authority of an EU Member State (or a State bound by an equivalent standard under an international agreement), duly motivated, limited in scope and time, and subject to judicial review.
3. 03
   Systematic challenge of unverified reports.We systematically contest, before the relevant administrative or judicial authority, any report that: fails to provide identifying details sufficient to localize the content; originates from a hotline operating outside the INHOPE network or equivalent international standards; requests action disproportionate to the alleged violation; or relies on a technological process that uOS does not operate.
4. 04
   Public transparency.Every removal, suspension or other action taken on CSAM grounds is reported in our annual Transparency Report, with country of origin, type of authority, date, and scope of action.
5. 05
   No voluntary monitoring.uOS conducts no voluntary monitoring of user content, no proactive scanning, and no proactive CSAM detection on our servers.

What this means in practice

• —A hotline sending a hash without a judicial order receives an acknowledgement, no action, and a request to obtain a judicial order if it wishes action.
• —A judicial order triggers a narrowly-scoped removal of the cited content and/or suspension of the cited account, plus a published entry in our next Transparency Report.
• —An over-broad order (e.g. affecting the whole of uOS, an entire user base, or all content of a particular category) is contested before being executed in whole or in part.

Why this policy

The alternative — wholesale removal on the basis of unverified hashes — would make uOS an unaccountable enforcement arm of any sufficiently motivated government. An 11% false positive rate, applied across millions of users, would result in tens of thousands of unjustified suspensions annually. We will not operate that way.