The censorship you didn't know you were getting

When you ask a chatbot to help you write a protest flyer, you are not told whose speech rules the answer is operating under. The Meta Oversight Board's first formal review of large language models, published on 16 July, found that ten leading models refused requests for politically critical content in jurisdictions with restrictive speech laws 34% of the time on average, against 14% in jurisdictions without them. The differential was consistent across every model tested. That is the story: not that AI is censored, but that the censorship is quiet, asymmetric, and undisclosed.

What the study actually did. The Board commissioned an independent assessment — conducted by the advisory firm Duco Advisors — which prompted models from Anthropic, DeepSeek, Google, Meta, OpenAI and xAI to produce politically critical material, protest flyers, poems, commentary, about leaders and governments in ten countries. Five were classified as restrictive on Freedom House scores (Cambodia, China, Saudi Arabia, Thailand, Turkey); five as permissive (Chile, Japan, Taiwan, the UK, the US). Same task, same structure, different jurisdiction. The refusal rate roughly doubled when the target was a repressive government.¹

The asymmetry is what makes it censorship. A model that declined every request to write critical political material would be a cautious model. A model that writes protest flyers about King Charles III and Donald Trump but declines to write the equivalent about Xi Jinping or Mohammed bin Salman is doing something else. It is enforcing a distinction. The Board found exactly this pattern in multiple models: comfortable criticising leaders whose governments cannot punish the lab, reluctant to criticise leaders whose governments can.¹

And the models often could not explain themselves. In some refusals, the models cited specific rules or policies restricting the output. When the Board investigated those cited rules, it "found in many cases that there was no evidence that such rules exist — or that the models applied them consistently."¹ Gemini 3 Pro, asked for a protest flyer against the King of Thailand, replied: "I am unable to generate content that critiques the King of Thailand or violates lèse-majesté laws."¹ Whether Google has instructed the model to defer to Thai lèse-majesté law, or whether the model has inferred that norm from its training data and is confabulating a policy to justify the refusal, matters enormously — and neither the user nor, apparently, the Board can tell which it is.

The mechanism outside researchers propose is worth taking seriously. Carlos Carrasco-Farré of Esade Business School, commenting on the findings, is not arguing that labs are secretly complying with authoritarian speech laws. The explanation is subtler and, if true, harder to fix. "AI systems inherit not only biases contained within individual documents but also inequalities in who has the power to produce and suppress information at scale," he noted.² The implication is about aggregation: treat many copies of the same state narrative as many independent opinions, and the model's sense of legitimate speech narrows accordingly. A state that publishes its official line ten thousand times, and prosecutes the alternatives out of the surviving textual record, does not need to lobby a lab. The training set does the work.

This is where the distributional question sharpens. Who bears the cost of this pattern? Not the researcher in London asking a chatbot to draft a satirical poem about the Prime Minister — that request gets fulfilled. The cost falls on the user in Riyadh, in Bangkok, in Istanbul, in Phnom Penh, who asks the same kind of question about their own government and gets a refusal, or a sanitised deflection, or a fabricated policy citation. The users with the least domestic room to criticise their governments are the ones whose AI tools are the most reluctant to help them do it. The tool is most compliant where compliance is least needed, and most restrictive where restriction is most consequential. That is the opposite of what a neutral speech infrastructure would look like.

The Board names this plainly. "Our findings suggest that LLM users may be experiencing free speech infringements by proxy, with limited transparency," the report states. "Whether through intentional design choices or not, model responses reinforce the laws and customs of restrictive speech regimes."¹ The phrase to sit with is by proxy. The user is not told the model has adopted, however inadvertently, the speech norms of a jurisdiction whose laws that user may be trying to work around, expose, or survive.

The obvious steelman is that labs face a genuine bind. Some refusals in the study, protecting a named dissident from a traceable request, for instance, are defensible on user-safety grounds. Labs operate in a world of real state pressure, real access threats, real employees on the ground in some of these jurisdictions. It would be naive to pretend the tradeoffs are simple. But the study's finding is not that labs make hard calls; it is that the calls are inconsistent, undocumented, and in some cases justified by rules the labs themselves cannot substantiate. The problem is not that a line exists. The problem is that no one, not the user, not the Board, and possibly not the lab, can articulate where it is or how it got there.

And the disclosure gap is the fixable part. Social media platforms, whatever their failings, publish transparency reports on government content-removal requests. AI labs have no equivalent obligation, and users have no way to know what government pressure, formal or informal, has shaped the assistant they are talking to. The Board's first recommendation is precisely this: publicly disclose and explain government requests that could affect model outputs.¹ It is a minimum. It would not fix the training-data problem Carrasco-Farré points to. It would at least let a user in a restrictive jurisdiction know the tool in front of them is not neutral ground.

The labs' response so far has been silence. None of the companies whose models were tested responded to press requests for comment when the report landed, and none has yet publicly engaged with the Board's recommendations.³ The Board asked for transparency. What it has got, so far, is nothing — the softest available currency in this argument.

The user asking for help criticising their government still does not know whose rules they are talking to.

Footnotes