EU names three porn sites subject to its strictest online content rules

Age verification tech could be headed to adult content sites Pornhub, Stripchat and XVideos after the three were added to a list of platforms subject to the strictest level of regulation under the European Union’s Digital Services Act (DSA).

Back in April, the EU announced an initial list of 17 so called very large online platforms (VLOPs) and two very large online search engines (VLOSE) designated under the DSA. That first list did not include any adult content sites. The addition of the three platforms designated today changes that.

Per Wikipedia — which ironically enough was already named a VLOP in the first wave or Commission designations — XVideos and Pornhub are the number one and number two visited adult content sites in the world. While Stripchat is an adult webcam platform that livestreams nude performers.

Currently none of the three services require visitors to undergo a hard age check (i.e. age verification, not self declaration) prior to accessing content — but that could be set to change in the region as a result of the trio being designated VLOPs.

The pan-EU regulation puts a raft of extra obligations on designated (larger) platforms, which have more than 45 million monthly average users in the region, including obligations to protect minors, as the EU notes in a press release today — writing [emphasis ours]: “VLOPs must design their services, including their interfaces, recommender systems, and terms and conditions, to address and prevent risks to the well-being of children. Mitigating measures to protect the rights of the child, and prevent minors from accessing pornographic content online, including with age verification tools.”

The Commission, which is responsible for overseeing VLOPs’ compliance with the DSA, also reiterated today that creating a safer online environment for children is an enforcement priority.

Other DSA obligations on VLOPs include documenting and analysing any “specific systemic risks” their services may pose with regard to the dissemination of illegal content and content threatening fundamental rights — with an obligation to produce risk assessments reports which, initially, must be shared with the Commission and later have to be made public. 

They must also apply mitigation measures to address risks linked to the dissemination of illegal content online, such as child sexual abuse material (CSAM), and content affecting fundamental rights, such as the right to human dignity and private life in case of non-consensual sharing of intimate material online or deepfake pornography.

“These measures can include adapting their terms and conditions, interfaces, moderation processes, or algorithms, among others,” the Commission notes.

The three adult platforms designated as VLOPs have four months to bring their services into compliance with the additional DSA requirements — meaning they have until late April to make any necessary changes, such as rolling out age verification tech.

“The Commission services will carefully monitor the compliance with the DSA obligations by these platforms, especially concerning the measures to protect minors from harmful content and to address the dissemination of illegal content,” the EU said, adding: “The Commission services are ready to closely engage with the newly designated platforms to ensure these are properly addressed.”

The DSA also contains a set of general obligations which apply more broadly, including to smaller digital services but also to VLOPs — such as ensuring their systems are designed to ensure a high level of privacy, safety and child protection; and promptly informing law enforcement authorities if they become aware of any information giving rise to a suspicion that a criminal offence involving a threat to the life or safety of a person, including in the case of child sexual abuse — and the compliance deadline for those requirements kicks in a little earlier, on February 17, 2024.

While the DSA applies across the EU and EEA (European Economic Area) this is a region that, post Brexit, does not include the UK. However the UK government passed its own Online Safety Act (OSA) this fall, setting up telecoms regulator Ofcom as the country’s Internet content watchdog and introducing a regime of even tougher penalties for breaches than the EU has (OSA fines can reach up to 10% of global annual turnover vs up to 6% under the EU’s DSA).

The UK law also puts a strong emphasis on child protection. And recent Ofcom guidance for porn sites aimed at helping them comply with a new legal duty to ensure minors do not encounter adult material online states they must carry out “highly effective” age checks — further stipulating such checks cannot include age gates that merely ask users to self declare they are over 18.

Ofcom’s list of UK-approved age check tech includes provisions like asking porn site users to upload a copy of their passport to verify their age; show their face to their webcam to undergo an AI age assessment; or sign in to Open Banking to prove they’re not a minor, among other methods the regulator deems acceptable.