EU's Digital Services Act: A New Era of Accountability for Major Online Platforms, Including Adult Sites

In a significant move underscoring the European Union's commitment to regulating the digital space, three of the world's most prominent adult content platforms — Pornhub, XVideos, and Stripchat — have been officially designated as "Very Large Online Platforms" (VLOPs) under the bloc's sweeping Digital Services Act (DSA). This classification, announced by the European Commission, subjects these sites to the most stringent set of obligations within the DSA framework, requiring them to implement substantial changes to their operations by February 2024.

The designation as a VLOP is not merely a label; it carries with it a heavy burden of responsibility aimed at mitigating systemic risks associated with large-scale online services. For platforms like Pornhub, XVideos, and Stripchat, this means facing heightened scrutiny and being held accountable for the content shared on their sites, particularly concerning illegal material and access by minors. The core requirements stemming from this designation revolve around robust age verification, proactive measures against illegal content, comprehensive risk assessments, and increased transparency.

The European Commission's press release confirming the designation cited that the three platforms "fulfil the threshold of 45 million average monthly users in the EU." This user count is the key determinant for a platform to be classified as 'very large' under the DSA, triggering the enhanced regulatory obligations. While XVideos publicly stated it had 160 million average monthly recipients in the EU, Pornhub's self-reported figure of 33 million users was notably lower than the threshold. The EU's decision to include Pornhub on the VLOP list indicates that the Commission's own assessment of its user base surpassed the 45 million mark, effectively challenging the company's reported numbers.

This discrepancy in user reporting was a point of contention leading up to the designation. A coalition of 30 NGOs, including European Digital Rights, the Center of Democracy and Technology, and the European Sex Workers' Rights Alliance, had previously urged the European Commission to designate major pornography sites as VLOPs. They argued that some platforms were presenting "surprisingly small numbers" to evade the stricter DSA requirements, suggesting these figures were a misrepresentation aimed at avoiding accountability for systemic risks present on their platforms.

Digital civil rights group Access Now specifically questioned Pornhub's 33 million user figure for Europe, finding it "unlikely" when compared to traffic analysis from services like SimilarWeb, which indicated the site receives billions of visits globally each month. The EU's decision validates these concerns and reinforces the Commission's authority to make its own determination on user thresholds based on available data and analysis.

Understanding the Digital Services Act (DSA) and VLOP Obligations

The Digital Services Act is a cornerstone of the EU's digital strategy, designed to create a safer digital space where fundamental rights are protected. It establishes a clear set of rules for online intermediaries and platforms, with obligations scaled according to their size and impact. VLOPs and Very Large Online Search Engines (VLOSEs) — those reaching 45 million active users or more in the EU — face the most extensive responsibilities due to their potential to influence public opinion, disseminate illegal content, and cause societal harm.

The initial list of VLOPs and VLOSEs, announced in April 2023, included major global tech giants like Amazon, Apple's App Store, Facebook, Instagram, X (formerly Twitter), YouTube, and Google Search. The inclusion of adult content platforms in this latest wave of designations signals the EU's broad interpretation of the DSA's scope and its determination to apply the rules consistently across different types of large online services.

For Pornhub, XVideos, and Stripchat, the VLOP designation triggers a range of specific obligations:

• **Risk Assessments:** They must conduct thorough annual risk assessments to identify and analyze systemic risks stemming from their services. These risks include the dissemination of illegal content (like CSAM and non-consensual deepfakes), negative effects on mental health, gender-based violence, and potential negative impacts on minors.
• **Risk Mitigation Measures:** Based on the risk assessments, platforms must implement effective measures to mitigate these identified risks. This includes adjusting content moderation systems, improving age verification technologies, modifying recommendation algorithms, and enhancing user reporting mechanisms.
• **Age Verification:** A critical requirement for these platforms is the implementation of robust age verification systems to prevent minors from accessing adult content. The DSA does not prescribe a specific technology, but requires measures that are effective and respect user privacy. This is a particularly challenging area, fraught with technical hurdles and privacy concerns.
• **Illegal Content Removal:** Platforms must establish clear and effective notice-and-action mechanisms allowing users and trusted flaggers to report illegal content. They are then obligated to act swiftly on valid notices and cooperate with law enforcement and judicial authorities.
• **Transparency:** VLOPs must publish regular, detailed transparency reports on their content moderation decisions, including the number of pieces of content removed, the reasons for removal, and the number of complaints received. They are also subject to independent external audits to verify their compliance with the DSA.
• **Data Access for Researchers:** VLOPs must provide access to their data to vetted researchers to enable scrutiny of systemic risks and the effectiveness of mitigation measures.
• **Compliance Officer:** They must appoint a compliance officer responsible for monitoring the platform's adherence to the DSA.
• **Crisis Response:** VLOPs may be required to take specific measures during crisis situations, such as public health emergencies or security threats, to prevent the spread of harmful content.

These obligations go significantly beyond the general rules that apply to all online platforms under the DSA, such as providing a mechanism for users to notify them of illegal content and avoiding targeted advertising based on sensitive data like ethnic origin or sexual orientation.

The Thorny Issue of Age Verification

The requirement for robust age verification is perhaps the most immediate and technically complex challenge for these newly designated VLOPs. While the need to protect minors from accessing adult content is widely accepted, implementing effective and privacy-preserving age verification online has proven difficult globally.

Various methods exist, each with its own set of challenges:

• **Self-Declaration:** Simply asking users to tick a box confirming they are over 18 is easily bypassed and ineffective.
• **Credit Card Verification:** While indicating financial independence, it doesn't strictly prove age and raises significant privacy concerns.
• **ID Document Upload:** Requires users to upload sensitive personal documents, posing major data security and privacy risks. Platforms would need robust systems to handle and store such data securely, and users may be reluctant to share it.
• **Third-Party Age Verification Services:** Users might be directed to external services that verify age using various methods (e.g., checking against databases, facial recognition). This offloads some burden from the platform but introduces reliance on third parties and still requires users to share potentially sensitive information.
• **Facial Recognition/Estimation:** Technologies that analyze facial features to estimate age raise significant privacy concerns and can be inaccurate, particularly for younger individuals.
• **Government Digital ID Systems:** Some countries are developing digital identity systems that could potentially be used for age verification, but these are not universally available and raise questions about government surveillance and control over online access.

The DSA requires effectiveness and privacy. This means platforms must choose methods that genuinely prevent minors' access while minimizing the collection and retention of personal data. The technical implementation needs to be secure against circumvention, and platforms must be transparent about how they verify age and handle user data.

The designation of these adult sites as VLOPs puts the spotlight squarely on their chosen age verification methods. They will need to demonstrate to the European Commission that their systems are not only implemented but are also effective in practice and compliant with the DSA's privacy requirements, including those under the General Data Protection Regulation (GDPR).

Image by TechCrunch (Illustrative)

Combating Illegal Content: CSAM and Deepfakes

Beyond age verification, the DSA places significant responsibility on VLOPs to combat illegal content. For adult platforms, this primarily concerns Child Sexual Abuse Material (CSAM) and non-consensual intimate imagery, including deepfake pornography. The scale of these platforms means they can be vectors for the rapid spread of such harmful content.

The DSA requires platforms to implement measures to detect, identify, and remove illegal content. This involves a combination of user reporting mechanisms and, for VLOPs, potentially proactive measures using automated tools or human review. They must also cooperate with law enforcement when illegal content is identified.

The rise of deepfake technology has added another layer of complexity. Non-consensual deepfakes, which digitally superimpose a person's face onto explicit content without their consent, are illegal in many jurisdictions and can cause immense harm to victims. VLOPs are expected to have systems in place to address this specific type of illegal content, likely involving mechanisms for victims to report such content and processes for swift removal.

The DSA's emphasis on risk assessments means these platforms must analyze how their design, features, and algorithms might inadvertently facilitate the spread of illegal content and then implement mitigation strategies. This could involve changes to how content is uploaded, moderated, recommended, or searched for on the site.

Transparency and Accountability

A key pillar of the DSA is increased transparency from large online platforms. The designation as VLOPs means Pornhub, XVideos, and Stripchat will no longer be able to operate with the same level of opacity regarding their content moderation practices and user numbers.

They will be required to:

• Publish detailed, machine-readable transparency reports at least annually, outlining their content moderation activities, including the volume of content removed, disabled, or restricted, the reasons for these actions, and information about complaints and redress mechanisms.
• Undergo independent external audits of their DSA compliance, including their risk management systems and moderation processes. The results of these audits must be made public.
• Provide data access to vetted researchers to study systemic risks and platform behavior.

This push for transparency is intended to allow regulators, researchers, and the public to better understand how these powerful platforms operate, how they make decisions about content, and whether they are effectively mitigating the risks they pose. The controversy over user numbers highlights the need for independent verification and public reporting.

Broader Regulatory Context and Global Trends

The EU's designation of these adult platforms occurs within a broader global trend towards increased regulation of online content and platforms. Governments worldwide are grappling with how to balance online safety, particularly for children, with freedom of expression and privacy rights.

As noted in the original report, several US states have attempted to mandate age verification for adult sites, with varying degrees of success and legal challenges. The UK recently passed its Online Safety Act, which also includes provisions for age verification for access to pornography, among other online harms. Countries like France and Germany have also pursued national-level regulations concerning online content and age restrictions.

The DSA is arguably the most comprehensive attempt globally to regulate large online platforms at a regional level. Its extraterritorial reach means that any platform serving a significant number of users in the EU, regardless of where the company is based, must comply with its rules. This creates a complex compliance landscape for global companies operating online.

The EU's proactive enforcement stance since the DSA came into effect for the initial batch of VLOPs in August is evident. The Commission has already sent formal requests for information to platforms like Meta and TikTok regarding their handling of illegal content and disinformation, particularly in the context of major events like the Israel-Hamas war. More significantly, the EU has opened formal proceedings into X (formerly Twitter) to investigate potential breaches of the DSA related to illegal content, disinformation, and transparency.

These enforcement actions demonstrate that the European Commission is serious about using the DSA to hold large platforms accountable. The designation of Pornhub, XVideos, and Stripchat signals that the adult entertainment industry is not exempt from this regulatory push.

Platform Pushback and Future Challenges

It is not uncommon for companies designated as VLOPs to challenge the decision. Amazon, for instance, has initiated legal proceedings against its designation, arguing that its retail business model does not fit the description of a VLOP in the same way as social media platforms or search engines. German online retailer Zalando has also challenged its inclusion on the list.

It remains to be seen whether Pornhub, XVideos, or Stripchat will mount similar legal challenges to their VLOP status. Such challenges could argue against the user count determination or contest the applicability of certain DSA provisions to their specific type of service. However, given the nature of the content they host and the specific risks associated with it, challenging the core rationale behind their designation — protecting minors and combating illegal content — might be difficult.

Beyond potential legal battles, the practical challenges of compliance are significant. Implementing effective, privacy-compliant age verification at scale is technically demanding and potentially costly. Enhancing content moderation systems to deal with vast amounts of user-uploaded content, including sophisticated deepfakes, requires substantial investment in technology and human resources.

Platforms will also need to navigate the complexities of cooperating with authorities across multiple EU member states and providing data access to researchers while respecting user privacy and confidentiality.

The DSA represents a paradigm shift in how large online platforms are regulated, moving towards a model of proactive risk management and increased accountability. The inclusion of major adult content sites under the VLOP regime highlights the EU's determination to apply these principles broadly and tackle systemic risks wherever they arise online.

The coming months leading up to the February 2024 deadline will be critical as these platforms work to implement the necessary changes. Their compliance efforts, and the EU's subsequent monitoring and enforcement, will set important precedents for the application of the DSA to diverse online services and contribute to the ongoing global debate about how best to regulate the digital world to ensure safety, transparency, and accountability.

The designation of Pornhub, XVideos, and Stripchat is a clear signal that no online service with a significant reach in the EU is beyond the scope of the Digital Services Act's most stringent rules. It marks a new chapter in the regulation of online content, placing the onus firmly on the largest platforms to ensure a safer environment for users, particularly the most vulnerable.

The success of this regulatory effort will depend on the platforms' commitment to genuine compliance and the EU's capacity for effective oversight and enforcement. The challenges are substantial, but the objective — a safer, more transparent digital space — is a critical goal for the European Union and its citizens.

As the February 2024 deadline approaches, the world will be watching to see how these major adult platforms adapt to the demanding requirements of the DSA and what impact these regulations will have on the landscape of online content and digital safety in Europe and potentially beyond.

Image by TechCrunch (Illustrative)

The Role of NGOs and Civil Society

The push for the designation of these adult platforms as VLOPs was significantly driven by civil society organizations. Their advocacy highlights the crucial role that NGOs and researchers play in identifying systemic risks on online platforms and holding powerful tech companies accountable. By collecting data, conducting analysis (like comparing self-reported user numbers with traffic estimates), and engaging with regulators, these groups provide valuable input that complements the Commission's own monitoring efforts.

The DSA explicitly recognizes the importance of civil society by granting vetted researchers access to VLOP data and encouraging platforms to cooperate with trusted flaggers — entities with particular expertise in identifying illegal content. This collaborative approach between regulators, platforms, and civil society is intended to create a more effective system for managing online risks.

The concerns raised by NGOs about the potential for illegal content, particularly CSAM and non-consensual imagery, to proliferate on large adult platforms were central to their call for VLOP designation. They argued that the sheer scale of these sites necessitates the higher level of responsibility and scrutiny mandated by the DSA for VLOPs. The Commission's decision validates these concerns and underscores the impact of sustained advocacy from civil society.

Economic and Operational Impacts

Complying with the DSA's VLOP obligations will undoubtedly impose significant economic and operational costs on Pornhub, XVideos, and Stripchat. Developing and implementing robust age verification systems, scaling up content moderation teams and technologies, conducting annual risk assessments and audits, and establishing transparency reporting mechanisms require substantial investment.

Platforms may need to hire more staff with expertise in legal compliance, content moderation, data analysis, and security. They may also need to invest heavily in new technologies, such as AI tools for content detection or secure systems for handling sensitive age verification data.

The requirement to swiftly remove illegal content and potentially modify algorithms to mitigate risks could also impact the user experience and the platforms' business models, which often rely on user-generated content and recommendation systems. Balancing the need for safety and compliance with maintaining a user-friendly and commercially viable service will be a key challenge.

Furthermore, the increased transparency requirements could expose operational details or moderation practices that were previously kept private, potentially leading to public scrutiny or criticism. The external audits will provide an independent assessment of their compliance efforts, adding another layer of accountability.

While the costs of compliance are high, the penalties for non-compliance under the DSA are even steeper. The European Commission can impose fines of up to 6% of a company's global annual revenue for breaches of the Act. For platforms with billions in revenue, this represents a significant financial risk, providing a strong incentive for genuine compliance.

The Path Forward

As the February 2024 deadline approaches, Pornhub, XVideos, and Stripchat are on a tight schedule to bring their operations into compliance with the DSA's VLOP requirements. This will involve a complex process of legal interpretation, technical implementation, policy development, and organizational change.

Key steps for the platforms will likely include:

1. **Legal and Technical Assessment:** A detailed review of the DSA's specific requirements and an assessment of their current systems and practices against these rules.
2. **Developing Compliance Strategies:** Designing and implementing new technical solutions for age verification and content moderation, updating terms of service and content policies, and establishing internal processes for risk assessment, reporting, and data access.
3. **Resource Allocation:** Allocating significant financial and human resources to build and maintain the necessary compliance infrastructure.
4. **Engagement with the Commission:** Potentially engaging with the European Commission to seek clarity on specific requirements or demonstrate their compliance efforts.
5. **Transparency Reporting and Audits:** Preparing for the first transparency reports and external audits, which will scrutinize their initial compliance efforts.

The EU's decision to designate these platforms marks a pivotal moment in the regulation of online adult content. It signifies that the DSA is a powerful tool that the Commission intends to use to address systemic risks across the digital landscape, regardless of the specific nature of the online service.

The outcome of this regulatory action will have implications not only for the adult entertainment industry but also for the broader application and enforcement of the DSA. It will test the effectiveness of the Act's provisions in tackling complex issues like age verification and illegal content on platforms with unique operational challenges and business models.

The narrative of digital regulation is one of constant evolution, adapting to new technologies and online behaviors. The DSA is the EU's latest and most ambitious response to the challenges posed by large online platforms. By bringing major adult content sites under its strictest regime, the EU is sending a clear message that accountability and safety are paramount in the digital age.

The story of the DSA's impact on Pornhub, XVideos, and Stripchat is just beginning. Their journey towards compliance, the EU's oversight, and the potential for legal challenges will unfold over the coming months and years, shaping the future of online content regulation in Europe and serving as a case study for regulators worldwide.

The designation is a necessary step towards ensuring that platforms with significant reach take responsibility for the content they host and the potential harm they can cause. It reinforces the principle that online spaces should not be ungoverned territories, but rather environments where fundamental rights and safety are protected through clear rules and robust enforcement.

Ultimately, the success of this regulatory intervention will be measured by its ability to effectively reduce the accessibility of adult content to minors and minimize the spread of illegal and harmful material, while also respecting privacy and fostering a vibrant online ecosystem. It's a delicate balance, but one that the DSA aims to strike through its comprehensive framework.

Image by Wired (Illustrative)

Conclusion: A Precedent Set

The European Union's decision to classify Pornhub, XVideos, and Stripchat as Very Large Online Platforms under the Digital Services Act is a landmark moment. It extends the reach of the DSA's most demanding obligations to a sector that has often operated with less regulatory oversight than mainstream social media or e-commerce platforms. This move is a direct response to concerns raised by civil society about the potential for harm on these sites, particularly concerning minors and illegal content.

By requiring robust age verification, enhanced content moderation, and greater transparency, the EU is placing significant responsibility on these platforms to mitigate systemic risks. The challenges of implementing these measures are considerable, involving complex technical, operational, and privacy considerations. However, the potential penalties for non-compliance provide a strong incentive for the platforms to invest in the necessary changes.

This designation also highlights the ongoing global effort to regulate online content and protect users, with different jurisdictions exploring various approaches to age verification and platform accountability. The EU's comprehensive DSA framework serves as a significant model in this global conversation.

The coming months will reveal how effectively these platforms can adapt to the new regulatory landscape and how the European Commission will oversee their compliance. This case will be a crucial test for the DSA's ability to enforce its rules across a diverse range of online services and ensure a safer digital environment for all European users.

The message is clear: size matters under the DSA, and with great size comes great responsibility, regardless of the type of content a platform hosts.