You are reviewing the annual file of an adult merchant in your portfolio. One box covers the DSA (Digital Services Act), the EU regulation on digital services. The merchant has written: "not applicable, fewer than 45 million users". The answer is reassuring. But since October 14, 2026, it is a bit shakier than it looks.
That day, the General Court of the European Union dismissed the action brought by Technius, the company that runs Stripchat. Technius was challenging a decision from December 2023. That decision classified Stripchat as a very large online platform (VLOP, more than 45 million users in the EU). Technius had reported about 31.8 million monthly active users in the EU. The European Commission had counted more than 62 million. The Court sided with the Commission.
You are a PSP, meaning the provider that lets the merchant accept card payments. Here is the short answer: the user number a merchant reports is an estimate it calculates itself. The Commission can replace it with its own. Above all, a platform under the threshold is not "outside the DSA". Most of the obligations that matter to you apply whatever the number. These are the terms of service, the reporting and removal of content, and explaining decisions to users.
What exactly happened with Stripchat?
The facts are useful, because they show how a number can tip over. In February 2023, Technius published about 31.8 million monthly active users. The figure came from Similarweb, an audience measurement tool. Technius had subtracted an estimate of "bounce visits", meaning visits where the user leaves right away. The Commission found that this subtraction counted the same thing twice. Similarweb's unique visitor measure already filters out a large share of those visits. So the Commission used more than 62 million. It designated the platform on December 20, 2023.
Later, Similarweb corrected its method. The figure for that period then dropped to about 37.3 million. For the Court, this correction does not make the decision unlawful. A decision is judged on the day it was taken, with the data available at that time. The Court added that the DSA gives enough guidance for each operator to choose a reliable counting method.
One point of context, to be precise. The Commission had already ended Stripchat's designation on May 27, 2025. The very large platform obligations stopped four months later. The ruling therefore concerns the past period. Technius can still appeal to the Court of Justice of the EU, an appeal limited to points of law. The deadline is two months and ten days.
Why should a PSP track this number?
Because the number changes three things for your merchant: the regulator, the level of requirements and the cost. Above 45 million, the European Commission supervises the platform. The platform must then assess its "systemic risks" every year. These are the serious risks its service can create for users and for society. It must also be audited by an independent body and publish more about its moderation. Finally, it pays a supervisory fee, capped at 0.05% of its worldwide net income. These obligations apply four months after the designation is notified.
This is not theoretical for the adult sector. To designate Pornhub, the Commission set aside the number Pornhub reported and used third-party data. In March 2026, the Commission sent preliminary findings to Pornhub, Stripchat, XNXX and XVideos. These are a first finding of possible breaches, here on minors' access to their services. So a disputed designation can be followed, a few months later, by a heavy procedure.
For you, this has three concrete consequences. First, the number signals your merchant's regulatory risk. Second, it is republished every six months. Third, the merchant can stay in disagreement with the Commission for years. That disagreement does not suspend its obligations.
Under the threshold, what still applies?
This is the part people forget most often. The DSA is built in tiers. The lower tiers apply to almost everyone.
| Obligation (DSA) | Who is covered | What you can ask for |
|---|---|---|
| Clear terms of service, including on moderation (Art. 14) | All online intermediary services | The current terms of service and their history |
| Reporting and removal of content (Art. 16) | All hosting services | The reporting form and actual handling times |
| Explaining decisions to the user (Art. 17) | All hosting services | Anonymized examples of explanations sent to creators |
| Internal complaints, suspension for misuse, recommendation transparency, protection of minors (Art. 20, 23, 27, 28) | Platforms, except micro and small enterprises | The appeal procedure, the suspension rule, the page that explains recommendations |
| Publishing the user number every six months (Art. 24(2)) | Platforms, except micro and small enterprises (which must still provide the number on request) | The latest publication and the counting method |
The exemption covers micro and small enterprises: fewer than 50 employees and under €10 million in turnover or balance sheet. It does not apply to a platform designated as a VLOP. And it offers no protection against card network rules such as those of Visa and Mastercard.
The investigation opened into Mym on October 16, 2026 shows this well. It was launched by Arcom, the French audiovisual and digital regulator. Mym is a French platform that is not designated as a VLOP. Arcom is questioning it in particular about terms of service it considers incomplete. It is also questioning it about the information given on its recommendation systems. At national level, fines can reach 6% of worldwide turnover. For inaccurate or incomplete information given to the regulator, the cap is 1%.
What we would do in your place
Ask for the number and the method, not just the number. Which source? Which adjustments? Does the merchant count logged-in accounts, visitors, or both? A merchant that subtracts "bounces" or "bots" must be able to explain why. The Stripchat case shows that this is exactly the kind of adjustment that was challenged.
Follow the trend. Archive each six-monthly publication. Take a merchant at 38 or 40 million that is growing fast. It deserves a conversation before it crosses the threshold, not after the notification.
Test the basic obligations yourself. Try the reporting form. Ask for three examples of removal decisions explained to the user. Read the page that explains recommendations. These are exactly the topics Arcom is questioning Mym about.
Do not confuse the DSA with card network rules. Since 2021, every adult merchant must meet Mastercard's requirements, whatever its size. It must verify the age and identity of those who upload content and of the people shown. It must have content reviewed before publication. It must handle complaints within seven business days. Visa sets comparable requirements through its VIRP (Visa Integrity Risk Program). The 45 million threshold changes nothing here.
Check who gets the money. A platform can have excellent terms of service and still pay a creator's earnings into a third party's account. Ask how the merchant links each creator's verified identity to their payout account. Also ask what happens when the identity and the account do not match.
Document your own decision. A regulator or a card network may question you. You must then show what you asked the merchant and what it answered. You must also explain why you kept the relationship. A dated page is often enough.
How Pleenk Approve can help
At its core, Pleenk Approve is a single digital identity. At your merchants, every creator, co-performer, agency or affiliate is verified with a liveness check. Their identity is encrypted by Pleenk and stored in a single wallet, a digital identity wallet: the platform receives proof, never the ID document. Everything is linked to this wallet: the person's accounts, their consents, the IBAN that receives their earnings and any bans. Moderation remains the platform's own: Pleenk connects to its AI moderation tool and keeps proof of the checks. Today, it is your merchant that sends you this proof when you ask for it. Pleenk does not calculate a platform's DSA user number, and does not do sanctions screening or anti-money laundering (AML) monitoring. Are you reviewing your adult portfolio or preparing an annual review? Write to us at contact@pleenk.com.
This article is for information only and does not constitute legal advice. Have your analysis reviewed by your legal counsel and your compliance teams.
Sources
- General Court of the European Union – Press release No 146/26, judgment T-134/24 Technius v Commission (October 14, 2026): https://curia.europa.eu/site/upload/docs/application/pdf/2026-10/cp260146en.pdf
- MTR Legal – General Court upholds Stripchat's earlier DSA status (October 2026): https://www.mtrlegal.com/en/general-court-upholds-stripchat-earlier-dsa-status/
- Digital Policy Alert – End of Stripchat's VLOP designation (May 27, 2025): https://digitalpolicyalert.org/event/36750-european-commission-terminated-very-large-online-platform-designation-of-stripchat-under-digital-services-act
- Biometric Update – Adult content sites maneuver to escape VLOP designation (November 2025): https://www.biometricupdate.com/202511/adult-content-sites-maneuver-to-escape-vlop-designation-under-eus-dsa
- European Commission – Preliminary findings against Pornhub, Stripchat, XNXX and XVideos (March 2026): https://ec.europa.eu/commission/presscorner/detail/en/ip_26_722
- Regulation (EU) 2022/2065 (DSA), in particular Art. 14, 16, 17, 19, 24, 33, 43 and 52: https://eur-lex.europa.eu/eli/reg/2022/2065/oj
- Arcom – Arcom opens an investigation into the French platform Mym (October 16, 2026, in French): https://www.arcom.fr/presse/larcom-ouvre-une-enquete-sur-la-plateforme-francaise-mym
- Mastercard – Protecting our network, protecting you: preventing illegal adult content (April 2021): https://www.mastercard.com/news/perspectives/2021/protecting-our-network-protecting-you-preventing-illegal-adult-content-on-our-network/