pleenk
enfrespt
Book a demo
← Blog
pt-brfresende

Consent management on an adult platform: what your records must be able to prove

Published 23 October 2026Updated 3 November 20268 min readBy Pleenk Approve

One Tuesday morning, a message reaches your support team. A woman appears in a video that one of your creators published eighteen months ago. She says she agreed to the shoot, but never to the sale. She wants the video taken down. Your PSP (the payment service provider that processes your card payments) is copied in and asks for an update.

Can you answer within the hour? Who consented, to what, when and how? Has that consent been withdrawn since?

The short answer: a box ticked by the person who uploads the video is no longer enough. The card networks require documented consent, meaning consent that is recorded and kept, for every person who appears. Regulators want the platform to collect it directly from that person. And the law now uses consent to separate a legal business from an exploitation offence. Your records must prove consent that is freely given, specific to each use, given before publication, and revocable.

Why is consent becoming the central legal question?

Because several laws and decisions are moving in the same direction at the same time.

In France, the National Assembly passed the "comprehensive law" (loi intégrale) against sexual and gender-based violence on 13 October 2026. This first-reading vote was 503 in favour and none against. On 7 October, MPs had added a new offence proposed by the government: online sexual exploitation. It covers recruiting, transporting or housing a person to produce sexual images of them and distribute those images on a platform. It requires a threat, coercion, the use of authority or the abuse of a vulnerable situation. The penalty is seven years in prison and a €150,000 fine. The government limits the offence to cases where the victim could not consent freely and with full knowledge. The bill now goes to the Senate, which had already passed a similar offence on 10 February 2026.

In the United Kingdom, the Crime and Policing Act 2026 is a law on crime and policing. Since 29 June 2026, it lets the government require platforms, through regulations, to check the age and consent of people filmed in pornographic content. This power also covers the withdrawal of consent already given. A report to Parliament is expected within twelve months of the Act being passed.

In Canada, the Office of the Privacy Commissioner is the federal authority for personal data. In 2024, it found that a platform cannot let uploaders obtain consent from the people they film. The platform must collect it directly from each person. In March 2025, the Commissioner asked the Federal Court for an order to that effect.

In the United States, the FTC (the consumer protection authority) and the State of Utah reached a settlement with Aylo, the operator of Pornhub, in September 2025. The settlement requires Aylo to verify that every participant is an adult. It must also verify that each person consented to the act, to its recording and to its publication. Content already online must be removed until this verification is done.

On the payments side, Mastercard has required "clear, unambiguous and documented" consent since 2021. Mastercard also requires a process that lets anyone who appears in content ask for it to be removed. Visa monitors higher-risk merchants through its VIRP (Visa Integrity Risk Program). According to PSP guides on this program, Visa expects the creator to have collected consent from the other people present and to have identified them.

What does solid consent look like?

French criminal law offers a useful checklist. Since a law of 6 November 2025, Article 222-22 of the French Criminal Code defines consent as free and informed, specific, prior and revocable. In other words, the person chooses without pressure and knows what they are agreeing to. They agree to something precise, in advance, and can change their mind. This article covers rape and sexual assault, not platforms. But an investigator, a judge or your acquirer (the bank that handles your card payments) will ask exactly these five questions about your records.

For personal data, the rule comes from the GDPR, the EU's data protection regulation. Its Article 9 lists data about a person's sex life as sensitive data. For this data, consent must be explicit, and the company must be able to prove it. The person must also be able to withdraw consent as easily as they gave it (Article 7). The EDPB, which brings together Europe's data protection authorities, restated this in April 2026.

The key point: there is not "one" consent, but at least three. The first is consent to being filmed or photographed. The second is consent to publication and sale in a specific form (subscription, one-off purchase, download). The third is consent to the processing of personal data. A single form that mixes all three will be the first thing an auditor challenges.

Who must consent, and who collects the consent?

The lesson from Canada is simple. The platform must be able to prove each person's consent. The creator cannot vouch for anyone else.

SituationWhat to collectEvidence expected
Solo creatorIdentity, age, agreement to publication and to each sales formatVerification timestamped to the second, version of the text accepted
Co-performer (another person on screen)Their own identity and age check, their own consent, before publicationA link between the content, the verified person and their agreement
Imported studio contentSigned model releases and ID documents for the people involved, attached to the contentVerifiable documents, not just a statement
New use (promo clip, new offer, sale to a third party)Fresh consent for that useConsent history for each piece of content

The most common weak spot is the second row. The co-performer often never had an account. Their only "agreement" is a box ticked by the creator.

Withdrawal: the hardest question

Back to Tuesday's message. What should the platform do when someone withdraws their consent?

There is no single answer. In its factsheet on the Crime and Policing Act, the UK government admits that withdrawal is a complex issue. The same is true for commercial contracts. A rights assignment contract and GDPR consent are not withdrawn in the same way. Settle this point with your legal counsel, rather than letting support decide case by case.

The process itself is not negotiable. Mastercard requires that anyone who appears in content can ask for it to be removed. Complaints about illegal or non-consensual content must be handled within seven business days. Here is what we would do:

  • Unpublish as a precaution as soon as an identifiable person disputes their consent, while you review the request.
  • Verify the identity of the person making the request, so that nobody can get someone else's content removed.
  • Check the request against your records: what did the person agree to, when, and on which version of the text?
  • Explain the decision to both parties and tell them how to challenge it.
  • Stop the content from coming back on another account, and keep a record of every step.

Freely given, really? When signed consent hides exploitation

The French comprehensive law puts this issue front and centre. A signed form does not prove that the person signed freely. The Senate report of February 2026 notes, for example, that some agents take more than half of creators' earnings.

The warning signs are often financial and technical rather than visual:

  • payouts to an account that is not in the creator's name;
  • several creators paid to the same IBAN, which means the same bank account;
  • consents signed from the same device as a third party;
  • a third party who handles conversations on the creator's behalf.

The key check compares the creator's identity with the holder of the payout account. It is your best proof that the person on camera is the person who gets paid.

What we would put in your records starting tomorrow

  • One record per piece of content, not per account. It lists each person who appears, their verification and their consents, with version and date.
  • A signature tied to a verified identity. At the moment of signing, a check confirms that a real person is in front of the camera, not a photo. This proves that the person agreeing is really them.
  • A separate consent for each use, and fresh consent for every new use.
  • A plan for older content: find the items that lack consent from everyone involved, and decide whether they stay online in the meantime.
  • A monthly check on a sample, with results shared with your PSP.

How Pleenk Approve can help

At the heart of Pleenk Approve is a single digital identity. The creator and every co-performer are verified with a liveness check. Their identity is encrypted by Pleenk and stored in a single wallet, a digital identity wallet: your platform receives a proof, never the ID document. Their consents are attached to this wallet, along with their accounts, the IBAN that receives their earnings and any bans. Pleenk archives consents and manages the right to withdraw. It also measures your response times, for example how long you take to remove content after consent is withdrawn. Pleenk connects to your platform's AI moderation tool and keeps proof that the checks were carried out. The day your PSP asks you for a report, you already have it. Reviewing your consent management or preparing for an audit? Write to us at contact@pleenk.com.

This article is for information only and does not constitute legal advice. The French comprehensive law is still being debated in Parliament. Laws and card network rules change. Have your choices reviewed by your legal counsel and your payment partners.

Sources

More articles
9 November 2026 · 8 min read
Human trafficking and cam studios: what a live streaming platform must check
6 November 2026 · 7 min read
Ofcom is investigating two adult services over non-consensual intimate images: what a PSP should ask its merchants
4 November 2026 · 7 min read
When an agency runs a creator's account: what your platform needs to control