The European Commission has accused four major pornography platforms of not doing enough to prevent minors from accessing their content, finding that Pornhub, Stripchat, XNXX and XVideos have breached the Digital Services Act in preliminary findings from a 10-month investigation.
At the heart of the Commission's complaint sits a fundamental flaw in how these platforms approach age control. The platforms rely on an ineffective "self-declaration" measure that only requires users to make a single click to state they are over 18. Content warnings, page blurring and "restricted to adults" labels do not effectively prevent minors from accessing harmful content, the Commission found. In other words, the technical barriers amount to little more than a checkbox that a child can bypass in seconds.
The deeper problem, though, runs beyond weak technology. The Commission determined the platforms did not use objective and thorough methodologies to fully assess the risks to minors accessing content on their platforms. More troubling still, Stripchat, Xvideos and XNXX either misrepresented or failed to take into account consultations with organizations that specialise in children's rights and age verification systems in their risk assessments. The platforms' risk assessments disproportionately emphasised business-centric concerns, such as reputational damage, rather than focusing on the societal risks to minors.
This finding reflects a troubling priority structure within these companies. When forced to choose between protecting children and protecting their brand reputation, they weighted the latter more heavily. The Commission's framing signals a clear message: child protection cannot be a secondary concern; it must be built into every stage of risk assessment.
The Commission has demanded that the platforms put privacy-preserving age verification systems in place. The platforms now have the chance to review the preliminary findings and respond, and can implement measures to remedy the alleged breaches. If the Commission confirms that the platforms failed to adhere to the Digital Services Act and issues a non-compliance decision, the porn providers could face fines of up to six percent of their global annual turnover.
The question of how to verify age without compromising privacy, however, remains technically contentious. The European Commission made a blueprint for an age verification solution available in July 2025 that allows users to prove they are over 18 without sharing any other personal information. The blueprint launched a pilot phase during which software will be tested and customised in collaboration with member states, online platforms and end-users, with Denmark, France, Greece, Italy and Spain taking up the technical solution first.
Yet privacy advocates point to genuine technical challenges. No technology available is entirely privacy-protective, fully accurate, and that guarantees complete coverage of the population. Every system of age verification or age estimation demands that users hand over sensitive and often immutable personal information that links their offline identity to their online activity, risking their safety and security. Some platforms have already signalled resistance. Pornhub, YouPorn and RedTube voluntarily geoblocked French users in June 2025, citing privacy concerns and ongoing legal appeals.
The Commission's enforcement here reflects a legitimate tension. Children clearly need protection from explicit material; that obligation is not in dispute. Yet requiring platforms to implement robust age verification creates real privacy trade-offs that neither regulators nor technologists have yet fully resolved. The coming months will test whether privacy-preserving methods can be effective in practice, or whether institutional pressure will force platforms toward more invasive solutions.