Age and consent verification for adult content businesses: what payment partners expect

Why verification decides the outcome

Every party in the payment chain for an adult business carries some exposure to what that business publishes. A card acquirer, a bank, a payouts provider and a hosting company each want assurance that nobody under the age of majority appears in the content, that everyone who does appear is who they claim to be, and that each of them agreed to take part and to have the material published.

Verification is the evidence for that assurance. A business that can show, for any item in its catalogue, who appears in it, how their age and identity were checked and where their consent is recorded, gives its partners something concrete to rely on. A business that cannot is asking them to take its word, which no regulated provider can do.

For that reason, the verification process tends to be the first thing a specialist reviewer examines and the last thing they sign off. A weakness here usually cannot be offset by strengths elsewhere in the application.

Who needs to be verified

The short answer is everyone who appears in content, and everyone who is paid for creating it. In practice, the categories differ by business model.

• Studios and producers verify every performer before a shoot, including those who appear briefly or in non-sexual roles within adult content.
• Creator platforms verify each account holder before they can publish or receive money, and also verify any other person who appears in that creator's uploads.
• Licensors and distributors obtain verification evidence from the original producer for each title they acquire, and keep it or keep reliable access to it.
• Agencies and managers who receive payouts on behalf of creators need to be identified, and the creators they represent still need individual verification.

The co-performer category causes the most problems. A creator may verify themselves properly and then upload material featuring another person who has never been through any check. Platforms that allow this without requiring the second person to be verified and to record consent are exposed to exactly the kind of content that payment partners will not tolerate.

Common verification approaches

There is no single method that every business must use, and the right combination depends on scale, geography and risk. Most well run businesses use several layers.

• Government identity document checks. The participant provides a passport, national identity card or driving licence. Automated tools check security features, data consistency and signs of tampering.
• Liveness and face matching. The participant takes a live selfie or short video, which is compared with the document photo. This helps prevent someone using another person's documents.
• Database or registry checks. In some countries, identity data can be checked against official or credit reference sources.
• In-person checks. Studios often inspect original documents on set, photograph the performer holding them and keep those images with the shoot records.
• Manual review. Trained staff examine cases that automated tools flag, such as poor image quality, unusual documents or a mismatch between the face and the document.

Age estimation tools that guess age from a face without checking a document can be useful as an extra layer, but they do not confirm identity and should not be the only check for anyone who appears in content.

Recording consent properly

Age and identity confirm who a person is. Consent records confirm what they agreed to. The two are separate, and a business needs both.

Good consent records are specific. A general statement signed at account creation is weaker than a record tied to a particular shoot or upload that sets out what was filmed, how it may be used and where it may be distributed. For studios, this usually means a signed release for each production, with the date, the location, the other participants and the intended uses. For creator platforms, it often means a consent confirmation captured at upload, with the identities of everyone appearing linked to that upload.

Consent should also be revocable in a way the business can act on. A clear route for a participant to raise a concern, and a process for reviewing and if necessary removing content, shows partners that consent is treated as continuing rather than a box ticked once. Our guide to content moderation and payments explains how takedown processes fit in.

Keep consent records in a form that can be produced quickly. A partner investigating a complaint may ask for evidence within days.

Using third-party verification providers

Most platforms and many studios use specialist verification vendors rather than building their own tools. This is sensible, because vendors invest in document libraries, fraud detection and liveness technology that few individual businesses could match.

Outsourcing the check does not outsource the responsibility. The business remains accountable to its partners and to the law for who appears in its content. When choosing and managing a vendor, consider the following:

• Which document types and countries the vendor supports, and how it handles documents outside that list.
• What the vendor returns to you: a simple pass or fail, or the underlying images, data and decision reasons.
• Where and for how long the vendor stores data, and whether you can retrieve it if you change vendor.
• How the vendor handles cases that need manual review, and whether those reviewers are trained for this sector.
• Whether you can audit the vendor or obtain independent assurance reports.

Retrieval is the point most often overlooked. If the vendor only gives you a pass result and keeps the evidence, you may struggle to produce it years later after the contract has ended. Agree access and export rights at the start.

What records to keep

Verification is only as good as the record that proves it happened. A useful test is whether someone outside the business could reconstruct, from your records alone, how a particular participant was verified for a particular item of content.

That usually requires the following for each participant: legal name and any stage or account names, date of birth, copies or images of the identity document, the result of any liveness or face match, the date and method of verification, the name or system that approved it, and links to every item of content in which they appear. For each item of content, it requires a list of everyone who appears and a link to the relevant consent record.

Records must also be protected. Identity documents are sensitive personal data, so access should be limited, logged and encrypted. Data protection laws in the countries where you operate will affect how long you may keep certain data and how you must secure it. For US-linked content, specific federal record keeping rules apply. Our article on record keeping for adult platforms covers those obligations in more detail.

When to re-verify

A single check at onboarding is a starting point. Circumstances change, documents expire and accounts change hands. Sensible triggers for re-verification include:

• An identity document on file has expired and the participant continues to produce content.
• Payout details change, especially if the new bank account is in a different name or country.
• The account shows signs of being used by someone else, such as a sharp change in login location, device or content style.
• A complaint or report suggests that a participant may be underage or may not have consented.
• The business changes verification vendor and the old evidence cannot be migrated in full.
• A long-dormant account becomes active again.

Some platforms also run periodic liveness checks at login or before payout, to confirm that the verified person is still the one operating the account. This is particularly useful where account sharing or account selling is a known risk.

What payment partners will ask to see

A payment partner reviewing an adult business will usually ask for the written verification policy, a description of the tools and vendors used, and a walk-through of the process from sign-up to first payout. They will often ask for a sample of records, chosen by them rather than by you, to test that the process works in practice.

They may also ask how many applicants fail verification, how manual reviews are handled and what happens when a participant cannot be verified. A business that rejects nobody is either very small or not checking properly, and a reviewer will want to know which.

Before releasing payouts, many payment partners require confirmation that each recipient has been verified, and some will ask to see the record for larger or unusual payments. Building a clean link between your verification system and your payout file makes this straightforward. Each payee in a payout batch should map to a verified participant, with no anonymous or unmatched recipients.

Common failures and how to avoid them

The same weaknesses appear repeatedly in reviews. Back catalogues acquired from other producers often arrive without complete records, and the buyer assumes the seller's assurances are enough. They are not, so obtain the records before you publish. Co-performers on creator platforms are added without their own verification. Records are held only by a vendor that the business no longer uses. Consent is captured once at sign-up and never tied to specific content. Staff with access to sensitive documents are not trained or monitored.

Each of these has a straightforward remedy, but the remedy takes time. A business planning to approach a new payment partner should audit its own records first, fix gaps and be ready to explain what it found and what it changed. That candour tends to be received far better than an apparently perfect file that falls apart under sampling.

General information only

This article gives general information about age, identity and consent verification. It is not legal advice, and specific requirements depend on where you produce content, where you offer it and who your partners are.

CCYFX only works with legal adult businesses that verify the age, identity and consent of everyone involved. You can read what we expect from applicants on our compliance page.