The European Commission has issued preliminary findings that Pornhub, Stripchat, XNXX and XVideos are breaking digital law by failing to stop minors from viewing pornographic material — and the platforms face fines that could run into hundreds of millions of euros
By Creatives Unite Newsroom
The European Commission delivered a legal blow to the world's four largest adult websites on Thursday, finding that Pornhub, Stripchat, XNXX and XVideos fail to protect minors from pornographic content .
The preliminary findings, issued under the Digital Services Act (DSA), came after a ten-month investigation and mark the most significant enforcement action yet against the pornography industry in Europe. They were announced on the same day Brussels opened a separate probe into Snapchat over suspicions that the messaging platform is also failing to protect children online.
At the heart of the Commission's case is the derisory simplicity of the age checks used by all four sites. Despite stating in their Terms of Services that their services are for adults only, all four platforms allow minors to access their platforms by a simple click confirming they are over 18. Regulators found that this "self-declaration" approach is wholly inadequate — and that the bolt-on measures the sites had added made little difference. Additional mitigation measures, such as page blurring, content warnings and "Restricted to Adults" labels, deployed by all of these platforms, do not effectively prevent minors from accessing harmful content.
Regulators say the four services did not employ objective and thorough methodologies to fully evaluate the impact of minors accessing their content. In particular, the Commission found that Stripchat, XNXX and XVideos either misrepresented or failed to properly reflect consultations with specialised organisations focusing on children's rights and age assurance tools. When risks were identified in these reports, the pornographic platforms focused on business concerns, such as reputational damage, instead of the dangers the sites might pose to young users.
Henna Virkkunen, the EU's Executive Vice-President for Tech Sovereignty, Security and Democracy, was unsparing. Online platforms, she said, "have a responsibility" to protect children, who are "accessing adult content at increasingly younger ages," and robust, privacy-conscious safeguards are necessary to keep minors away from such material.
These preliminary findings are part of the Commission's formal proceedings launched against XVideos, XNXX, Pornhub and Stripchat under the DSA on 27 May 2025. The inquiry drew on a substantial body of evidence: an in-depth investigation that included an analysis of the platforms' risk assessment reports, internal data and documents, as well as the platforms' replies to requests for information and interviews with experts in the field.
The four sites are designated as "very large online platforms" (VLOPs) under the DSA — a status that applies to platforms with more than 45 million monthly active users in the EU and that comes with the most stringent obligations in the regulation. All four are classified as VLOPs.
The Commission's own undercover testing showed that children could navigate past the sites' nominal barriers with no meaningful difficulty. Pop-up warnings, blurred preview images, and "Adults Only" banners were found to create only the appearance of restriction.
The announcement produced a pointed response from at least one of the sites. XVideos pushed back against the findings, saying: "The European Commission is asking us to commit suicide for nothing. Adding age checks on four sites out of a million does nothing to prevent minors from accessing adult content, as we know they will simply move to other, less safe sites that are completely out of reach of regulators." Pornhub, Stripchat and XNXX did not immediately respond to requests for comment.
The argument — that mandatory verification on the major sites merely redirects traffic to unregulated alternatives — is one the Commission has heard before and rejects. Its case is that VLOPs bear legal responsibility for their own compliance regardless of what happens elsewhere on the internet. In parallel, a coordinated action against non-compliant smaller pornographic platforms is also being carried out by national regulators in the member states.
The platforms now have the possibility to examine the documents in the Commission's investigation files and reply in writing to the Commission's preliminary findings. They can also take measures to remedy the breaches. If the preliminary conclusions are ultimately confirmed, the Commission may issue a non-compliance decision, which can trigger a fine proportionate to the infringement which shall in no case exceed 6% of the total worldwide annual turnover of the provider. The Commission can also impose periodic penalty payments to compel a platform to comply.
The Commission's enforcement toolkit is formidable. Primary fines under the DSA can reach 6% of a platform's total worldwide annual turnover for the previous financial year. In addition, daily penalty payments of up to 5% of average daily global turnover can be imposed to drive compliance with Commission orders. National courts can also order temporary service suspensions.
On 5 December 2025, the Commission issued a fine of €120 million to X (formerly Twitter) for breaching its transparency obligations under the Digital Services Act - the first non-compliance decision ever handed down under the DSA. The X penalty covered three violations: the deceptive design of its "blue checkmark," the lack of transparency of its advertising repository, and the failure to provide access to public data for researchers. X has since challenged the fine at the General Court of the European Union, arguing procedural violations and breach of its rights of defence.
The €120 million figure, while headline-grabbing as the DSA's first penalty, was well below the maximum fine of 6% that the DSA can impose based on X's total global turnover, suggesting that if fines are ultimately levied against the adult platforms, the amounts could be proportionally larger depending on each company's revenues.
The action against the porn sites is part of an accelerating pattern of DSA enforcement. The EU last month told Chinese-owned platform TikTok to change its "addictive design" or face heavy fines under the DSA. Facebook and Instagram are also under investigation, with Virkkunen signalling that preliminary findings in that case — focused significantly on age verification — would come "soon."
The timing is notable. The EU's actions come after a Los Angeles jury found Meta — the parent company of Facebook and Instagram — and YouTube liable for harming a young woman through the addictive design of their platforms, a verdict that handed plaintiffs in thousands of similar pending cases considerable leverage and drew an approving response from Virkkunen, who said it sent "a very clear message" to the industry. There are also expanding efforts, especially in Britain and France, to force porn sites to check users' age to prevent children from accessing online smut.
In Britain, mandatory age verification for commercial pornography sites came into force in January 2025 under the Online Safety Act, requiring platforms to implement robust checks and raising immediate questions about how European regulators would follow suit.
The Commission's preferred technical solution is the EU Age Verification Blueprint, an open-source application developed under a two-year contract with the T-Scy consortium — composed of Swedish firm Scytales AB and T-Systems International GmbH, a subsidiary of Deutsche Telekom. Denmark, France, Greece, Italy and Spain will be the first to take up the technical solution in view of taking it up in their national digital wallets or publishing a customised national age verification app on the app stores.
The architecture is built around privacy by design. The privacy-preserving age verification app enables users to easily prove they are over 18 when accessing restricted adult content, such as online pornography, without revealing any personal information — not even their exact age. It is technically modelled on the forthcoming European Digital Identity Wallets, which are due to roll out across all 27 member states by end of 2026. A second version of the blueprint, published in October 2025, added the ability to onboard via passport or national identity card.
The Commission's guidelines, published in 2025 as a benchmark for DSA compliance, are explicit that age verification is a proportionate and effective measure to mitigate the risk of minors accessing adult content services. Regulators and child safety researchers have long understood why the alternative — asking users to click a box confirming their age — cannot work.
Self-declaration requires no friction whatsoever. A child of eight can confirm they are 18 as readily as an adult can. The blurred previews and warning pages that the four sites deployed in lieu of verification are, if anything, more likely to pique curiosity than to deter access. Studies cited in the Commission's investigative file indicate that a significant proportion of European minors have accessed pornographic content online, with first exposure often occurring in early adolescence.
The Commission's concern is not merely moral but legal: the DSA's Article 28 requires platforms accessible to minors to ensure "a high level of safety, security and privacy" for those users. Letting a child watch explicit content via a checkbox does not come close to discharging that obligation.
The preliminary findings are not a final decision. The four platforms now have a window — typically several weeks — to review the Commission's investigation file, mount a written defence, or propose a remediation plan. The European Board for Digital Services, the network of national regulators established under the DSA, will be consulted in parallel.
If the Commission's preliminary conclusions survive scrutiny, it will issue a formal non-compliance decision. At that point, fines become operative. The platforms may also face requirements to implement specific technical measures, with periodic penalty payments accruing for each day of continued non-compliance. Repeat or aggravated infringements can attract higher penalties.
The message from Brussels is unambiguous: the Commission is demanding that Pornhub, Stripchat, XNXX and XVideos introduce what it calls "privacy-preserving age verification systems" — tools that can meaningfully restrict underage access without unnecessarily compromising users' privacy. Whether the platforms comply voluntarily, seek to negotiate, or fight the findings in court will define the next chapter of the EU's most consequential confrontation yet with the pornography industry.
