> For the complete documentation index, see [llms.txt](https://docs.layerlens.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.layerlens.ai/more-in-this-section-2/compliance-8.md). # Media and entertainment compliance Media compliance has shifted decisively toward **platform regulation** post-2022 — EU DSA, UK OSA, and a growing patchwork of US state laws now sit on top of the older copyright, defamation, and broadcast frame. ## Regulatory frame | Regime | Applies when | Evaluation-evidence shape | | ----------------------------------------------------------- | ----------------------------------------------------------------- | ------------------------------------------------------------- | | **EU Digital Services Act (DSA)** | EU-active platforms; stricter for VLOPs/VLOSEs | Recommender transparency; risk assessments; audits | | **UK Online Safety Act (OSA)** | UK-active user-to-user / search services | Illegal content + child safety duties | | **COPPA** | Services likely used by children under 13 | Age gating; parental consent; data minimization | | **CSAM laws (18 USC § 2258A, EU)** | Any platform | Mandatory NCMEC reporting; prompt removal | | **DMCA / EU DSM Directive** | Hosting user content | Notice-and-takedown; counter-notice handling | | **Defamation law** | Editorial content | Substantiation, retraction processes, public-figure standards | | **Ratings systems** | Distributed media | PEGI / ESRB / BBFC / FSK / MPAA / TV Parental Guidelines | | **State platform laws (TX, FL, NY SAFE for Kids, CA AADC)** | State-resident users | Per-state moderation/disclosure rules | | **TCPA (push notifications, SMS)** | Marketing notification | Consent capture | | **Privacy laws (CCPA, GDPR, etc.)** | Per [retail compliance](/more-in-this-section-2/compliance-10.md) | DSR fulfillment | | **NIST AI RMF (voluntary)** | Governance reference | GOVERN/MAP/MEASURE/MANAGE evidence | ## EU Digital Services Act In effect since 2024 for VLOPs/VLOSEs (40+ services designated). Key requirements: * **Risk assessments** on systemic risks (illegal content, fundamental rights, civic discourse, public health) * **Risk mitigation measures** including content moderation system design * **Independent audits** annually * **Recommender transparency** — Article 27 requires explanation of main parameters * **Data access for researchers** under controlled conditions * **Crisis response protocols** * **Fines up to 6% of global revenue** **Stratix evaluation evidence supports DSA:** * Recommender drift dashboards retained per quarter * Bias and fairness scorers documented as risk-mitigation measures * Audit trail of moderation decisions including model version and policy version * Production trace sampling at sufficient volume for independent auditors ## UK Online Safety Act In effect 2024-2025 across phases. Core duties: * Illegal content duty — prevent and remove * Child safety duty for services likely accessed by children * Adult user empowerment for Cat 1 services * Transparency reports Ofcom enforces; max fines £18M or 10% of global revenue. **Stratix evaluation evidence:** * Per-category moderation precision/recall reports * Child safety risk assessment package * Transparency-report data export ## COPPA For services directed to children under 13: * Verifiable parental consent before data collection * Limited use of collected data * Strict retention limits For mixed-audience media services (e.g., kids' rows in a streaming service), age-band gating must be a hard rule with audit evidence. ## CSAM (18 USC § 2258A) Mandatory reporting to NCMEC for actual knowledge. The CSAM-detection-floor rule is the highest-priority hard rule in moderation: * 100% routing of confirmed and suspected CSAM to the NCMEC pipeline * Zero tolerance for false negatives evading the routing * Audit trail of every detection event **Stratix evidence:** * Hard rule on every moderation evaluation * Quarterly audit of routing pipeline integrity ## DMCA / EU DSM Directive For hosting user content: * Notice-and-takedown response within reasonable time * Counter-notice routing to human review * Repeat-infringer policy **Stratix evidence:** * Counter-notice human-review rule (mandatory) * Match-confidence threshold tracked * False-positive rate monitored ## Defamation For AI-generated editorial content: * Public-figure plaintiffs must show actual malice (NYT v. Sullivan) * Private-figure plaintiffs need only negligence * AI-generated factual claims about identifiable individuals carry exposure when unsupported * Some jurisdictions (UK, Australia) have stronger plaintiff protections than US **Stratix evidence:** * Faithfulness judge against verifiable sources * Editor-review gate as hard rule * Retraction-handling workflow audited ## Ratings systems Per-region, per-medium: * **Film:** MPAA (US), BBFC (UK), FSK (DE), CNC (FR), regional analogs * **TV:** TV Parental Guidelines (US), per-country broadcast ratings * **Games:** ESRB (US), PEGI (EU), USK (DE), CERO (JP) **Stratix evidence:** * Rating data populated per region; hard rule that surfaced content matches profile permission * Region-aware profile metadata propagated through traces ## State platform laws US fragmenting: * **Texas HB 20** — viewpoint-discrimination claims * **Florida SB 7072** — political-candidate moderation rules * **NY SAFE for Kids Act** — algorithmic feed restrictions for minors * **California AADC (AB 2273)** — child-impact assessment for online services Stay current on state law per active geography. ## CCPA / CPRA / state privacy / GDPR / UK GDPR See [retail compliance](/more-in-this-section-2/compliance-10.md) — same framework applies. Notable for media: opt-outs of ad targeting and profile-based personalization. ## Recommended setup 1. Pro tier minimum; Enterprise for VLOP-tier platforms 2. SSO + RBAC for editorial / moderation / safety roles 3. Hard rules: CSAM routing, age gating, ratings match, editor-review gate, exclusion adjacency 4. Faithfulness judges for editorial AI; per-category moderation classifiers 5. DSA / OSA reporting data pipeline configured 6. NCMEC routing tested quarterly 7. Audit retention matching the longer of platform-law minimums or 7 years 8. DPA executed; tenant data residency where contracted ## See also * [Media scenarios](/more-in-this-section-2/scenarios-8.md) * [Media eval patterns](/more-in-this-section-2/eval-patterns-8.md) * [Concept: Multi-tenancy](/7.-observe-see-whats-happening/multi-tenancy.md) * [Enterprise](/4.2-industry-use-cases/media-entertainment.md) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.layerlens.ai/more-in-this-section-2/compliance-8.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.