Media and entertainment compliance

Media and entertainment compliance — DSA, OSA, COPPA, ratings systems, DMCA, defamation, broadcast/state laws.

Media compliance has shifted decisively toward platform regulation post-2022 — EU DSA, UK OSA, and a growing patchwork of US state laws now sit on top of the older copyright, defamation, and broadcast frame.

Regulatory frame

Regime	Applies when	Evaluation-evidence shape
EU Digital Services Act (DSA)	EU-active platforms; stricter for VLOPs/VLOSEs	Recommender transparency; risk assessments; audits
UK Online Safety Act (OSA)	UK-active user-to-user / search services	Illegal content + child safety duties
COPPA	Services likely used by children under 13	Age gating; parental consent; data minimization
CSAM laws (18 USC § 2258A, EU)	Any platform	Mandatory NCMEC reporting; prompt removal
DMCA / EU DSM Directive	Hosting user content	Notice-and-takedown; counter-notice handling
Defamation law	Editorial content	Substantiation, retraction processes, public-figure standards
Ratings systems	Distributed media	PEGI / ESRB / BBFC / FSK / MPAA / TV Parental Guidelines
State platform laws (TX, FL, NY SAFE for Kids, CA AADC)	State-resident users	Per-state moderation/disclosure rules
TCPA (push notifications, SMS)	Marketing notification	Consent capture
Privacy laws (CCPA, GDPR, etc.)	Per retail compliance	DSR fulfillment
NIST AI RMF (voluntary)	Governance reference	GOVERN/MAP/MEASURE/MANAGE evidence

EU Digital Services Act

In effect since 2024 for VLOPs/VLOSEs (40+ services designated). Key requirements:

• Risk assessments on systemic risks (illegal content, fundamental rights, civic discourse, public health)
• Risk mitigation measures including content moderation system design
• Independent audits annually
• Recommender transparency — Article 27 requires explanation of main parameters
• Data access for researchers under controlled conditions
• Crisis response protocols
• Fines up to 6% of global revenue

Stratix evaluation evidence supports DSA:

• Recommender drift dashboards retained per quarter
• Bias and fairness scorers documented as risk-mitigation measures
• Audit trail of moderation decisions including model version and policy version
• Production trace sampling at sufficient volume for independent auditors

UK Online Safety Act

In effect 2024-2025 across phases. Core duties:

• Illegal content duty — prevent and remove
• Child safety duty for services likely accessed by children
• Adult user empowerment for Cat 1 services
• Transparency reports

Ofcom enforces; max fines £18M or 10% of global revenue.

Stratix evaluation evidence:

• Per-category moderation precision/recall reports
• Child safety risk assessment package
• Transparency-report data export

COPPA

For services directed to children under 13:

• Verifiable parental consent before data collection
• Limited use of collected data
• Strict retention limits

For mixed-audience media services (e.g., kids' rows in a streaming service), age-band gating must be a hard rule with audit evidence.

CSAM (18 USC § 2258A)

Mandatory reporting to NCMEC for actual knowledge. The CSAM-detection-floor rule is the highest-priority hard rule in moderation:

• 100% routing of confirmed and suspected CSAM to the NCMEC pipeline
• Zero tolerance for false negatives evading the routing
• Audit trail of every detection event

Stratix evidence:

• Hard rule on every moderation evaluation
• Quarterly audit of routing pipeline integrity

DMCA / EU DSM Directive

For hosting user content:

• Notice-and-takedown response within reasonable time
• Counter-notice routing to human review
• Repeat-infringer policy

Stratix evidence:

• Counter-notice human-review rule (mandatory)
• Match-confidence threshold tracked
• False-positive rate monitored

Defamation

For AI-generated editorial content:

• Public-figure plaintiffs must show actual malice (NYT v. Sullivan)
• Private-figure plaintiffs need only negligence
• AI-generated factual claims about identifiable individuals carry exposure when unsupported
• Some jurisdictions (UK, Australia) have stronger plaintiff protections than US

Stratix evidence:

• Faithfulness judge against verifiable sources
• Editor-review gate as hard rule
• Retraction-handling workflow audited

Ratings systems

Per-region, per-medium:

• Film: MPAA (US), BBFC (UK), FSK (DE), CNC (FR), regional analogs
• TV: TV Parental Guidelines (US), per-country broadcast ratings
• Games: ESRB (US), PEGI (EU), USK (DE), CERO (JP)

Stratix evidence:

• Rating data populated per region; hard rule that surfaced content matches profile permission
• Region-aware profile metadata propagated through traces

State platform laws

US fragmenting:

• Texas HB 20 — viewpoint-discrimination claims
• Florida SB 7072 — political-candidate moderation rules
• NY SAFE for Kids Act — algorithmic feed restrictions for minors
• California AADC (AB 2273) — child-impact assessment for online services

Stay current on state law per active geography.

CCPA / CPRA / state privacy / GDPR / UK GDPR

See retail compliance — same framework applies. Notable for media: opt-outs of ad targeting and profile-based personalization.

Recommended setup

1. Pro tier minimum; Enterprise for VLOP-tier platforms
2. SSO + RBAC for editorial / moderation / safety roles
3. Hard rules: CSAM routing, age gating, ratings match, editor-review gate, exclusion adjacency
4. Faithfulness judges for editorial AI; per-category moderation classifiers
5. DSA / OSA reporting data pipeline configured
6. NCMEC routing tested quarterly
7. Audit retention matching the longer of platform-law minimums or 7 years
8. DPA executed; tenant data residency where contracted

See also

• Media scenarios
• Media eval patterns
• Concept: Multi-tenancy
• Enterprise