> For the complete documentation index, see [llms.txt](https://docs.layerlens.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.layerlens.ai/more-in-this-section-2/compliance-8.md).

# Media and entertainment compliance

Media and entertainment compliance — DSA, OSA, COPPA, ratings systems, DMCA, defamation, broadcast/state laws.

Media compliance has shifted decisively toward **platform regulation** post-2022 — EU DSA, UK OSA, and a growing patchwork of US state laws now sit on top of the older copyright, defamation, and broadcast frame.

## Regulatory frame

| Regime                                                      | Applies when                                                      | Evaluation-evidence shape                                     |
| ----------------------------------------------------------- | ----------------------------------------------------------------- | ------------------------------------------------------------- |
| **EU Digital Services Act (DSA)**                           | EU-active platforms; stricter for VLOPs/VLOSEs                    | Recommender transparency; risk assessments; audits            |
| **UK Online Safety Act (OSA)**                              | UK-active user-to-user / search services                          | Illegal content + child safety duties                         |
| **COPPA**                                                   | Services likely used by children under 13                         | Age gating; parental consent; data minimization               |
| **CSAM laws (18 USC § 2258A, EU)**                          | Any platform                                                      | Mandatory NCMEC reporting; prompt removal                     |
| **DMCA / EU DSM Directive**                                 | Hosting user content                                              | Notice-and-takedown; counter-notice handling                  |
| **Defamation law**                                          | Editorial content                                                 | Substantiation, retraction processes, public-figure standards |
| **Ratings systems**                                         | Distributed media                                                 | PEGI / ESRB / BBFC / FSK / MPAA / TV Parental Guidelines      |
| **State platform laws (TX, FL, NY SAFE for Kids, CA AADC)** | State-resident users                                              | Per-state moderation/disclosure rules                         |
| **TCPA (push notifications, SMS)**                          | Marketing notification                                            | Consent capture                                               |
| **Privacy laws (CCPA, GDPR, etc.)**                         | Per [retail compliance](/more-in-this-section-2/compliance-10.md) | DSR fulfillment                                               |
| **NIST AI RMF (voluntary)**                                 | Governance reference                                              | GOVERN/MAP/MEASURE/MANAGE evidence                            |

## EU Digital Services Act

In effect since 2024 for VLOPs/VLOSEs (40+ services designated). Key requirements:

* **Risk assessments** on systemic risks (illegal content, fundamental rights, civic discourse, public health)
* **Risk mitigation measures** including content moderation system design
* **Independent audits** annually
* **Recommender transparency** — Article 27 requires explanation of main parameters
* **Data access for researchers** under controlled conditions
* **Crisis response protocols**
* **Fines up to 6% of global revenue**

**Stratix evaluation evidence supports DSA:**

* Recommender drift dashboards retained per quarter
* Bias and fairness scorers documented as risk-mitigation measures
* Audit trail of moderation decisions including model version and policy version
* Production trace sampling at sufficient volume for independent auditors

## UK Online Safety Act

In effect 2024-2025 across phases. Core duties:

* Illegal content duty — prevent and remove
* Child safety duty for services likely accessed by children
* Adult user empowerment for Cat 1 services
* Transparency reports

Ofcom enforces; max fines £18M or 10% of global revenue.

**Stratix evaluation evidence:**

* Per-category moderation precision/recall reports
* Child safety risk assessment package
* Transparency-report data export

## COPPA

For services directed to children under 13:

* Verifiable parental consent before data collection
* Limited use of collected data
* Strict retention limits

For mixed-audience media services (e.g., kids' rows in a streaming service), age-band gating must be a hard rule with audit evidence.

## CSAM (18 USC § 2258A)

Mandatory reporting to NCMEC for actual knowledge. The CSAM-detection-floor rule is the highest-priority hard rule in moderation:

* 100% routing of confirmed and suspected CSAM to the NCMEC pipeline
* Zero tolerance for false negatives evading the routing
* Audit trail of every detection event

**Stratix evidence:**

* Hard rule on every moderation evaluation
* Quarterly audit of routing pipeline integrity

## DMCA / EU DSM Directive

For hosting user content:

* Notice-and-takedown response within reasonable time
* Counter-notice routing to human review
* Repeat-infringer policy

**Stratix evidence:**

* Counter-notice human-review rule (mandatory)
* Match-confidence threshold tracked
* False-positive rate monitored

## Defamation

For AI-generated editorial content:

* Public-figure plaintiffs must show actual malice (NYT v. Sullivan)
* Private-figure plaintiffs need only negligence
* AI-generated factual claims about identifiable individuals carry exposure when unsupported
* Some jurisdictions (UK, Australia) have stronger plaintiff protections than US

**Stratix evidence:**

* Faithfulness judge against verifiable sources
* Editor-review gate as hard rule
* Retraction-handling workflow audited

## Ratings systems

Per-region, per-medium:

* **Film:** MPAA (US), BBFC (UK), FSK (DE), CNC (FR), regional analogs
* **TV:** TV Parental Guidelines (US), per-country broadcast ratings
* **Games:** ESRB (US), PEGI (EU), USK (DE), CERO (JP)

**Stratix evidence:**

* Rating data populated per region; hard rule that surfaced content matches profile permission
* Region-aware profile metadata propagated through traces

## State platform laws

US fragmenting:

* **Texas HB 20** — viewpoint-discrimination claims
* **Florida SB 7072** — political-candidate moderation rules
* **NY SAFE for Kids Act** — algorithmic feed restrictions for minors
* **California AADC (AB 2273)** — child-impact assessment for online services

Stay current on state law per active geography.

## CCPA / CPRA / state privacy / GDPR / UK GDPR

See [retail compliance](/more-in-this-section-2/compliance-10.md) — same framework applies. Notable for media: opt-outs of ad targeting and profile-based personalization.

## Recommended setup

1. Pro tier minimum; Enterprise for VLOP-tier platforms
2. SSO + RBAC for editorial / moderation / safety roles
3. Hard rules: CSAM routing, age gating, ratings match, editor-review gate, exclusion adjacency
4. Faithfulness judges for editorial AI; per-category moderation classifiers
5. DSA / OSA reporting data pipeline configured
6. NCMEC routing tested quarterly
7. Audit retention matching the longer of platform-law minimums or 7 years
8. DPA executed; tenant data residency where contracted

## See also

* [Media scenarios](/more-in-this-section-2/scenarios-8.md)
* [Media eval patterns](/more-in-this-section-2/eval-patterns-8.md)
* [Concept: Multi-tenancy](/7.-observe-see-whats-happening/multi-tenancy.md)
* [Enterprise](/4.2-industry-use-cases/media-entertainment.md)