The release form in the drawer
A signed paper release protects you only for what it says, and only until someone tests it. A realistic scenario of how a scanned release becomes a legal claim four years later.
Read ArticleIdentity verification, age assurance, digital consent and the regulations that shape them. Written for the people who have to implement this, not the people who write about it.
A signed paper release protects you only for what it says, and only until someone tests it. A realistic scenario of how a scanned release becomes a legal claim four years later.
Read Article
A secure portal confirms that a file was uploaded. It cannot tell you who collected it. What an identity-checked collection receipt changes for a firm's file of record.
Read Article
Age assurance regimes ask platforms to check identity documents, then punish them for holding the data. The way out is to receive an age attribute instead of an identity.
Read Article
Signing-time dependency versus verification-time dependency — and why a properly sealed credential stays checkable offline, long after the issuer has gone.
Read Article
If the law requires you to know who your customer is and prove it years later, the check is the easy half. The evidence is the part that fails audits.
Read Article
What a ProntoTag request actually is, what the person who sent it can and cannot see, and what happens to your documents when you approve or decline.
Read Article
Bad grammar and odd links stopped being reliable tells the moment voice cloning got cheap. What replaces them is out-of-band verification of the person, not the message.
Read Article
Sometimes a support team needs one bit of information: is this a real, live person who is who they claim to be? Returning only that answer removes most of the data protection problem.
Read Article
Scanned release forms and terms-of-service warranties are assertions, not evidence. What regulators now expect from platforms hosting user media, and what asset-linked consent looks like.
Read Article
Advertising, stock, school sport and live events all run on photographs of identifiable people — which makes every frame personal data. Four sectors where paper releases quietly fail.
Read Article
Conventional KYC is built by platforms, for platforms. What it looks like to invert that — credentials on the device, only proofs leaving it — and where we are with it.
Read Article
ProntoID proves who a person is. PrestoMint proves which content they authorised. Three layers, one publish-time answer, and nobody holding both halves.
Read Article
From 10 July 2027 the EU Anti-Money Laundering Regulation applies directly in all 27 Member States. What changes for remote customer due diligence — and for the obligation to prove, years later, that a check happened.
Read Article
Mastercard and Visa write their adult content rules at the acquirer, not the merchant. Where portfolio liability actually sits, and why a merchant's consent file is an assertion rather than evidence.
Read Article
Paper releases ask models to hand a passport copy and a home address to someone with no way to protect either. There is a version of this where the document never leaves.
Read Article
Running the check is straightforward. Proving two years later who was checked, what was verified, and what the credential status was at that exact moment is the harder problem.
Read Article
Credential analysis, liveness and a sealed dossier for every party — completed before the deed is drawn, not reconstructed afterwards.
Read Article
ProntoTag signals, records and attests. It deliberately does not delete content, and the reasons for that boundary are both security and jurisdiction.
Read Article
A model release is a contract. The right to erasure is a statutory right. Treating one as cancelling the other is the most common compliance failure in photography work.
Read ArticleFive recurring threads. Each one comes out of a decision we actually had to make.
The UK Online Safety Act, EU DSA Article 28, German JMStV, GDPR and Swiss FADP — what each one actually requires, jurisdiction by jurisdiction, rather than what vendors say it requires.
Canonical serialisation, detached signatures, append-only ledgers and key custody. The engineering decisions that determine whether a record is still provable in ten years.
What a release is worth when neither party was identified, why withdrawal is an append rather than a delete, and how bilateral consent differs from a checkbox.
Notes from building the ecosystem — what shipped, what we changed our minds about, and the constraints that shaped the answer.
Card scheme rules, platform liability, age assurance standards and where the market is heading — read from primary sources rather than press releases.
If you are working through an identity or compliance problem and cannot find a straight answer anywhere, tell us. It is usually worth an article.