- Hosting platforms that store, preview and monetise user media are increasingly treated as controllers, not neutral conduits.
- A scanned release proves a document exists. It does not prove who signed it, how old they were, or which files it covers.
- The accountability principle requires demonstrable consent — evidence a platform holds, not a promise a creator made.
- Asset-linked consent binds a verified identity to specific files at the moment of approval, which is the artefact regulators actually ask for.
The bargain platforms have been making
Every platform that hosts user-generated media has quietly made the same trade. On one side: onboarding that is fast enough for creators to actually complete. On the other: documentation strong enough to survive a challenge. Almost everyone optimised for the first and hoped the second would never be tested.
The mechanism is familiar. A creator uploads content, uploads a scanned release form, ticks a box warranting that everyone featured consented and was over eighteen, and the asset goes live. The platform never opens the PDF. At volume, nobody could.
That model was reasonable when the alternative was a filing cabinet. It is much harder to defend now — not because the law suddenly changed, but because regulators started asking a question the model was never built to answer: can you show us the consent?
- Signatures nobody verified, against an identity nobody checked
- Scope mismatches — a photo release covering published video
- No link between the document and the specific files that went live
Three assumptions that no longer hold
Most compliance gaps are not the result of bad faith. They come from three inherited assumptions that were sound a decade ago and are not any more.
"We are just the technical supplier"
The intuition is that responsibility sits entirely with the uploader — the platform simply provides pipes and storage. The statutory test, though, is not about pipes. Under Article 4(7) a controller is whoever determines the purposes and means of processing.
A platform that indexes media, generates previews, recommends it to users, sets retention, and takes a commission on every sale is making exactly those determinations. That is why EU and UK authorities have repeatedly landed on controller or joint-controller status for intermediaries that shape and profit from processing. And once you are a controller, Article 5(2) applies: you must be able to demonstrate compliance. "Our terms required the creator to hold a release" is an allocation of contractual risk between you and the creator. It is not evidence, and the person in the content was never a party to it.
"The release form is on file"
Having a document and having valid consent are different things, and the gap between them is where the real exposure lives.
Scope drifts. A release granting rights to stills gets filed against an upload that includes video. Limits get ignored. A form restricted to one territory, or expiring after twelve months, sits behind a catalogue that streams worldwide indefinitely. Identity is assumed. A scan proves that a piece of paper was signed by someone. It does not establish that the signatory is the person visible in the media, or that they were an adult on the day of the shoot.
Where the content touches special category data — material revealing someone's sex life or sexual orientation, or biometric data used to identify them — Article 9 raises the bar to explicit consent. An unread PDF is a weak answer to a strong requirement.
"Our US framework covers us"
Many international platforms built their processes around US reference points: 18 U.S.C. § 2257 record-keeping, DMCA safe harbour, indemnities in the creator agreement. These are worth having. They are not portable.
Article 3(2) extends the GDPR to organisations outside the EU that offer services to, or monitor, people in the EU. A contractual disclaimer drafted for a US court does not answer a supervisory authority asking a European resident's question about a European resident's data. Compliance is territorial in reach and evidential in nature, and neither of those is something a warranty clause can supply.
Consent has moved from being a document you collect to being a state you can evidence. Paper answers the first framing well and the second one badly. That is the whole problem in one sentence.
What asset-linked consent looks like
If the gap is evidential, the fix has to be structural. Consent needs to be captured at the moment of publication, from a verified person, against the exact files in question — and then sealed so that it can be produced later without anyone reconstructing it from memory.
That is what ProntoTag does. It replaces the uploaded PDF with a verified workflow that binds an identity to specific assets.
- A timestamped consent record tied to the file, not to a folder
- Identity and age confirmed against a government document at signing time
- A retrievable audit trail — no manual reconstruction later
Tagging at the point of upload
When content is uploaded, the people featured in it are tagged. Each tagged person receives a secure link — no account setup, no app download, no password to invent.
Identity and age, checked live
The tagged person completes a short session: a government photo ID is captured and parsed, and a real-time biometric liveness check confirms a live human is present and matches the document. Age is read from the document rather than self-declared. This is the step a scanned form structurally cannot perform.
The exact assets, previewed before signing
Before signing anything, the person sees the specific images or video files the request covers. Scope ambiguity disappears because there is nothing left to interpret — approval attaches to enumerated files, not to a general description of a shoot.
Sealed, then retrievable
The agreement, the asset reference, the verification result and the timestamp are sealed into a record stored in an isolated vault. The signature carries the legal name resolved from the verified document rather than whatever was typed into a field. When a question arrives eighteen months later, the answer is a lookup.
| Compliance question | Scan and trust | ProntoTag |
|---|---|---|
| Proof of consent | A third-party PDF of unknown provenance, rarely opened. | A consent record bound to a biometrically verified identity. |
| Age assurance | Self-declared by the uploader, on the uploader's word. | Read from a government document at the moment of signing. |
| Scope control | Format and territory drift between form and publication. | Approval attaches to enumerated files the person has seen. |
| Dispute response | Days of chasing an uploader for paperwork that may not exist. | Immediate retrieval of the verification record for the asset. |
| Withdrawal of consent | No mechanism; the subject has no visibility into publication. | The subject sees what is published and can act on it directly. |
| Scaling | Manual review that nobody can staff at catalogue volume. | Enforced in software, at the point of upload, per asset. |
What about the content you already host?
This is the question that stops most remediation projects before they start. Every established platform has catalogue items uploaded years ago under warranty terms that would not survive scrutiny today, and the size of that backlog can feel like a reason to do nothing.
It usually is not. Supervisory authorities are not looking for a platform that has never had a gap; they are looking at intent, actual harm, and whether the underlying process was fixed. Three things measurably improve the position:
- Act fast on notice. Removing a disputed item immediately, and documenting when and why, limits both the harm and the window a regulator is assessing.
- Quantify the exposure honestly. Where an item generated negligible revenue and reached few people, say so with data. Scale is one of the factors weighed when a sanction is calibrated.
- Show the process changed. A platform that has replaced unverified uploads with verified consent is describing a systemic fix, which is materially different from promising to be more careful.
In practice, most platforms migrate in order of risk: new uploads first, then the highest-traffic legacy assets, then the long tail. What matters is that the direction of travel is documented and real.
Who this actually protects
It is easy to frame verified consent as a burden imposed on creators. Built properly, it is the opposite — it removes work from everyone who currently absorbs it informally.
- Platforms stop holding other people's ID scans. Identity data stays in ProntoID's vaults; the platform receives a verification result and a consent record, which is the part it actually needs and the part it can safely retain.
- Creators stop collecting, storing and re-sending paperwork, and stop being the weakest link in someone else's compliance chain. Onboarding a collaborator becomes a link, not an envelope.
- The people in the content get something the paper model never gave them: visibility into where their likeness is published, control over which formats were approved, and a working route to withdraw consent.
No vendor can make a platform compliant. Compliance depends on your lawful basis, your retention practices, your transparency notices and your governance. What technology can do is supply the evidence layer that those obligations rest on — and that layer is precisely what a scanned PDF fails to provide.
Where to start
If you host media featuring identifiable people, three questions are worth answering this quarter. For any given asset in your catalogue, can you produce the consent behind it in under a minute? Does that consent name a verified person, or an unverified signature? And does it refer to the file that is actually published, or to a shoot it was loosely associated with?
If any answer is uncomfortable, the fix is not a better form. It is moving consent capture into the upload path, where it can be verified, scoped and sealed while the content is still in front of you.