Most debates about child online safety focus on what platforms should do. Far fewer ask who has the power to make them do it. There is a quieter actor that has already shown it can change platform behaviour faster than any regulator, campaign or court: the payment network.
My work in Tuteliq sits at the intersection of reducing online harm and preventing financial crime. Navigating two regulators, different and often siloed industries, but it always boils down to preventing harm. Because of this, i understand the eco-system that is needed in order to truly protect. So, I want to put a question to every founder, product lead and board member running a platform that is not called Meta. Meta can absorb a fine. Can you?
Child safety is not only a "children's platform" problem There is a persistent belief that child safety obligations belong to the services designed for children: the games, the social apps, the learning tools. Everyone else can get on with business.
The evidence does not support that comfort. Research with people who seek out child sexual abuse material shows that many first encountered it as minors, often by accident, and often through mainstream services, search engines and adult sites (Protect Children and Ofcom, 2026; MLex). Children do not stay in the spaces built for them. Harm does not either. Any service that hosts user content, enables payments, recommends material or connects strangers is part of the child safety system, whether it chose to be or not.
The most dramatic proof of that came not from a regulator, but from the card networks.
December 2020: four days that changed an industry On 4 December 2020, The New York Times published Nicholas Kristof's investigation into child sexual abuse and non-consensual material on Pornhub. Within days, Mastercard said its own investigation had "confirmed violations of our standards prohibiting unlawful content" and instructed the banks connecting the site to its network to terminate acceptance. Visa suspended processing pending its own review, and Discover terminated acceptance too (Axios; BBC News).
The response was immediate. Pornhub banned uploads from unverified users and then removed all content from unverified uploaders "pending verification and review", taking the site from around 13.5 million videos to 2.9 million almost overnight (The Verge; BBC News).
Years of campaigning by survivors and advocates had preceded that moment. What turned pressure into action within a week was the loss of the ability to take payment.
The 2021 Mastercard standards Mastercard did not stop at one merchant. In April 2021 it announced new requirements for every adult content seller on its network, effective from 15 October 2021. The banks that connect merchants to Mastercard must now certify that sellers have effective controls to "monitor, block and, where necessary, take down all illegal content", built on "clear, unambiguous and documented consent" (Mastercard, 2021). The standards require:
documented age and identity verification for everyone depicted and everyone uploading content; review of all content before publication; a complaints process that resolves reports of illegal or non-consensual content within seven business days; an appeals route that allows any person depicted to request removal (Mastercard, 2021).
The detailed rules go further. Merchants must hold written agreements and written consent records for content providers, verify uploaders against government-issued ID, be able to monitor and remove live streams in real time, and must not market content in ways that suggest child exploitation or non-consent (Mastercard Security Rules and Procedures). Merchants must also report flagged content and complaints to their acquiring bank each month (Reuters).
Consider what that means. Before most countries had legislated, a private payment network had imposed pre-publication review, age and consent verification and timed takedown duties on an entire global industry. Researchers have described the payment ecosystem as "controlling the keys to the Golden City" for adult platforms, noting that these rules set requirements "that are not stipulated by law" (Franco, 2024, New Media & Society).
Why this works: the super controller Criminology has a name for this. Routine activity theory tells us crime happens when a motivated offender and a suitable target meet without a capable guardian. Later work added the people who control places, and then the "super controllers" who sit above them: the organisations, institutions and markets that create incentives for place managers to act (Sampson, Eck and Dunham, 2010).
Platforms are the place managers of the online world. Payment networks, banks and acquirers are among their most powerful super controllers. They do not moderate content themselves. They change the incentives of those who do. When the ability to take money depends on proving you can prevent abuse, prevention stops being a cost centre and becomes a condition of doing business.
Courts are starting to see payment providers in the same light. In Fleites v MindGeek, a US federal judge refused Visa's motion to be dismissed from a survivor's claim, writing that Visa "is not alleged to have simply created an incentive to commit a crime, it is alleged to have knowingly provided the tool used to complete a crime" (Fleites v MindGeek, C.D. Cal. 2022). That was a ruling at the pleading stage, not a finding of liability, but its message to the financial sector was clear: processing the proceeds of abuse is not a neutral act.
Now the law has caught up, and it follows the money too The UK Online Safety Act built this logic into statute. Ofcom can fine a provider up to £18 million or 10% of qualifying worldwide revenue, whichever is greater (GOV.UK). In the most serious cases of continuing non-compliance, it can ask a court for business disruption measures, including service restriction orders requiring providers of "ancillary services", explicitly including services that "enable funds to be transferred", to withdraw from a non-compliant platform (Online Safety Act 2023, s.144; Ofcom enforcement guidance). Those orders can require the termination of existing contracts.
This is no longer theoretical. Ofcom fined AVS Group £1 million for failing to deploy highly effective age assurance across 18 adult sites (Reuters), then fined 8579 LLC a record £1.35 million in February 2026 (European Audiovisual Observatory). Further penalties have followed, including £630,000 against the provider of Fapello and £730,000 against the provider of Xgroovy (Ofcom; Ofcom). In May 2026, Ofcom applied for its first business disruption order, against a suicide forum it had already fined £950,000 (The Register).
Ofcom has also acknowledged that most of its fines remain unpaid, particularly where companies hold no UK assets (The Register). That is exactly why the payment lever matters. A fine can be ignored from offshore. Losing your acquirer cannot.
Meta can swallow fines. Can your platform? In March 2026, a New Mexico jury ordered Meta to pay $375 million after finding it misled users about child safety and concealed what it knew about child sexual exploitation on its platforms (Reuters). In 2022, Ireland's Data Protection Commission fined Instagram €405 million over its handling of children's data (Data Protection Commission). Meta is appealing the New Mexico verdict.
These are serious sums. But Meta's revenue for 2025 was $200.97 billion (Meta). The New Mexico penalty is less than 0.2% of one year's revenue. Meta has the cash, the lawyers and the time to appeal.
Most platforms have none of those things. For a mid-sized marketplace, a creator platform, a dating app, a gaming community or an AI image tool, a seven-figure fine is a material event. Losing card acceptance can end the business. Consider how quickly it happens:
In August 2021, OnlyFans announced it would ban sexually explicit content, with its founder telling the Financial Times "we had no choice, the short answer is banks". It reversed the decision within days after securing "banking partners' assurances" (AP News; Observer). In July 2025, Steam introduced a rule banning content that may violate the standards of its payment processors and card networks, and removed hundreds of adult titles. Itch.io deindexed more than 20,000 NSFW works overnight to "protect the platform's core payment infrastructure" (TechCrunch; WIRED).
Notice who carried the cost in each case. Not only the platform, but every legitimate creator and user who depended on it. When prevention is left until the payment provider acts, the response is blunt, sudden and indiscriminate.
A note on proportionality I want to be fair to the critics. Sex worker advocates, researchers and game developers have raised real concerns that payment providers act as unaccountable moral gatekeepers, and that blanket removals harm lawful creators, including LGBTQ+ creators (CBC; Franco, 2024). Mastercard and Visa both say they allow lawful purchases and do not make moral judgements about legal content (WIRED).
Those concerns strengthen my argument rather than weaken it. The way to avoid crude, last-minute de-risking is for platforms to build credible, evidenced child safety controls before anyone outside forces the issue. Platforms that can show their working are far better placed to keep their banking relationships, satisfy regulators and protect the lawful users they serve.
What every platform should do now Whether or not you host children, and whether or not you host adult content:
Map your financial dependencies. Know who your acquirer, payment processor and banking partners are, and read their content and risk standards. Mastercard's adult content rules are public. Your exposure may not be. Treat child safety as a payments risk, not just a trust and safety risk. Put it on the board risk register alongside fraud and AML, because that is where your financial partners will put it. Verify before you publish. Age and consent verification, pre-publication review and fast takedown are now baseline expectations for higher-risk content. They are far cheaper to design in than to retrofit under a deadline. Keep the evidence. Monthly reporting, complaint logs and takedown timings are what acquirers and regulators will ask for. Comprehensive moderation with a solid auditable evidence log is essential. If you cannot evidence it, assume it did not happen. Close the gap between policy and practice. Every case above involved stated policies that did not match what was happening on the platform. Work with the financial sector, not against it. Banks, card schemes and platforms share an interest in keeping the proceeds of child abuse out of the system. Share intelligence, align standards and build consistent, proportionate expectations, rather than waiting for the next exposé.
The bottom line Financial services have shown that when they make prevention a condition of access, platforms change fast. Regulators have now written the same lever into law. The question is no longer whether your platform will be held responsible for child safety. It is who will hold you to account first: a regulator, a court, a journalist, or the bank that processes your revenue.
Meta can afford to find out the hard way. Most platforms cannot. Prevention is not only the right thing to do for children. For most businesses, it is the only form of risk management that does not arrive too late.
References Axios (2020). Mastercard, Visa, Discover cut payment services to Pornhub. https://www.axios.com/2020/12/11/pornhub-mastercard-visa-payments BBC News (2020). Pornhub: Mastercard severs links with pornography site. https://www.bbc.co.uk/news/technology-55267311 BBC News (2020). Pornhub removes all user-uploaded videos amid legality row. https://www.bbc.co.uk/news/technology-55304115 CBC (2025). How an anti-porn lobby on payment processors censored thousands of video games. https://www.cbc.ca/radio/day6/steam-itch-takedowns-credit-cards-1.7597563 Data Protection Commission (2022). Data Protection Commission announces decision in Instagram inquiry. https://dataprotection.ie/en/news-media/press-releases/data-protection-commission-announces-decision-instagram-inquiry European Audiovisual Observatory (2026). Ofcom escalates Online Safety Act enforcement with new fines over age-assurance failures on adult websites. https://merlin.obs.coe.int/article/10494 Fleites v MindGeek (C.D. Cal., 29 July 2022). https://caselaw.findlaw.com/court/us-dis-crt-cd-cal/1913266.html Franco, R. S. (2024). "Controlling the keys to the Golden City": The payment ecosystem and the regulation of adult webcamming and subscription-based fan platforms. New Media & Society. https://journals.sagepub.com/doi/10.1177/14614448241303465 GOV.UK (2024). Online Safety Act: explainer. https://www.gov.uk/government/publications/online-safety-act-explainer/online-safety-act-explainer Mastercard (2021). Protecting our network, protecting you: Preventing illegal adult content on our network. https://www.mastercard.com/news/perspectives/2021/protecting-our-network-protecting-you-preventing-illegal-adult-content-on-our-network Mastercard. Security Rules and Procedures: Merchant Edition. https://www.mastercard.com/content/dam/mccom/shared/business/support/rules-pdfs/SPME-Manual.pdf Meta (2026). Meta Reports Fourth Quarter and Full Year 2025 Results. https://investor.atmeta.com/investor-news/press-release-details/2026/Meta-Reports-Fourth-Quarter-and-Full-Year-2025-Results/default.aspx MLex (2026). Search engines, porn sites central to CSAM access, UK study finds. https://www.mlex.com/mlex/articles/2454384/search-engines-porn-sites-central-to-csam-access-uk-study-finds Observer (2021). OnlyFans CEO blames banks for initial policy change. https://observer.com/2021/08/onlyfans-ceo-explain-porn-ban-banking-partner-interview/ Ofcom (2025). Online Safety Enforcement Guidance. https://www.ofcom.org.uk/siteassets/resources/documents/online-safety/information-for-industry/illegal-harms/online-safety-enforcement-guidance.pdf?v=391925 Ofcom (2026). Ofcom fines porn company £630,000 for age check failings. https://www.ofcom.org.uk/online-safety/protecting-children/ofcom-fines-porn-company-630000-for-age-check-failings Ofcom (2026). Porn site deploys age checks as Ofcom fines it £730,000. https://www.ofcom.org.uk/online-safety/illegal-and-harmful-content/porn-site-deploys-age-checks-as-ofcom-fines-it-730000 Online Safety Act 2023, Part 7, Chapter 6: Business disruption measures. https://www.legislation.gov.uk/ukpga/2023/50/part/7/chapter/6/crossheading/business-disruption-measures Protect Children and Ofcom (2026). CSAM Perpetrator Research Report. https://www.suojellaanlapsia.fi/en/post/tmat-csam-perpetrator-research-report Reuters (2025). US whistleblower says Mastercard, Visa failed to stop payments on OnlyFans for child sex abuse. https://www.reuters.com/world/us/us-whistleblower-says-mastercard-visa-failed-stop-payments-child-sex-abuse-2025-01-24/ Reuters (2025). Britain fines porn website $1.3 mln over age checks failure. https://www.reuters.com/business/media-telecom/britain-fines-porn-website-13-mln-over-age-checks-failure-2025-12-04/ Reuters (2026). Jury orders Meta to pay $375 mln in New Mexico lawsuit over child sexual exploitation. https://www.reuters.com/sustainability/boards-policy-regulation/jury-orders-meta-pay-375-mln-new-mexico-lawsuit-over-child-sexual-exploitation-2026-03-24/ Sampson, R., Eck, J. E. and Dunham, J. (2010). Super controllers and crime prevention: A routine activity explanation of crime prevention success and failure. Security Journal, 23(1), 37–51. https://doi.org/10.1057/sj.2008.17 TechCrunch (2025). Itch.io is the latest marketplace to crack down on adult games. https://techcrunch.com/2025/07/27/itch-io-is-the-latest-marketplace-to-crack-down-on-adult-games/ The Register (2026). Ofcom discovers issuing Online Safety Act fines is easier than collecting them. https://www.theregister.com/security/2026/09/17/ofcom-discovers-issuing-online-safety-act-fines-is-easier-than-collecting-them/5297110 The Verge (2020). Pornhub just removed most of its videos. https://www.theverge.com/2020/12/14/22173858/pornhub-videos-removed-user-uploaded-visa-mastercard-verified AP News (2021). OnlyFans reverses explicit content ban after outcry. https://apnews.com/article/technology-business-arts-and-entertainment-d10b111007731f7679ad8954af0ba027 WIRED (2025). Itch.io is restoring NSFW games, as long as they're free. https://www.wired.com/story/itchio-restoring-free-nsfw-games/