Urgent Compliance
For adult website operators, January 1, 2027, should already be driving decisions about technology, staffing, content acquisition and recordkeeping. California’s AB 1705 creates obligations addressing the age and consent of people appearing in sexually explicit content, together with significant potential liability for website operators and uploaders. Preparing for those obligations requires more than revising a paragraph in the terms of service.
Gov. Gavin Newsom signed AB 1705 on September 30, 2026. The legislation adds Sections 22610 through 22618 to California’s Business and Professions Code and takes effect January 1, 2027, under California’s ordinary effective-date rules. That gives businesses a short runway to evaluate their exposure, implement upload controls and examine the content they already display.
Featured In The November 2026 Edition Of XBIZ World
The practical challenge is that several departments must work together. Legal counsel can interpret the requirements and prepare certification language, but engineering must enforce the workflow. Moderators must recognize and escalate warning signs. Content acquisition teams must secure adequate documentation. Management must provide the budget and authority necessary to make those changes before the deadline.
For XBIZ readers, the immediate priority is understanding what the enacted law actually requires, then translating those requirements into controls that work under everyday business conditions.
AB 1705 focuses on the people appearing in content and the users supplying it. Its express requirements concern uploader email verification, certifications addressing adulthood and consent, record retention, and an operator’s exercise of ordinary care. Installing a viewer age gate does not satisfy those obligations.
The first step is determining which websites, and business activities fall within the law. AB 1705 defines a “pornographic internet website” by reference to a website that permits users to upload, or solicits from users, sexually explicit content for display. A “user” can be a person or an entity that uploads or otherwise provides that content. Operators therefore should examine creator submissions, studio deliveries, distributor feeds and other acquisition arrangements, rather than limiting their review to websites offering anonymous public uploads. The definition contains no express minimum revenue, traffic or percentage-of-content threshold.
That does not mean every website containing nudity automatically falls within the statute. The definitions and exclusions matter. The law excludes content that, taken as a whole, has serious literary, artistic or scientific value. It also excludes email or direct messaging services, and cloud storage, file transfer or collaboration services, based on those functions alone.
A separate provision excludes qualifying sexually explicit content transmitted through an online dating service’s private messaging or direct-communication feature to user-selected recipients, provided it is not made available to the general public, a publicly viewable feed or public search indexing. That is a content-specific exclusion with conditions, not a blanket exemption for every feature offered by a dating platform.
Operators outside California also need a considered assessment of their California connections. An out-of-state incorporation or server location should not be treated as a complete legal analysis. Counsel should evaluate jurisdiction, the business’s activities and the relevant parties. Likewise, a decision to restrict California access should receive legal and technical review before anyone treats it as a complete answer.
Central to the statute is its specialized definition of a “depicted individual.” In this context, the phrase does not simply mean every performer shown on screen. It identifies someone depicted nude or engaging in sexual acts who satisfies at least one of three conditions: the person did not consent to being depicted; the person was a minor when the content was created; or the person did not consent to the uploading when it occurred.
Those distinctions should shape the compliance process. Establishing that someone is an adult today does not establish that the person was an adult when a recording was made. Consent to recording and consent to uploading are separate issues. A supplier’s assurance that it owns distribution rights may be relevant, but operators should examine whether their documentation actually addresses the people depicted and the proposed use.
The statute’s definitions also contain cross-references and drafting language that warrant careful legal interpretation. Businesses should avoid turning a short summary into a universal rule for every borderline category of content. Nevertheless, uncertainty at the edges does not eliminate the need to implement the law’s express upload and recordkeeping requirements.
One immediate engineering task is uploader email verification. Section 22614 requires operators to verify a user’s email address before permitting the user to upload sexually explicit content. Merely collecting an address during registration does not verify it. Nor does sending a welcome email, without any confirmation that the user controls the address, necessarily accomplish that objective.
A practical implementation could require the uploader to complete a verification link or code before upload functionality becomes available. Although the statute does not prescribe a particular technical method, the system should reliably enforce the sequence.
This review must include more than the public upload page. Mobile interfaces, application programming interfaces, bulk imports, partner dashboards and older accounts can create alternate routes around a new control. Operators should identify every submission path and confirm that the applicable requirements cannot be bypassed through a less visible channel.
The next mandatory element is the uploader’s certification. Before uploading, a user must submit a statement, under penalty of perjury, certifying three facts about each individual depicted: the person was not a minor when the content was created, consents to the content being uploaded to the website, and consented to being depicted. The user must also provide sufficient contact information, including at least an email address.
Operators should have counsel prepare language that clearly captures all three points. A generic promise to comply with applicable laws may fail to communicate or document the required certification. The uploader should understand that the statement concerns every person depicted, including collaborators and others appearing alongside the account holder.
As an implementation recommendation, certifications should be linked to identifiable content. That connection allows the business to establish which statement accompanied which submission. If a platform accepts batch uploads, its records should clearly identify every file covered by the declaration. The law does not mandate a particular database design, but ambiguity about a statement’s coverage creates an avoidable evidentiary problem.
The certification carries consequences on both sides of the transaction. Knowingly providing false information in the statement is an infraction punishable by a $1,000 fine. An operator that fails to obtain the required statement is presumed to have violated Section 22612, the provision establishing the duty concerning displayed content.
Obtaining the statement, however, is not an express blanket safe harbor. Section 22612 requires ordinary care and reasonable diligence concerning displayed content, while Section 22614 separately requires ordinary care and reasonable steps concerning uploaded content. Operators should therefore avoid designing a system that collects a declaration but disregards credible evidence contradicting it.
Consider a submission accompanied by a certification but also by communications suggesting that one participant opposed distribution. The certification should not end the review. The same principle applies when documentation raises questions about age at production, the uploader’s authority or whether a depicted person agreed to the upload.
A sensible operational response is to identify warning signs, create escalation procedures and give reviewers authority to hold content while concerns are investigated. These are recommended ways to support the statutory duty of care; AB 1705 does not prescribe one universal moderation product or require a particular vendor.
Record retention is another concrete obligation requiring immediate attention. Operators must retain the required statement and contact information in a readily available format for at least seven years after submission. The statutory retention period is tied to submission, rather than to how long the user maintains an account or how long the content remains online.
Existing deletion routines may conflict with that requirement. Closing a creator account, removing a video or migrating to a new platform might currently trigger deletion of associated records. Operators need to identify those routines and ensure that required records survive for the applicable period.
“Readily available” also deserves practical attention. An archive is of limited use if employees cannot locate a certification without restoring an entire retired system. As a recommended design, a compliance record should connect the declaration, its submission date, the uploader’s contact information and the relevant content identifier. Preserving the version of the certification presented to the uploader can also help establish what was actually certified.
Those records should be protected through appropriate access controls, secure storage and tested recovery procedures. The seven-year requirement concerns the specified statement and contact information; it should not be casually interpreted as an instruction to collect and retain every conceivable sensitive document. Additional collection and retention decisions should be evaluated against other applicable obligations.
Existing libraries present a separate and potentially substantial workload. Section 22612 addresses content displayed on a covered website, and the enacted text contains no express grandfather exemption for older material. Operators should therefore assess continuing display after the effective date instead of assuming that a pre-2027 upload date resolves the issue. That is a prospective compliance concern, distinct from claiming the statute retroactively makes a past upload unlawful.
A useful starting point is a documented inventory of content sources and supporting records. Which files came directly from verified creators? Which arrived through distributors? Which have releases or reliable age-at-production information? Which have previously generated consent complaints? Which cannot be connected to an identifiable supplier?
Prioritizing material with unresolved complaints or missing documentation is a practical risk-management approach. Where serious questions cannot be resolved, restricting access while the matter is reviewed may be appropriate. Any preservation obligations should be addressed before records or files are destroyed.
Operators should also distinguish this recommended library review from an express statutory instruction to obtain a new declaration for every historical upload. The law’s continuing display duty is clear enough to demand attention, but the treatment of particular legacy records and transactions deserves individualized analysis.
Complaint handling must become part of the same operational system. A business that receives a credible age or consent complaint needs a process that reaches someone able to investigate and act. Routing every message into a general customer-service queue creates unnecessary delay, particularly over weekends and holidays.
AB 1705 itself does not establish a universal hourly takedown deadline. Operators should not invent one and present it as a statutory requirement. Instead, internal response targets should reflect the seriousness of the allegation, the duty of care and any other applicable legal requirements.
Removal procedures should account for the way a website actually distributes content. Disabling a main page may leave a preview, thumbnail, alternate URL or publicly accessible cached copy available. A rehearsal using test material can establish whether the team knows how to disable the relevant copies and document what it did.
The financial exposure reinforces the importance of preparation. A qualifying harmed depicted individual may sue an operator for covered violations and may also sue an uploader under the conditions specified in the statute. A prevailing individual may recover actual damages or statutory damages of up to $75,000 per violation, whichever amount is greater, along with punitive damages, reasonable attorney’s fees and costs, and other available relief, including an injunction.
The $75,000 figure should be described accurately. It is not an automatic award in every case, and it is not a universal ceiling on total exposure. The statute separately authorizes public prosecutors to seek a $25,000 civil penalty per violation, injunctive and other equitable relief, attorney’s fees and costs, and other appropriate relief.
Of particular operational significance, each full calendar day that content uploaded or displayed in violation remains accessible constitutes a separate violation. That language makes unresolved accessibility an issue management must understand. It does not mean every complaint automatically establishes a violation, but it provides a compelling reason to ensure that credible concerns receive prompt attention.
Contracts and supplier relationships should be reviewed alongside the technology. As a recommended practice, agreements should address documentation, cooperation with investigations, the accuracy of supplied information and responses to age or consent disputes. A distributor’s willingness to provide records may be as important operationally as the representations written into its contract.
Outsourcing an upload system or moderation function also requires scrutiny. Operators should confirm what their vendors actually verify, what records they retain, how those records can be retrieved and whether they can be exported when the relationship ends. A vendor’s general claim of compliance is less useful than a demonstration of the specific workflow the business will rely on.
The remaining time before January 1 should be assigned concrete deliverables. During October, management should appoint a responsible compliance lead, obtain a scope assessment, map submission channels and begin the library review. Engineering and counsel should settle the email-verification and certification requirements early enough to allow implementation.
November should be used to deploy and test those controls, establish retention rules, revise supplier procedures and train the employees who will handle exceptions. Testing should include attempts to upload through alternate routes, submit incomplete certifications and delete accounts whose required records must remain available.
December should be reserved for correcting failures and rehearsing the complete process. Select a submission and retrieve its certification. Confirm that the record identifies the covered content. Run a test complaint through escalation. Verify that authorized staff can disable access across the website. Establish holiday coverage before the deadline arrives.
These are recommended project milestones, not additional statutory dates. Their purpose is to avoid discovering in late December that the legal language is ready but the underlying system is not.
Management should also assign counsel to check for relevant amendments, court orders and other developments before publication and implementation. A possible future challenge should not become an assumed extension of the compliance deadline.
AB 1705 requires website operators to be able to explain how content enters their platforms, what uploaders certified, how required records are preserved and how concerns about age or consent are handled. For an adult business with a large library and multiple submission channels, building that capability takes time.
January 1, 2027, should mark the operation of a tested compliance process. The work necessary to reach that point belongs on the calendar now
This article does not constitute legal advice and is provided for your information only and should not be relied upon in lieu of consultation with legal advisors in your own jurisdiction. It may not be current as the laws in this area change frequently. Transmission of the information contained in this article is not intended to create, and the receipt does not constitute, an attorney-client relationship between sender and receiver.
About Silverstein Legal
Founded in 2006 by adult entertainment lawyer Corey D. Silverstein, Silverstein Legal is a boutique law firm that caters to the needs of anyone working in the adult entertainment industry. Silverstein Legal’s clients include hosting companies, affiliate programs, content producers, processors, designers, developers, and website operators.
Related Articles
