Do card network consent rules apply if our content is not explicit?

The registration programmes are triggered by content category, so a strictly non-explicit platform usually sits outside them. The consent expectation, though, has broadened well past explicit material: acquirers underwriting any platform that depicts identifiable real people increasingly ask how consent is recorded, because their own risk models have caught up with deepfake litigation. Expect the question even if the formal programme does not apply.

Is a signed model release enough documented consent?

For traditional production, often yes. For generative platforms it usually is not, because a release covers a shoot that happened while a generation platform produces images nobody has seen yet. What underwriters want to see is that the release's limits are enforced at the moment of production, and that you can map any individual output back to the permission that authorised it.

How quickly do we need to produce consent records on request?

Assume days, not weeks, and assume the request arrives with a deadline attached rather than as an opening conversation. Acquirers escalate quickly because their own network deadlines are short. A platform that has to run a manual investigation to answer will usually miss the window even when the answer would have been favourable.

What actually happens if we fail an acquirer review?

Typically a graded sequence: a remediation notice with a deadline, then a rolling reserve or raised fees, then termination and a listing on the terminated merchant file, which makes finding a replacement acquirer materially harder. The intermediate steps are recoverable. The last one shapes the next two years of the business.

Does using a payment facilitator remove this obligation?

No, it moves it. The facilitator carries the network relationship and passes the requirements down to you, usually as contract terms that are stricter than the network rules because the facilitator is managing its own portfolio risk. You get a faster start and a less forgiving counterparty.

Academy6 August 20266 min read

Card Network Consent Rules: A Practical Guide

Visa and Mastercard require documented consent and age checks for adult content. What to build so your acquirer stays happy and you keep processing.

By LikeWard Compliance Desk

Paperwork and a pen on a desk, representing the documented consent card network consent rules require

Photo via Unsplash

Regulators can fine you. Card networks can switch you off. That asymmetry is why card network consent rules deserve more engineering attention than they usually get, and why platforms that treat consent as a legal formality tend to discover the problem at the worst possible moment — during an acquirer review, with a deadline.

This guide covers what the networks actually require, what "documented consent" means when the content is generated rather than filmed, and how to build a record you can produce in minutes. It reflects how LikeWard's provenance manifest is designed, which is to say: designed to survive this specific conversation.

Key takeaways

Networks require documented consent from every identifiable person, plus verified age, before adult content can be processed.

A signed release is not the same as enforcement — a release is a promise, a boundary set is a control.

The artifact you need maps each output to the permission that authorised it.

Loss of processing is faster and more terminal than a regulatory fine.

The same record satisfies Ofcom, the FTC and your acquirer. Build it once.

What's covered

Why the networks care
What the rules require
What "documented consent" means for generated content
Building a consent artifact
Surviving an acquirer review
A worked example
Common failure modes

Why the networks care

Payment networks are not moral arbiters, whatever the press coverage suggests. They are risk managers with an unusually direct enforcement mechanism.

Their exposure is chargebacks, brand damage and litigation. Non-consensual content generates all three, and the third has been getting more expensive. So the networks pushed the cost back down the chain: acquirers must underwrite adult-content merchants more carefully, and merchants must demonstrate controls.

Mastercard's specialty merchant registration requirements for adult content platforms — in force since 2021 — set the pattern the industry now follows: documented consent from every person depicted, verified age, pre-publication review, a working complaints process, and removal within a stated window. Visa's requirements for the same merchant category run in parallel. Both have been tightened since.

What the rules require

Reduced to what you must build:

Consent from every identifiable person, documented and retrievable.
Age verification of the depicted person and, separately, of the purchaser.
Content review before publication, not only in response to reports.
A complaints process reachable by people who are not customers.
Removal within a stated window, evidenced.
Records produced on request.

The same expectations appear in the statutory regimes: the Online Safety Act 2023, overseen by Ofcom, and the TAKE IT DOWN Act, enforced by the FTC.

Read that list next to the UK Online Safety Act duties and the TAKE IT DOWN Act's removal duty. It is very nearly the same list. Three institutions with different motives converged on the same requirements, which is a strong hint about what to build first.

Here is where the traditional model breaks.

For a photoshoot, documented consent is a release signed on the day, covering images that already exist. Finite set, known content, signature on file.

For a generation platform, the images do not exist yet. There may be thousands. Nobody has seen them. A release saying "I consent to images of me being produced and sold" documents almost nothing useful — it cannot tell an acquirer whether a specific image was within scope, because scope was never expressed in a form anything could check.

What works instead is a two-part record:

A boundary set — the permission, as structured data: permitted contexts, forbidden depictions, realism ceiling, version number, timestamp.
A provenance manifest on every output — naming the creator, the exact boundary-set version it was authorised under, the requester, and when.

Together they answer the underwriter's real question, which is not "did she consent?" but "was this particular image within what she consented to, and can you show me?"

Property	Why an underwriter asks	Weak answer	Strong answer
Identity of the depicted person	Confirms consent came from the right person	"Creator account"	Verified identity evidence recorded at activation
Scope of permission	Was this image inside it?	A PDF release	Machine-readable boundary set, versioned
Which version applied	Rules change over time	"Current terms"	Version stamped on each output
Purchaser age	Networks require it	Self-declared	Verified before generation, fail-closed
Withdrawal	Can consent be taken back?	"We stop new content"	Outstanding licences marked revoked
Retrieval speed	Deadlines are short	Manual search	Single endpoint lookup

Table: the six properties an acquirer review tends to probe, and what separates an answer that satisfies it from one that prolongs it.

The retrieval row is the one teams underestimate. Having the data and being able to produce it inside a deadline are different capabilities, and only the second one counts.

Surviving an acquirer review

Reviews arrive unannounced, often after a chargeback spike or a press story about someone else. What gets asked, roughly in order:

"Show me your consent records for these five pieces of content." They pick the content. If your answer requires a database migration, you have already failed.

"How do you prevent prohibited content?" The answer they want is a control that runs before production. "We remove it when reported" is a moderation policy, not a control.

"How fast do you remove on request?" State the window, then show timestamps proving you have met it. The FTC-enforced 48-hour standard is the number most reviewers now anchor on.

"What cannot be produced on your platform at all?" A short list of categories nobody can enable answers this cleanly. On LikeWard that is the four non-waivable prohibitions, evaluated before creator rules and before the age gate.

"Who verified the depicted person?" Creator activation should be gated on recorded identity evidence. If a profile can go live without it, that is the finding.

A worked example

A mid-sized platform gets a review after a chargeback spike. It has model releases for every creator — genuinely, all of them, properly signed.

The reviewer picks six images and asks which release covers each. The releases are generic grants covering "content produced on the platform". They cannot say whether image four, which depicts a context one creator had verbally asked to avoid, was in scope. Nobody wrote the request down anywhere a system could read it.

The platform is not accused of anything. It simply cannot demonstrate the control. It gets a remediation notice, a rolling reserve, and ninety days.

Now run the same review against a versioned boundary set plus per-output manifests. Six lookups. Each returns the creator, the version, the permitted contexts under that version, the requester's verification state, and the timestamp. Image four was refused and never produced, and the refusal is logged with the rule it broke.

Same underlying good intentions. Completely different afternoon.

Common failure modes

Treating the release as the artifact. It documents willingness, not scope.

Verifying the purchaser but not the creator — or the reverse. Both are required, for different reasons.

A takedown queue nobody can action. We found exactly this in our own hardening pass: a queue that could accept reports but had no resolution path. Accepting a report is not the duty; resolving it is.

Revocation that only stops future output. If already-issued content still resolves as authorised, your withdrawal is cosmetic — and an underwriter will spot it in one query.

Different rules on the API than on the website. Whatever the site claims, the loosest path is your actual policy. LikeWard runs one evaluation across web, API and MCP, and we test refusals from each.

Waiting for the review to build any of this. Ninety days is not enough time to retrofit consent records onto content that already exists.

Related: the UK Online Safety Act deep-dive, the TAKE IT DOWN Act compliance guide, and content provenance explained for the technical shape of the record itself. Creators wondering what this means for them should read how to license your likeness.

Frequently asked questions

Do card network consent rules apply if our content is not explicit?: The registration programmes are triggered by content category, so a strictly non-explicit platform usually sits outside them. The consent expectation, though, has broadened well past explicit material: acquirers underwriting any platform that depicts identifiable real people increasingly ask how consent is recorded, because their own risk models have caught up with deepfake litigation. Expect the question even if the formal programme does not apply.
Is a signed model release enough documented consent?: For traditional production, often yes. For generative platforms it usually is not, because a release covers a shoot that happened while a generation platform produces images nobody has seen yet. What underwriters want to see is that the release's limits are enforced at the moment of production, and that you can map any individual output back to the permission that authorised it.
How quickly do we need to produce consent records on request?: Assume days, not weeks, and assume the request arrives with a deadline attached rather than as an opening conversation. Acquirers escalate quickly because their own network deadlines are short. A platform that has to run a manual investigation to answer will usually miss the window even when the answer would have been favourable.
What actually happens if we fail an acquirer review?: Typically a graded sequence: a remediation notice with a deadline, then a rolling reserve or raised fees, then termination and a listing on the terminated merchant file, which makes finding a replacement acquirer materially harder. The intermediate steps are recoverable. The last one shapes the next two years of the business.
Does using a payment facilitator remove this obligation?: No, it moves it. The facilitator carries the network relationship and passes the requirements down to you, usually as contract terms that are stricter than the network rules because the facilitator is managing its own portfolio risk. You get a faster start and a less forgiving counterparty.