Three days ago, the European Commission dropped a bomb: Pornhub, Stripchat, XNXX, and XVideos are in preliminary breach of the Digital Services Act. The charge? Failing to protect minors from accessing pornographic content. Potential fines up to 6% of global annual turnover.
The investigation started in May 2025. Ten months later, the Commission's conclusion is blunt: all four platforms rely on self-declaration — a "click here to confirm you're 18" button — and the EU considers that worthless. Content warnings, page blurring, "Restricted to adults" labels — none of it counts as an effective measure under the DSA.
But here's what caught my attention. The EU is focused on who accesses these sites. Nobody's asking what these sites collect from the people already using them.
I have that data.
What Blacklight Found on All Four Sites
I run a project called NSFWRanker where I scan adult sites with The Markup's Blacklight tool — the same privacy inspector built by investigative journalists. It detects third-party trackers, cookies, canvas fingerprinting, session recording scripts, and keystroke capture.
Here's what the scans show for the four EU-targeted platforms:
Pornhub — 2 third-party trackers, 0 cookies. No fingerprinting. No session recording. No keystroke capture. Owned by Aylo (Cyprus). The scan looks reasonable on paper, but Aylo operates 13 properties as a first-party data network. Cross-site profiling that Blacklight can't measure.
Stripchat — 0 trackers, 0 cookies. Nothing. Clean across the board. This is a live cam platform with millions of daily users and it runs a tighter ship than most news websites. Also Cyprus-based (Technius Ltd).
XNXX — 0 trackers, 0 cookies. Zero everything. The largest free tube by video count, owned by WGCZ (Czech Republic), and one of the cleanest scans in my entire dataset of 1,000+ sites.
XVideos — 1 tracker, 0 cookies. Sister site to XNXX, same parent company. Nearly identical clean profile. One tracker is marginal noise.
The Irony Nobody's Talking About
The EU wants these four platforms to implement "privacy-preserving age verification." The Commission is even building an EU Age Verification app with pilot programs in six member states including Denmark and France.
But look at the scan data. These four sites are already among the cleanest major adult platforms on the internet. Stripchat and XNXX run zero trackers. Zero cookies. That's cleaner than CNN, cleaner than WebMD, cleaner than most EU government websites.
Meanwhile, sites that aren't on the EU's radar are running 7, 15, even 56 third-party trackers. One adult search engine I scanned records every keystroke users type — including fetish searches. A network of 9 sites owned by the same UK company records full browsing sessions. Several platforms use canvas fingerprinting to track users across devices, even in incognito mode.
The EU caught the big fish for the wrong thing while the small fish do the real damage unnoticed.
Age Verification Creates New Privacy Risks
XVideos responded to the Commission's findings by saying the EU was "asking us to commit suicide for nothing" — that age checks would push users to unregulated sites outside EU jurisdiction. It's a self-serving argument, but the underlying concern about age verification privacy is legitimate.
We've already seen what happens when age verification vendors handle sensitive data. Persona — the vendor used by Discord, OpenAI, and Roblox — had 2,500 verification files found on a government server earlier this year. The system ran 269 surveillance checks including facial recognition, PEP screening, and terrorist watchlist queries. All of it stored. 419 cybersecurity professors from 30 countries signed an open letter against it.
Requiring age verification on sites that already collect zero trackers could paradoxically make users less private, not more.
What the Data Actually Shows
After scanning 1,000+ adult sites, the pattern is clear:
The biggest platforms tend to be the cleanest. They have legal teams, compliance departments, and enough visibility that they can't afford to deploy aggressive tracking.
The real surveillance happens on mid-tier and small sites that nobody regulates and nobody scans. Sites where the operator is a shell company in Panama or a network of entities registered across three jurisdictions. Sites where session recording captures every mouse movement and keystroke capture logs every search query.
The EU is looking at the front door while the backdoor is wide open.
Full privacy scans for all four EU-targeted sites — and 163 others — are at nsfwranker.com. The tracker ranking breaks down the worst and cleanest sites by the numbers.
I scan adult sites for trackers, fingerprinting, and surveillance scripts using The Markup's Blacklight tool. The data is free, the methodology is public, and nobody pays for rankings. More at nsfwranker.com.
Top comments (0)