Dating Compliance Checklist

Ofcom requires highly effective age assurance for services likely to be accessed by children, including dating services hosting adult content.

Article 28 of the Digital Services Act requires platforms accessible to minors to put privacy, safety and security measures in place.

COPPA prohibits collecting personal data from US children under 13 without verifiable parental consent. Dating products should hard-block.

Self-declared age does not meet UK or EU standards for adult-content services. Use a regulated verification provider.

Members must know what you collect, why, the legal basis, who you share with, and how long you keep it.

Contract, legitimate interests, consent or legal obligation. Marketing email needs consent; profile matching is contract.

Hosting, email, analytics, payments and moderation vendors are all processors. No DPA, no GDPR compliance.

SCCs, IDTA or an adequacy decision must be in place for any transfer to a third country, with supplementary measures documented.

If you sell or share data, run targeted ads or hit state thresholds, you need a Do Not Sell link, opt-out signals and consumer rights workflows.

Members can request deletion, regulators ask how long you keep what. Default to delete unless you can justify keeping it.

Most regimes require notification of a personal data breach within 72 hours. Rehearse before you need it.

Non-negotiable across every regime. Friction here turns into churn and complaints.

UK OSA, EU DSA and US notice-and-takedown regimes all require a clear path for reporting and removing illegal content.

Members need to know the rules. Regulators check you publish them.

EU DSA Article 15 mandates them for in-scope platforms. UK OSA and US states are headed the same way.

You need a defined channel, a way to verify the request, and a log. Otherwise you risk over- or under-disclosing.

Standard processors quietly off-board dating businesses. Use a specialist who has underwritten you up front.

Visa and Mastercard place dating in a monitored category. Sustained excessive chargebacks trigger fines and termination.

California ARL, FTC ROSCA, EU UCPD and UK CPRs all require clear up-front and pre-renewal notice plus easy cancellation.

Romance fraud and AML risk rises with paid features. Document your screening for higher-tier accounts.

UK ad standards are strict on dating, especially around body image, sexual implication and unrealistic outcomes.

Earnings claims, testimonial use and "free" framing have all triggered enforcement actions in dating.

Pre-consent tracking pixels are the single most common GDPR fine for ad-funded sites.

Account termination, fake profile rules, off-platform contact, IP licence, refund position. Generic SaaS templates leave you exposed.

Members need to know what is allowed before they post, not after you ban them.

EU and UK distance-selling rules grant statutory cancellation windows. Subscription dark patterns trigger regulator action.