We asked a UK law firm to review how we handle model consent
Every marketplace handling work that features identifiable people eventually faces the same question: not did you get a release? but can you produce it, and does it prove what you think it proves? Rather than answer that ourselves, we instructed an independent UK law firm to look at how consent actually works on BentBox. This is what they examined, what they found, and the one change we made as a result.
Why we commissioned a review, and why in the UK
Consent infrastructure is easy to describe well and hard to assess from the inside. We had rebuilt how model consent is captured on BentBox, and we wanted someone with no stake in the outcome to tell us whether the rebuild held up — including in the places where it might not.
We chose UK counsel for two reasons. The first is the Online Safety Act, which imposes duties on platforms carrying adult content that go well beyond anything the equivalent EU instruments require on the same facts. If a consent process is going to be tested anywhere, it will be tested there first. The second is portability: UK GDPR is the retained text of the EU GDPR, and while the two regimes have begun to diverge under the Data (Use and Access) Act 2025 — mostly in the UK's favour on cookies, subject access and automated decisions — the core principles, lawful bases and rights remain substantially aligned, and the European Commission renewed UK adequacy in December 2025. A conclusion reached under UK GDPR on the parts that matter here still means something to a reader in Amsterdam or Madrid.
We have chosen not to name the firm. The advice was commissioned as a private consultation on BentBox's own legal position, not as a public assessment of a product, and we are not publishing it. What follows are the operational findings that bear on how consent works here, in our words.
The gap between a promise and a record
The industry default for decades has been the photographer-supplied model release. A creator uploads work, ticks a box confirming they hold a signed release, and warrants that everyone depicted is an adult who agreed to the publication. The platform files the warranty and moves on.
That model works until it is tested. A warranty is a contractual promise about something that happened somewhere else, between people the platform never met, on terms the platform never saw. It allocates blame well. What it does not do is answer the question that actually gets asked in a complaint, a chargeback, an app store review or a supervisory authority enquiry: show us the consent.
At that point the difference between holding a promise and holding a record stops being philosophical. Documents can be stored without ever being verified, and "we have a release on file" and "we can demonstrate that the person in this image consented to this image" are not the same statement.
How a ProntoTag is created
Five stages sit between a creator tagging a model and BentBox holding a record it could produce on request. The order matters: each stage constrains the next.
The creator tags the model
When a creator uploads work, they tag each identifiable person in it. The tag points at that specific upload, not at the creator's account or their catalogue as a whole.
The model is invited to verify
ProntoID sends the tagged model a link. They present a government photo ID to the camera. The relevant fields are read for verification and the document image is held by ProntoID in an encrypted vault that BentBox cannot reach.
A liveness session confirms who is present
A 3D liveness session matches the person's live face against the photo on the ID, and against the tagged content itself. This closes the gap between "someone signed" and "the person in the work signed".
Both parties sign a standard release
A model release is generated, linked to the verified identity, and signed by both parties. It records the ProntoID user IDs, names and email addresses of the signatories. Both parties keep a copy on their ProntoID dashboard.
BentBox receives the outcome, not the evidence
BentBox is told that a valid release exists between two verified adults, and stores that outcome with its audit metadata. The ID document and biometric data stay with ProntoID.
The last stage is the one platforms tend to underestimate. BentBox deliberately does not take custody of the ID document or the biometric template. Haas & Reed B.V. and Brooks & Keitt Sàrl are separate legal entities and independent data controllers: BentBox holds the verification outcome and its audit metadata, ProntoID holds the underlying evidence. That separation means the platform gains an evidential position without accumulating a vault of passport scans it has no operational reason to hold.
What the review found
The review assessed the process against the accountability requirements that sit at the centre of UK GDPR: that a platform must have a lawful basis for what it does with personal data, that content of this kind is special category data requiring explicit consent, and that the burden of demonstrating that consent falls on the platform rather than on the person who supplied the content.
On that measure the process was found to be robust, and a substantial improvement on what it replaced. The specific features identified as carrying the weight were the ones that convert an assertion into a record: identity verified against a government document rather than asserted by a third party; a liveness check confirming the person signing is the person verified; consent tied to identified content so its scope is unambiguous; a standard release form in place of whatever wording each creator happened to bring; a working route for a model to see where their likeness appears and withdraw it; and secure retention of the underlying evidence away from the platform.
The one change we made
Verifying against the content, not just the ID
The review raised one gap. A liveness session that matches a live face to a government ID proves that the person signing is who they say they are. It does not, on its own, prove that they are the person in the content. Those are different claims, and only the second one is the claim a consent record needs to support.
We have since closed that gap. The liveness session now also matches against the tagged content itself, so a ProntoTag records that the person who consented is the person depicted — not merely someone holding a valid ID. It is the least visible change described on this page and the most important one.
What this changes
The benefits land differently depending on which side of the upload you sit on.
For the platform
- An answer to "produce the consent." Verification outcomes are queryable per item, not scattered across creator correspondence.
- Consistent release terms. One standard form replaces however many variants creators bring with them, so the platform knows what its records actually say.
- Withdrawal that works. A defined route from a model's dashboard to content coming out of sale, instead of an email to support and a manual hunt.
- Less sensitive data on the platform. Identity documents stay with a separate controller built to hold them.
- Cleaner moderation. Reviewers see whether a tag is verified rather than guessing from file names and creator history.
For creators and models
- No paperwork custody. Creators stop being the archivist for other people's identity documents, which is a liability most photographers never asked for.
- Faster review. A verified tag removes the most common reason an upload sits in the moderation queue.
- Models see what they signed. Consent is given against the actual images, not a description of a shoot from three months earlier.
- A real withdrawal mechanism. Models keep visibility of where their likeness is published and can act on any individual item.
- Trust that travels. A verified release is easier to point at when a model is deciding whether to work with a creator again.
What ProntoTag does not do
Scope, stated plainly
A ProntoTag is verified proof that an identity-checked adult consented to a specific piece of content on specific terms. It is not a warranty that the content is authorised for every downstream use, that the creator holds every other right in the work, or that every person appearing in a frame has been tagged. Those remain the creator's responsibility.
Nor does any verification product decide a platform's obligations for it. Data protection duties attach to the platform because of what the platform does with the data, and no vendor can assume them on its behalf. What good consent infrastructure changes is whether the platform is in a position to meet those duties with evidence rather than assurances.
A legal review does not change that either. It is a considered opinion at a point in time, on a process as it stood when it was examined, under one jurisdiction's law. It is not a certificate, it does not bind a regulator, and it does not transfer to anyone else running similar tooling in a different way. We commissioned it because we wanted to know, not because it settles anything permanently.
Frequently asked questions
Bring verified consent to your own uploads
ProntoTag is available to BentBox creators from the upload flow. Tag the people in your work, and they are invited to verify and sign before the content goes live.
Start an upload How ProntoID works