Legal references

This page lists the laws and payment processor rules behind the Crestfall Studio policies, grouped by country. Each entry names the rule, says in one plain sentence what it asks of Crestfall Studio, and links to its primary source: the statute, the official journal or the regulator's own page.

This page is a reference to help you find the underlying rules, and it is not legal advice.

United States

Federal

• 18 U.S.C. 2256, definitions for child sexual exploitation offenses. Federal law defines a minor as anyone under 18 and reaches computer generated images that are indistinguishable from a real minor or altered to show an identifiable minor; the first absolute in the Crestfall Studio content policy goes further and bars any sexual or suggestive content involving a character who is or appears under 18, in text or in images. 18 U.S.C. 2256
• 18 U.S.C. 2257 and 2257A, record keeping for sexually explicit depictions. These sections require producers of visual depictions of actual or simulated sexually explicit conduct to verify and record the age and identity of each real performer; Crestfall Studio makes no such depictions, because its images never show nudity or sexual acts, no real performers appear in them, and written text is not a visual depiction. 18 U.S.C. 2257 and 18 U.S.C. 2257A
• 18 U.S.C. 2258A, reporting duties of providers. Crestfall Studio must report apparent child sexual abuse material it becomes aware of to the CyberTipline run by the National Center for Missing and Exploited Children and preserve the reported contents for one year after the report. 18 U.S.C. 2258A
• TAKE IT DOWN Act, 47 U.S.C. 223a. Since 2026-05-19, a public platform that mainly hosts content posted by its users must run a notice and removal process for intimate images published without the consent of the person shown, including AI made forgeries, and remove a reported image and any known identical copies within 48 hours of a valid request, with the Federal Trade Commission enforcing the duty. 47 U.S.C. 223a
• DMCA notice and takedown, 17 U.S.C. 512. A platform keeps its safe harbor from copyright liability for material its users post only if it registers a designated agent with the Copyright Office, removes material promptly on a valid notice, handles counter notices as the statute sets out, and ends the accounts of repeat infringers. 17 U.S.C. 512 and the Copyright Office designated agent directory
• Restore Online Shoppers' Confidence Act, 15 U.S.C. 8403. For any paid plan sold online that renews and charges automatically, Crestfall Studio must disclose all material terms before taking billing details, get the buyer's express informed consent before charging, and offer a simple way to stop recurring charges. 15 U.S.C. 8403

State

• California SB 243, companion chatbots, Business and Professions Code 22601 and following. Since 2026-01-01, Crestfall Studio must tell users plainly that characters are AI where a reasonable person could be misled, run a protocol that refers a user who expresses suicidal ideation or self harm to crisis services, publish that protocol on its website, and from 2027-07-01 report on it each year to California's Office of Suicide Prevention. SB 243, chaptered text
• New York General Business Law Article 47, AI companion models. Since 2025-11-05, an operator of an AI companion must run a protocol that detects expressions of suicidal ideation or self harm and refers the user to crisis services such as 988, and must tell the user they are not talking with a human at the start of an interaction and at least every three hours during a continuing one. New York S3008C, Part U, as enacted
• California automatic renewal law, Business and Professions Code 17600 and following. Crestfall Studio must state automatic renewal terms clearly before a paid plan starts, get the buyer's affirmative consent to those terms, send an acknowledgment that explains how to cancel, and let a subscriber who signed up online cancel online; several other states have similar automatic renewal laws. Business and Professions Code 17600 to 17606

Germany

• Jugendmedienschutz-Staatsvertrag (JMStV). Germany's interstate treaty on youth media protection requires that pornographic content online be available only to a closed user group of verified adults, that other content unsuitable for minors be kept from them, for example with an age label a recognized youth protection program can read, and that a commercial provider of such content name a youth protection officer or entrust that task to a recognized self-regulation body. JMStV text, published by the KJM
• JusProg age label. JusProg is a youth protection program recognized under the JMStV that reads an age-de.xml label on a website, and labeling Crestfall Studio 18 lets JusProg block it for younger users, which meets the treaty's duty for content unsuitable for minors but does not replace the closed user group the treaty requires for pornographic content. Webseite labeln, JusProg
• Netzwerkdurchsetzungsgesetz (NetzDG) and Digitale-Dienste-Gesetz (DDG). Most of the NetzDG's duties for platforms were repealed when the Digital Services Act took over the field, and the DDG now carries out the DSA in Germany, naming the Bundesnetzagentur as the main regulator and the federal youth media protection agency for certain child safety duties. NetzDG and DDG
• § 5 DDG, Impressum. A commercial digital service offered in Germany must keep its provider details, including name, postal address and a fast electronic contact, easy to find and always available. § 5 DDG
• § 312g BGB, Widerrufsrecht. A consumer in Germany who buys online has a right to withdraw from the contract. § 312g BGB
• § 355 BGB, withdrawal period. The withdrawal right lasts 14 days, needs no reason, and is exercised by a clear statement to the seller. § 355 BGB
• § 356 BGB, withdrawal for digital content. For digital content not supplied on a physical medium, the withdrawal right ends early only if the buyer expressly agreed to immediate supply, confirmed knowing this ends the right, and received a confirmation of the contract, and supply has begun. § 356 BGB
• § 312j BGB, Button-Lösung. The final button on a paid checkout must read "zahlungspflichtig bestellen" or an equally clear phrase, and without it no contract forms, which is why the German checkout button reads "Zahlungspflichtig bestellen". § 312j BGB
• § 312k BGB, Kündigungsbutton. Where a paid plan can be taken out on a website, a consumer in Germany must be able to cancel it there through a clearly labeled cancellation button, such as "Verträge hier kündigen", that leads straight to a confirmation page. § 312k BGB
• Bundesdatenschutzgesetz (BDSG). The GDPR applies directly in Germany, and the BDSG adds the national rules the GDPR leaves to member states, such as when a company must appoint a data protection officer. BDSG
• § 25 TDDDG, cookies and device storage. Storing or reading information on a user's device needs the user's informed consent unless it is strictly necessary to provide the service the user asked for, which is the rule behind the consent banner that runs before analytics for users in the European Union. § 25 TDDDG

European Union

• Digital Services Act, Regulation (EU) 2022/2065. As a hosting service, Crestfall Studio must publish points of contact for users and authorities, run a notice and action process for illegal content, send a statement of reasons for each moderation decision, and inform authorities of information suggesting a criminal offense that threatens a person's life or safety. Regulation (EU) 2022/2065, Official Journal text
• General Data Protection Regulation, Regulation (EU) 2016/679. Crestfall Studio must have a legal basis for each use of the personal data of people in the EU, explain how it uses that data, and honor their rights to access, correct, delete and port their data and to object. Regulation (EU) 2016/679, Official Journal text
• Consumer Rights Directive, Directive 2011/83/EU. The directive sets the EU-wide rules that German law carries out: clear information before an online purchase, an order button that states the duty to pay, and a 14-day withdrawal right that, for digital content, ends early only with the buyer's express consent and acknowledgment. Directive 2011/83/EU, Official Journal text
• AI Act, Regulation (EU) 2024/1689, Article 50. Since 2026-08-02, an AI system built to interact with people must be designed so that they are told they are interacting with AI, unless that is obvious from the context. Regulation (EU) 2024/1689, Official Journal text

Payment processor rules

• Stripe prohibited and restricted businesses. Stripe does not serve businesses selling pornography or other mature audience content, including literature, imagery and AI generated content, designed for the purpose of sexual gratification, and Crestfall Studio's payment account depends on staying outside that line. Stripe prohibited and restricted businesses list