A video compliance checklist becomes urgent the moment someone hands you a security questionnaire, a legal team flags an upcoming EU deadline, or a customer's procurement team asks a question your team can't answer cleanly.
Video compliance splits into six domains: viewer privacy, accessibility, AI transparency, content protection, security certification, and sector-specific rules.
This checklist covers what each domain requires of your video hosting, delivery, and publishing setup. It does not replace general corporate compliance work outside video.
By the end, you'll have the exact questions to put to your video platform, plus a downloadable version to keep on hand.
Key Takeaways
- Video compliance splits into six domains: viewer privacy, accessibility, AI transparency, content protection, security certification, and sector-specific rules. Most video-heavy businesses handle one domain well and assume a certified vendor covers the rest.
- The EU AI Act's Article 50 transparency rules apply from August 2, 2026. Deepfakes and AI-generated video need visible disclosure, and marking obligations reach systems already on the market by December 2, 2026.
- The European Accessibility Act has required WCAG 2.1 AA captions and audio description in each market's own language since June 28, 2025, not just in the original production language.
- DOJ pushed ADA Title II web accessibility deadlines for state and local government entities to April 2027 and April 2028. The underlying WCAG 2.1 AA standard did not change, only the enforcement date.
- The proposed HIPAA Security Rule overhaul, including mandatory multi-factor authentication for systems touching health data, is still not final as of mid-2026. The current Security Rule remains in force regardless.
- Roughly half of this checklist is your video platform's job, not yours.
What "Video Compliance" Actually Covers
Video compliance is not one law. It is six separate obligation sets that happen to land on the same asset, and most teams have mapped one or two of them at most.
| Domain | Key regulations | What it requires of your video | Who owns it | Key deadline |
|---|---|---|---|---|
| Viewer privacy | GDPR, CCPA/CPRA, ePrivacy | Consent before analytics, lawful transfer basis, retention limits | Shared | Already in force |
| Accessibility | EAA, ADA, Section 508, CVAA | Captions, transcripts, audio description, accessible player | Shared | EAA since Jun 28, 2025. ADA Title II: Apr 26, 2027 or 2028 |
| Sector-specific | HIPAA, FERPA, COPPA, PCI DSS, UK OSA, DSA | BAAs, age assurance, data handling | Shared | Varies: COPPA Apr 22, 2026. PCI DSS already mandatory. UK OSA already enforced |
| AI transparency | EU AI Act Art. 50 | Label deepfakes, machine-readable marking of synthetic content | You | Aug 2, 2026 (marking grace period to Dec 2, 2026) |
| Content protection | DMCA, licensing terms | DRM, signed URLs, geo-restriction | Platform | No statutory deadline |
| Security | SOC 2, ISO 27001, GDPR Art. 32 | Encryption, access control, breach process | Platform | No statutory deadline |
The "who owns it" column is the part most vendor pages skip. Viewer privacy, accessibility, and sector rules are shared: your platform can supply the technical mechanism, but your organization still has to configure it, disclose it, and answer for it if a regulator asks.
Content protection and baseline security posture sit mostly with the platform. AI transparency sits with you, because the disclosure obligation attaches to whoever publishes the content, not whoever hosts it.
Your video platform can hold the certificate, but it can't hold your consent banner.
The Video Compliance Checklist
Work through each domain in order. Every item below carries a date, an article number, or a named standard, because "comply with GDPR" is not something you can act on, and "report a breach within 72 hours under GDPR Article 33" is.
Viewer Data and Privacy (GDPR, CCPA/CPRA)
GDPR applies to any video hosting platform processing personal data from people in the EU, regardless of where your company is based. CCPA and its update, CPRA, cover California residents on a separate but similar timeline.
If your video player loads before a viewer answers a consent prompt, both frameworks treat the resulting data collection as a live violation, not a technicality.
- Block analytics cookies, fingerprinting scripts, and third-party pixels in your video player until the viewer answers the consent prompt. IP addresses count as personal data under GDPR, so this includes the player's own analytics calls.
- Get a signed Data Processing Agreement from your video vendor, tied to GDPR Article 28, plus a published sub-processor list and a defined notice period for changes to it.
- Confirm which region your video files, thumbnails, and viewer analytics are actually stored in. Gumlet, for example, processes data inside the U.S. for non-EU customers and in Frankfurt for EU customers, per its current privacy policy. Ask your own vendor the same question directly. Don't assume "cloud-based" means "in your region."
- Confirm your transfer basis if viewer data moves to the U.S. The EU-U.S. Data Privacy Framework remains valid as of August 2026: the EU General Court upheld it in September 2025, but French MP Philippe Latombe's appeal is now pending before the Court of Justice of the EU, the same court that struck down both of the DPF's predecessor frameworks.
- Confirm your vendor's breach notification SLA actually supports GDPR Article 33's 72-hour window to the supervisory authority. A vendor that promises to notify you "as soon as possible" has not answered the question.
How to verify: Don't take a compliance page's word for it. Open your video player in a fresh browser session, block third-party cookies, and watch the network tab. If analytics calls fire before you interact with the consent banner, you have your answer regardless of what the vendor's marketing site claims.
If your player loads analytics before the consent banner is answered, you are not GDPR compliant, no matter what your vendor's certificate says.
Accessibility (EAA, ADA, Section 508, WCAG 2.1 AA)
The European Accessibility Act has required WCAG 2.1 AA-level accessibility since June 28, 2025, measured against the harmonized standard EN 301 549. In the U.S., Section 508 and the CVAA cover federal and telecom-adjacent video specifically, while ADA Title II sets separate deadlines for state and local government websites.
- Provide accurate, synchronized captions for every public-facing video, including speaker labels and non-speech audio cues such as [door slams] or [music playing].
- Publish an on-page transcript alongside every video. This does double duty: it satisfies EAA and WCAG requirements, and the same text feeds search and AI-answer extraction. Our complete guide to video SEO covers how transcripts drive both.
- Add audio description wherever visual information isn't already covered by the dialogue track.
- Deliver captions and audio description in the language of each market you serve, not just your original production language. This is the detail most compliance checklists miss: the EAA doesn't require one accessible version of your video. It requires one for each market, in that market's own language.
- Confirm your video player is keyboard-navigable, with screen-reader-compatible controls and visible caption styling options.
- Meet the WCAG 2.1 AA contrast minimum for caption text and player controls: at least 4.5:1 for caption text against its background, and at least 3:1 for large text and for UI elements like play, pause, and volume buttons. A semi-transparent caption box that looks fine in your player preview can still fail this ratio against a bright video frame.
- If you're a true microenterprise, fewer than 10 employees and under €2 million in annual turnover or balance sheet, both conditions required together, the EAA exempts your services specifically, though not any physical products you sell.
- DOJ extended ADA Title II web accessibility deadlines for state and local government entities to April 26, 2027 (populations of 50,000 or more) and April 26, 2028 (smaller entities and special districts). The WCAG 2.1 AA standard itself did not change, only the enforcement date. HHS followed with a matching extension for Section 504-covered healthcare and federally funded entities: May 11, 2027 for organizations with 15 or more employees, May 10, 2028 for smaller ones.
How to verify: don't treat an auto-caption pass as finished work. Manually spot-check timing and speaker labels, and have a native speaker review at least one non-English market's caption file. A caption file that meets German conventions doesn't automatically meet French ones.
Auto-generated captions you haven't reviewed are an accessibility liability, not an accessibility feature.
AI and Synthetic Media (EU AI Act Article 50)
Article 50 of the EU AI Act applies from August 2, 2026, and reaches any business using AI dubbing, AI voice, AI avatars, or AI-edited video for EU audiences, including companies based outside the EU.
The European Commission published its final guidelines on the article on July 20, 2026, confirming the voluntary Code of Practice on Transparency of AI-Generated Content as an adequate route to compliance.
- Disclose deepfake content visibly to viewers. The definition covers AI-generated or manipulated video that resembles a real person, object, or event closely enough to appear authentic. Clearly fantastical or obviously stylized content falls outside it.
- Apply machine-readable marking, watermarking, metadata, or fingerprinting, to AI-generated output at the point it's created, not after the fact.
- Note the two-tier timeline: content generated before August 2, 2026 doesn't need retroactive labeling, but systems already on the market must meet marking and detection requirements by December 2, 2026.
- Consider signing the EU's Code of Practice on Transparency of AI-Generated Content. It's voluntary, but the Commission and the AI Board have confirmed it as an adequate way to demonstrate Article 50 compliance, and roughly 190 organizations had signed by the end of July 2026.
The number: Penalties reach €15 million or 3% of global annual turnover, whichever is higher, with the lower of the two applying to SMEs and startups, under Article 99 of the regulation.
How to verify: Map every AI touchpoint in your video pipeline first, research, scripting, voice-over, captioning, translation, avatars, before deciding what needs labeling. Most teams discover the AI Act question the first time legal asks which tools touched a specific video, not before.
If a human didn't say it and a viewer can't tell, you have to tell them.
Content Protection and Rights
This is the domain your video platform mostly owns, but "mostly" is doing real work in that sentence. You still choose what to turn on.
- Confirm which DRM systems your platform supports and at which plan tier. Widevine and FairPlay cover Chrome, Android, Safari, and Apple devices between them; PlayReady adds specific desktop and smart-TV coverage. Gumlet, for example, issues Widevine and FairPlay credentials automatically to new signups, with video DRM available as a $99 per month add-on. The five-video free ceiling applies across every plan, including paid tiers, not just free and entry-level ones.
- Use signed or expiring URLs, domain allowlisting, and geo-restriction for anything that shouldn't be publicly indexable. An "unlisted" video is not a security control.
- Add forensic or dynamic watermarking for high-value catalogs such as paid courses, OTT libraries, or pre-release content, where a single leak carries a real dollar cost.
- Maintain a documented DMCA takedown process and a designated agent if you host any user-uploaded video.
- Confirm your music and stock footage licenses actually cover the territories and distribution channels you're using now, not only the ones you had in mind when you licensed them.
How to verify: Ask your vendor to show, not describe, each control. A vendor that can produce a signed URL on request and show you its expiry window has answered the question. A vendor that says "enterprise-grade security available" has not.
Access control is a compliance control. "Unlisted" is not a security model.
Security and Certifications
- Ask for SOC 2 Type II specifically. Type I only confirms controls existed on a single date; Type II confirms they operated correctly over a review period, which is the signal enterprise buyers and auditors actually want.
- Confirm ISO 27001 (and ISO 42001 if AI features are in scope) with a current certificate date, not a badge with no expiry shown.
- Confirm encryption in transit and at rest, plus how encryption keys are managed and rotated.
- Confirm SSO/SAML support, SCIM provisioning, role-based access control, and audit logging on admin actions.
- Ask about penetration test cadence and whether a redacted report is shareable under NDA.
- Check the sub-processor list itself, not just the existence of one. Gumlet's public Trust Center, for example, lists ISO 27001:2022 and SOC 2 documentation and names specific sub-processors with their locations, including Intercom, Mixpanel, MongoDB, and Cloudflare in the U.S. and Stripe in Singapore. That level of specificity is what a real trust page looks like, versus one that just says it takes security seriously.
Insider take: A SOC 2 badge with no visible date is the single most common thing that looks like proof and isn't. Always ask for the audit period.
If you're comparing platforms for a compliance-heavy enterprise deployment specifically, our breakdown of VdoCipher alternatives covers how Gumlet, Brightcove, and other enterprise-tier platforms stack up on exactly this.
This article maps legal obligations. For the technical counterpart, a walkthrough of access control, encryption, and DRM configuration mapped to your own infrastructure rather than to a regulation, check out our secure video hosting checklist.
How to verify: Ask for the actual report and read the scope statement, not just the certification name. A SOC 2 badge tied to a 2023 audit window, or a certificate that carves out the specific product you're buying, is a logo, not a control.
Sector and Content-Specific Rules
These rules apply narrowly, but they apply hard when they do.
- HIPAA: If your video contains protected health information, you need encryption, role-based access, audit logging, and a signed Business Associate Agreement with any vendor touching that footage. HHS proposed a major HIPAA Security Rule overhaul in January 2025, including mandatory multi-factor authentication for systems handling health data, but as of mid-2026 it remains a proposed rule. The Office of Management and Budget's own timeline has pushed final action to July 2027. Nothing has changed yet. The current Security Rule still governs, and OCR is actively enforcing it in the meantime.
- FERPA: The law doesn't specifically address video, so it falls back to the general education-record test. A recording is only a protected education record if it directly relates to an identifiable student and is maintained in that student's file. A whole-class lecture recording usually isn't one; a recording kept as part of a disciplinary record is.
- COPPA: Amendments took effect June 23, 2025, with most substantive requirements enforceable from April 22, 2026, adding stricter parental consent and data-retention rules for child-directed content. The FTC has already enforced this against video specifically: in September 2025, Disney agreed to pay $10 million to settle allegations that it collected data from children watching child-directed videos on YouTube without parental notice or consent, an agreement a federal judge approved that December.
- PCI DSS: If you take payments for video access, pay-per-view, subscriptions, or paid courses, PCI DSS 4.0.1 is now the only active version, and every previously "future-dated" requirement became mandatory on March 31, 2025. There's no remaining grace period.
- UK Online Safety Act: Age assurance duties for platforms hosting adult or otherwise harmful content became enforceable July 25, 2025, with penalties up to £18 million or 10% of global qualifying revenue.
- EU DSA: The Digital Services Act has applied to all in-scope platforms since February 17, 2024, and to designated Very Large Online Platforms since August 2023. If you operate a video-sharing platform carrying user-generated content, expect notice-and-action mechanisms, complaints handling, and minor-protection obligations layered on top of everything above. Penalties reach 6% of global annual turnover.
How to verify: Don't assume a general SOC 2 or GDPR posture covers sector rules by default. Ask your platform which of these it has a signed agreement or documented control for, by name, not which ones it "supports."
A vendor that says "we are compliant" has told you nothing. A vendor that names the exact agreement, standard, or BAA has told you everything.
What to Ask Your Video Platform
Shared responsibility means your vendor's answer is half of your actual compliance posture. Ask these directly, and treat a vague answer as a real answer: it tells you the control probably doesn't exist yet.
| Question to ask | A good answer looks like |
|---|---|
| Where is viewer analytics data stored, and can we pick the region? | Names specific regions and lets you choose. "Globally distributed" is not an answer. |
| What's in your sub-processor list, and how do you notify us of changes? | A public, named list with locations and a defined notice window |
| Do you have a signed DPA covering our account? | Yes, available on request or self-serve, referencing GDPR Article 28 directly. |
| What's your breach notification SLA? | A specific number of hours that supports GDPR Article 33's 72-hour clock. |
| Which DRM systems do you support, and at which plan tier? | Names Widevine, FairPlay, or PlayReady explicitly, plus the exact tier or add-on cost. |
| Can we see your current SOC 2 report and its audit period? | The actual report or a recent summary with a current audit window. |
| Do you deliver captions and audio description per market, or one language track for everyone? | Confirms multi-language, per-market delivery. Assuming English captions cover every market is a red flag. |
| What happens if we exceed your DRM or storage limits mid-cycle? | A specific number and a defined next step, not "contact sales." |
| Do you have a BAA available for HIPAA-covered content? | Yes, named explicitly, usually gated to specific plans. Silence means ‘No.’ |
For a direct answer on most of these without waiting on a sales call, Gumlet's Trust Center publishes its current certifications and sub-processor list.
If you'd rather work from a CEO-level version of this conversation instead of the compliance-specific cut, we've also published a video security audit checklist built for that framing.
How to Start This
Audit one domain before you try to audit everything.
- Identify which jurisdictions and audiences your video actually reaches. A U.S.-only SaaS product with zero EU traffic has a different starting point than one selling into Germany and France.
- Pick the domain with the nearest hard deadline that applies to you. For most video businesses right now, that's either the EU AI Act (August 2, 2026) or EAA per-market captioning, both already enforceable or about to be.
- Inventory your existing video library against that one domain first. Don't try to check six boxes across every video you've ever published in a single pass.
- Fix new content going forward immediately, then backfill the highest-traffic 20% of your existing library rather than trying to touch everything at once.
- Set a six-month re-review. Every domain in this checklist moves fast enough that a "done" checklist from a year ago isn't a current one.
If you're building this out for a larger deployment, our enterprise video hosting page covers procurement and rollout considerations beyond compliance specifically.
Frequently Asked Questions
1. What is video compliance?
Video compliance is the set of legal and technical obligations that apply to hosting, delivering, and publishing video, spanning six areas: viewer privacy, accessibility, AI transparency, content protection, security certification, and sector-specific rules like HIPAA or COPPA. No single regulation covers all six.
A platform that's GDPR compliant hasn't automatically met accessibility or AI Act requirements, and treating one as a stand-in for the rest is the most common gap teams carry into an audit.
2. Does GDPR apply to embedded video?
Yes, if the video player or its analytics collect any personal data from EU-based viewers, including IP addresses, which count as personal data under GDPR regardless of whether a name or email address is involved. An embedded video that loads a third-party analytics script before the viewer consents is processing personal data without a lawful basis.
The fix is blocking that script until consent is given, not switching to a stripped-down embed mode and assuming that alone solves it.
3. Are captions legally required?
Yes, for most public-facing video reaching the EU or served through platforms covered by US accessibility law. The European Accessibility Act has required synchronized, accurate captions since June 28, 2025, and U.S. laws including Section 508 and the CVAA require them for federal and certain broadcast-adjacent content.
Auto-generated captions that haven't been manually reviewed for accuracy and speaker labeling don't reliably satisfy either standard, even though many teams treat them as sufficient.
4. Do I have to label AI-generated video in the EU?
Yes, starting August 2, 2026, under Article 50 of the EU AI Act, if the content qualifies as a deepfake or otherwise AI-generated content resembling a real person or event. The obligation applies to providers and deployers based anywhere, not only companies headquartered in the EU, as long as the content reaches EU audiences.
Clearly fantastical or obviously stylized AI content falls outside the definition, but content designed to appear authentic does not.
5. Is my video platform responsible for compliance, or am I?
Both, depending on the domain. Content protection and baseline security posture are mostly your platform's responsibility, while AI transparency labeling and consent-banner configuration are yours regardless of which platform you use.
Viewer privacy, accessibility, and sector-specific rules like HIPAA are shared: the platform supplies the technical mechanism, but your organization configures, discloses, and answers for it. Assuming a certified vendor closes every gap is the single most common mistake in this checklist.
6. What certifications should an enterprise video platform have?
At minimum, SOC 2 Type II and ISO 27001, both with a current audit or certification date you can verify directly rather than a badge alone. Regulated industries add HIPAA business associate agreements, ISO 42001 if the platform uses AI features, and GDPR-specific documentation including a signed DPA and sub-processor list.
Ask to see the actual report and its scope statement. A certification that excludes the specific product you're buying is more common than most buyers expect.
7. Is HIPAA-compliant video hosting a real thing?
Yes, but it requires more than a vendor's marketing claim. A HIPAA-eligible video setup needs encryption in transit and at rest, role-based access control, audit logging, and a signed Business Associate Agreement with the vendor, usually available only on specific enterprise plans.
As of August 2026, the proposed HIPAA Security Rule overhaul that would tighten these requirements further is still not final, so the current Security Rule remains the operative standard. Confirm BAA availability by name before assuming any plan qualifies.
8. What happens if I miss the EAA deadline?
Enforcement is active and decentralized: each EU member state designates its own regulator and penalty framework, so exposure multiplies with every market you serve rather than capping at a single EU-wide fine. Since enforcement began on June 28, 2025, several member states have already opened cases against non-compliant digital-service providers.
There's no universal grace period for existing content, though a limited transitional window applies to some services already on the market before that date. The safer move is auditing against WCAG 2.1 AA now rather than waiting for a specific enforcement action in your market.
Conclusion
A usable video compliance checklist isn't the one with the most boxes checked. It's the one that tells you honestly which boxes are yours and which belong to your vendor, because roughly half of this list will never be resolved by a certificate alone.
Revisit it every six months, since every domain here, AI transparency most of all, moves fast enough to make a year-old audit worthless.
Start with the one deadline that actually applies to you, not the one that sounds the scariest.