The Visa rule that quietly governs every AI girlfriend on the internet

The most asked question on every AI girlfriend forum is some version of "which platform has no restrictions." The most honest answer ever posted on Quora to that question runs about eighteen words: best with zero restrictions doesn't really exist, because payment processors and app stores force compliance. That answer is correct in a way most people who upvote it don't fully appreciate. The platform isn't deciding. The merchant account is.

Two private companies, Visa and Mastercard, have spent the last five years quietly becoming the de facto regulator of every adult-adjacent product on the consumer internet. Not because they passed any laws. Because they wrote merchant policies, and the merchant policies have the force of law for anyone who needs to take a credit card.

How a 2021 internal policy memo ate the entire adult internet

The pivot point was April 2021, when Mastercard announced new requirements for any merchant processing payments for adult content. Banks would have to ensure that platforms verified the age and consent of every person depicted. Content review processes had to be implemented. Identity verification became mandatory. The stated reason was preventing child exploitation, which nobody could publicly object to.

The downstream effects were immediate and enormous. OnlyFans announced in August 2021 that it would stop allowing sexually explicit content, with founder Tim Stokely directly attributing the change to pressure from banking partners. The site reversed course six days later after public outcry, but the message was received industry-wide. Pornhub had already lost Visa, Mastercard, and Discover processing in December 2020 after a New York Times opinion piece. The cards never came back, and the site now runs primarily on ads and data sales.

What's interesting about the 2021 Mastercard policy is what it didn't explicitly say. The text was ambiguous enough that the ACLU criticized its "vague and ambiguous" phrasing as fundamentally unenforceable. That ambiguity wasn't a bug. Ambiguous rules let processors push enforcement onto platforms, and platforms onto creators, with the actual decision-making happening through chilling-effect compliance rather than written enforcement.

The 2025 expansion: anthropomorphic content and Steam itself

If you assumed this was a one-time policy adjustment that mostly affected porn sites, the events of 2025 should adjust the picture. In late June, Fansly removed all adult furry content from its platform, citing processor classification of anthropomorphic content as simulated bestiality. Kemonomimi (human-like characters with animal ears) was deemed acceptable. Full fursonas were not. The line between the two was drawn by someone at a card network who has almost certainly never written a single furry story.

Steam followed in July, updating its rules to forbid "content that may violate the rules and standards set forth by Steam's payment processors and related card networks and banks." That clause is the most honest thing Valve has ever published. It admits, in plain text, that Steam's content policy is downstream of decisions made by entities Steam doesn't control.

Japanese platforms got hit too. Doujinshi retailer Melonbooks halted Visa and Mastercard payments in December 2024. Manga Library Z shut down entirely in November 2024. DLsite, Skeb, and Toranoana all pivoted to alternative payment methods. None of these companies were doing anything illegal under Japanese law. They were doing things that two American payment processors had decided not to facilitate.

Who actually writes these rules

The chilling phrase in every news story is "responding to pressure from advocacy groups." That phrase tends to obscure who the advocacy groups actually are.

The two organizations driving most of the recent campaigns are the National Center on Sexual Exploitation (NCOSE, formerly known as Morality in Media) and the Australian group Collective Shout. Both run targeted campaigns pressuring Visa and Mastercard to cut off specific platforms, then publicly take credit when the platforms comply. NCOSE has been involved in litigation against MindGeek, the former parent of Pornhub, and that 2022 case (which allowed a plaintiff to sue Visa directly) is the legal precedent every payment processor is now operating against.

The mechanism is: advocacy group files complaint with payment processor, processor doesn't want to be the next defendant in a Visa-style lawsuit, processor pressures merchant bank, merchant bank pressures platform, platform changes policy. The advocacy group never has to win a single legal argument. They just have to make the threat of liability uncomfortable enough that the processor would rather drop the merchant than fight.

What this means for AI companion platforms specifically

AI girlfriend platforms inherit every constraint above and add a few of their own. The image generation component puts them in the same regulatory neighborhood as adult content sites, which means age verification, content moderation, and uploaded reference image bans are baseline requirements. The text component triggers a different set of concerns around CSAM generation (any prompt mentioning age too young flags everything for review). The companion framing, the relationship simulation itself, has so far been treated as adjacent rather than central, but that could change with one well-publicized incident.

You can see the consequences directly in how the platforms talk about themselves. Candy AI operates from Malta under EverAI Limited; the bank statement shows "EverAI" rather than the platform name, and they accept Bitcoin, Ethereum, USDC, and Litecoin alongside cards. Nomi explicitly forbids explicit NSFW content despite competing in the AI companion space. Most platforms require ID verification before any NSFW unlock, and several use Persona, the same biometric verification vendor Mastercard now owns financial interest in.

The convergence isn't coincidental. Every platform in the category is essentially negotiating with the same two card networks through the same handful of merchant processors. The platforms that look the most permissive are typically the ones that have routed payments through crypto rails, alternative processors like CCBill or Epoch, or offshore banking jurisdictions that don't sync as tightly with Visa's standards.

Why "uncensored" is mostly marketing

Read enough AI companion review sites and you'll see the word "uncensored" applied to platforms that absolutely have content filters. The disconnect happens because "uncensored" has come to mean "less restrictive than Candy AI" rather than "actually unrestricted." Every consumer-facing platform that accepts credit cards has filters. The filters are what keep the merchant account alive.

The honestly unrestricted territory in this category is essentially self-hosted. Run a local model with SillyTavern on your own machine, host a Stable Diffusion variant for image generation, and you've exited the entire payment processor compliance regime because no payment is happening. That's not a coincidence. The technical complexity is the cost of leaving the regulated zone. Anyone trying to deliver that experience as a hosted SaaS hits the same wall, gets the same processor pushback, and either complies, switches to crypto, or shuts down.

What changes from here

The Trump administration's January 2025 executive orders and the broader political environment have shifted the conversation around payment processor neutrality, but the underlying dynamics haven't reversed. NCOSE and Collective Shout are still actively campaigning. The pending Visa lawsuit is still pending. The OnlyFans whistleblower complaint about CSAM payment processing keeps the regulatory pressure on processors high, which keeps the pressure on merchants high.

For users picking an AI companion platform, the practical takeaway is this: the platform's content policy probably isn't what you think it is. The platform's processor's policy is what you're actually subscribing to. When a feature disappears overnight or NSFW unlocks require a new ID submission, the company that made that decision usually isn't the one that sent you the email. It's the one whose logo sits in the bottom corner of the checkout page.