My understanding is that they used to "follow" that by making someone check a box saying the uploader was CPOE compliant.

The "secondary producer" (anyone who "publishes, reproduces, or reissues") has had limited enforcement and is what would cover Pornhub.

More recently they have changed to collecting legal identification of anyone doing an upload at least.