I run a web publishing product with over 10M deployments. The easy-to-enforce content policy is this "Are we breaking the law by hosting this content?". Basically the answer for an ISP is always no until there is a takedown order from the courts which your are under jurisdiction, OR you knowingly are hosting a phishing attack intended to defraud unsuspecting members of the public, OR you are put on notice of content infringement via sworn affidavit under penalty of perjury. It really is that simple because ISPs are immune by default.