The Short Answer

If you produce explicit content — solo or with anyone else — federal law requires four things on file before you publish:

Government-issued photo ID for every performer (including yourself), verified before the camera turns on.
A cross-reference index linking each piece of content to every performer in it, searchable by every name they've used.
A designated Custodian of Records with a physical address where those records are available during business hours.
A 2257 statement on every page or piece of content naming the Custodian and that address.

Penalties for failure: up to 5 years federal prison for a first offense, up to 10 years for repeat offenses, plus forfeiture of all content. This is criminal liability, not a civil fine.

The rest of this guide explains each requirement in detail, what's changed in 2026 (Mastercard AN 5196, Visa Integrity Risk Program, the TAKE IT DOWN Act), and what "compliant" actually looks like for solo creators vs. studios.

What Is 18 U.S.C. § 2257?

18 U.S.C. § 2257 is the federal record-keeping law for producers of "actual sexually explicit conduct." Enacted in 1988 and substantially expanded by the Adam Walsh Act of 2006, it requires every producer to create, maintain, and make inspectable records proving every performer was at least 18 at the time of production.

There is nothing to file

No registration form, no certification letter, no portal, no email to the Department of Justice, and no government list of compliant producers. The obligation is to keep the records, not to announce yourself.

The confusion has a source. When the Adam Walsh Act extended 2257 to simulated sexually explicit conduct, it swept in mainstream film and television, and the DOJ opened a certification route in 2009 so those companies could opt out of the full record-keeping burden. That route was built for productions where a reasonable person would not assume the content is pornography. It is not open to producers of actual sexually explicit content, which is why there is nothing for you to file and nothing to wait for approval on.

The regulations live at 28 CFR Part 75. Enforcement runs through the Department of Justice — specifically the Child Exploitation and Obscenity Section. Inspections happen at the custodian address during normal business hours, and they arrive unannounced: 28 CFR 75.5(b) says in a single sentence that advance notice of a record inspection shall not be given.

If you produce adult content involving anyone — including yourself as a solo creator — the law applies to you.

Who Does 2257 Apply To?

The law applies to primary producers (those who actually film or photograph the content) and secondary producers (those who publish, duplicate, or distribute it). Key groups include:

Independent producers shooting scenes with other performers
Studios of any size producing explicit content
Clip site sellers on platforms like ManyVids, Clips4Sale, and IWantClips
OnlyFans creators who produce sexually explicit content
Photographers shooting explicit still images
Distributors and publishers who reissue content

Important: 18 U.S.C. § 2257 applies to all producers of visual depictions of actual sexually explicit conduct. The statute requires records for every performer portrayed, including yourself. Consult a qualified attorney for guidance on your specific situation.

The Six Core Requirements

1. Collect Government-Issued Photo ID

For every performer appearing in sexually explicit content, you must collect and inspect a valid government-issued photo identification document. This ID must contain:

The performer's legal name
Date of birth
A photograph

Acceptable documents include driver's licenses, passports, and state-issued ID cards. You must verify that the performer is at least 18 years old before any production begins.

Inspecting the document is not the whole obligation. 28 CFR 75.2(a)(1) requires the records to hold a legible copy of the identification document itself, in hard copy or as a scan, not a note saying one was seen.

2. Maintain Detailed Records

You must create and maintain an index that cross-references:

Each performer's legal name
Any stage names, aliases, or maiden names used
Date of birth
The title, description, or identifier of each piece of content they appear in
The date of production

The records must be organized alphabetically by the performer's legal name, then indexed or cross-referenced to every alias or other name used and to every title or identifying number, so an inspector can get from a performer to their content and from a piece of content back to its performers. That is 28 CFR 75.2(a)(2) and (a)(3).

28 CFR 75.2(a)(1)(iii) adds one element people miss: the record holds a copy of the depiction itself, and where it is published online, a copy of every URL it appears at. The URL list keeps growing for as long as the content is up.

3. Designate a Custodian of Records (COR)

Every producer must designate a Custodian of Records - a person or entity responsible for maintaining the required records and making them available for inspection. The COR must:

Maintain all required records in an organized, accessible manner
Make records available for inspection during normal business hours at a designated physical location
Produce records on demand when requested by authorized inspectors (typically the Attorney General's office)

4. Display the COR Statement

Every piece of content you produce must display a compliance statement including:

The name of the Custodian of Records
The physical address where records can be inspected

This statement must appear on the content itself or be readily accessible (e.g., on a website page for online content).

5. Retain Records for the Required Period

Under 28 CFR 75.4, records must be kept for seven years from the date the record was created or last amended or added to, and for five years after you stop producing sexually explicit content, whichever runs longer. (75.5 is the inspection rule, not the retention rule. The two get mixed up constantly, including on this site until 2026-08-23.) As a practical matter, most producers should retain records for the duration of their career and beyond.

6. Keep the Records Separate

28 CFR 75.2(e) is short and absolute: records required under Part 75 "shall be segregated from all other records, shall not contain any other records, and shall not be contained within any other records."

In practice that means your 2257 records cannot live inside your general business filing, your accounting system, or a shared drive full of contracts and invoices. They are their own set. An inspector is entitled to see the records the regulation names and nothing else, and mixing them with unrelated material is how a producer ends up handing over more than the law asks for.

Performers and Shoots Outside the United States

Nothing above stops applying when a performer, a shoot, or the person keeping the records is outside the United States. What changes is which identification document the regulation names, and that turns on facts about the day of the shoot rather than on where a business is registered.

Which document the regulation names

The document a producer must examine is a "picture identification card", and 28 CFR 75.1(b) defines it in two parts.

The first is a document issued by the United States, a State, a political subdivision of a State, or a United States territory, bearing the person's photograph, name and date of birth. The regulation's own examples are a U.S. passport, Permanent Resident Card or employment authorization document, and a driver's license or other identification issued by a State or the District of Columbia.

The second is a foreign government-issued equivalent, and it carries two conditions.

Both conditions, or it is not that document

A foreign document is the card 75.1(b) describes only when both of these are true on the original production date:

The person it identifies is a non-U.S. citizen located outside the United States.
The producer maintaining the records, whether a U.S. citizen or not, is also located outside the United States.

The test is about where two people physically were that day. Not nationality on its own, and not where a company is incorporated. Whichever branch applies, the card has to be valid as of that same date.

The cases producers actually arrive with

Shoot abroad, foreign performer, records kept abroad. Their foreign passport, national ID card, driver's license or residence permit is the document the second branch describes.
Shoot in the United States, or a record-keeper in the United States. The second condition fails, so the U.S.-issued list is what applies. Many performers from other countries working here already hold one: a Permanent Resident Card, an employment authorization document, or a state driver's license or ID. Where a performer holds only a foreign document, talk to your attorney before the shoot rather than after it.
Shot abroad, published by a U.S. producer holding copies. Whether copies held in the United States of a foreign producer's examination meet the definition is a question to put to an attorney with the dates and the places in hand.

Whether a particular document qualifies depends on those dates and places rather than on the document, which is why this guide does not rule on it. The country-by-country list of what the identity check reads is in Identity documents from outside the United States.

Records received from another producer

28 CFR 75.2(b) lets a secondary producer meet the requirement by accepting copies of the primary producer's records, and it adds one obligation of its own: keep the name and address of the primary producer those copies came from.

The copies may be redacted to remove non-essential detail such as addresses, phone numbers and social security numbers. The identification number of the picture identification card may not be redacted.

What the card networks add here, and what they do not

Mastercard's AN 5196 and Visa's Integrity Risk Program read the same wherever the performer or the shoot is. Neither one keys anything it asks for to the country that issued a performer's identification, and what your acquirer accepts as verification is the acquirer's own call. If a performer's document is an unusual one, ask them before the shoot rather than after it.

The Custodian of Records Problem

The COR requirement is where most independent producers get stuck. The law requires records to be available at a physical location during business hours. For independent producers, this creates an impossible choice:

Option	Problem
Use your home address	Your home address becomes public record. Safety and privacy risk.
Rent office space	$2,000–5,000/month for a dedicated compliance office with staff.
Ignore the requirement	Criminal penalties: up to 5 years imprisonment for non-compliance.

This is exactly the problem that COR services like Easy2257 solve. By designating a third-party service as your Custodian of Records, you fulfill the legal requirement without exposing your home address or renting office space.

Penalties for Non-Compliance

Failure to comply with 2257 carries serious penalties:

First offense: Up to 5 years imprisonment
Subsequent offenses: Up to 10 years imprisonment
Forfeiture of content produced in violation

These are federal criminal penalties, not civil fines. The law is enforced by the Department of Justice, and inspections occur during business hours without advance notice.

The offense is the record-keeping failure itself. A producer whose performers were all demonstrably adults still commits it by failing to keep the records, because what is charged is the missing record, not the age of anyone depicted.

What Changed in 2026: Payment Processors, AN 5196, and VIRP

Federal 2257 law has been stable for over a decade, but the *enforcement environment* has shifted dramatically. In 2026, the binding pressure on adult producers no longer comes only from the DOJ — it comes from the card networks.

Mastercard AN 5196

Mastercard's AN 5196 (Announcement to Customers, bulletin 5196) requires every acquiring bank that processes adult content payments to verify that the merchant has documented age and consent for every performer in every piece of content monetized through the network. In practice, your payment processor will ask for:

Proof of performer ID verification
A signed model release per performer per scene
A monthly compliance report showing removal-request volume and resolution times
A documented Custodian of Records arrangement

If your acquirer can't verify those, they drop you. There is no appeals process.

Visa Integrity Risk Program (VIRP)

Visa's Integrity Risk Program imposes parallel requirements with two additional teeth: a takedown SLA (you must remove flagged content within defined hours) and annual third-party attestation for higher-volume merchants. VIRP also requires a public-facing takedown intake — an unauthenticated form where anyone depicted in your content can request removal.

TAKE IT DOWN Act (2025)

Signed into federal law in 2025, the TAKE IT DOWN Act imposes a 48-hour removal obligation for non-consensual intimate imagery (NCII) reported through a defined intake. Adult platforms and producers are squarely in scope. Failure to meet the SLA triggers civil penalties enforceable by the FTC.

What this means in practice

You can be 100% compliant with 2257 itself and still lose your processor if you don't carry the AN 5196 / VIRP paperwork. The federal law sets the floor. The card networks set the ceiling. Most producers underestimate how much of their actual compliance burden comes from the second category.

Easy2257 hosts the unauthenticated takedown portal at /report/removal and enforces the TAKE IT DOWN 48-hour SLA automatically on every paid plan, and generates the monthly acquirer report on Producer plans and up. None of it is a separate product, because none of it is optional for anyone monetizing adult content in 2026.

How to Comply: Step-by-Step

Step 1: Before Production

Collect a valid government-issued photo ID from every performer
Verify the performer is at least 18 years old
Record the performer's legal name, date of birth, and any aliases
Have the performer sign a model release that includes their legal name, stage name, and date of birth

Step 2: During/After Production

Document the title or identifier of the content produced
Record the date of production
Record all performers who appeared in the content
Cross-reference performer records with content identifiers

Step 3: Record Maintenance

Store all records in an organized, indexed system
Ensure records are searchable by performer name (including aliases)
Ensure records are searchable by content title/identifier
Maintain records at the designated COR location
Keep records for seven years from creation or last amendment, and five years after you stop producing, whichever runs longer (28 CFR 75.4)

Step 4: Display Requirements

Include the COR statement (name and address) on all content
For websites, include a dedicated 2257 compliance page
For physical media, include the statement on packaging

Digital vs. Paper Records

The original 2257 regulations were written for a paper-based world, and they were amended for this one. 28 CFR 75.2(f) permits records to be kept in digital form on one condition: there must be a custodian who can authenticate each digital record, meaning they can show a record has not been altered since it was created. That is why every file in an Easy2257 record carries a SHA-256 digest.

What digital storage does not do is dissolve the physical location requirement. The custodian still needs an address where the records can be produced during business hours.

Best practice: Maintain digital records (for efficiency and backup) while ensuring your designated COR can produce physical copies on demand if required during an inspection. Modern compliance platforms handle this by storing all records digitally with the ability to generate printed reports.

Common Mistakes

Not collecting ID before production. The law requires age verification *before* production begins. Collecting IDs after the fact doesn't protect you.

Accepting photocopies or photos of IDs. While digital ID verification is increasingly accepted, you should use a verification system that authenticates the document, not just captures an image.

Incomplete cross-referencing. Your records must link performers to specific content. Having a folder of IDs without tying them to productions is not compliant.

Using your home address as the COR location. While technically compliant, this exposes your home address publicly. Use a COR service or registered agent.

Not updating records when content is redistributed. If you license content to a distributor, records still need to be maintained.

Forgetting the display requirement. Every piece of content needs the COR statement. This includes content on tube sites, clip sites, and social media platforms.

OnlyFans, Fansly, and Clip-Site 2257 Obligations

OnlyFans, Fansly, ManyVids, Clips4Sale, and iWantClips all run their own 2257 verification flows for content uploaded to their platforms. That covers their obligations as a secondary producer or distributor. It does not cover yours.

As the primary producer — the person who actually filmed or photographed the content — you are independently and personally responsible for:

Maintaining a complete records set under 28 CFR Part 75
Designating a Custodian of Records with a physical address
Displaying a 2257 statement on every page or piece of content you publish anywhere
Retaining those records for at least seven years from production date

The platform's 2257 page is *their* compliance statement, not yours. When the DOJ inspects, they inspect the producer — which is you. Posting on OnlyFans doesn't shift that obligation to OnlyFans.

The same is true for AN 5196 and VIRP: your platform's processor relationship doesn't insulate you from your own. If you sell direct, you carry it. If you take payments through any channel outside the host platform, you carry it.

For deeper, platform-specific guides:

Two free things on this site that go with this guide:

What 18 U.S.C. § 2257 actually requires — the statute answered in full, in plain language, before any sell
Free 2257 statement generator and template — build the statement you are required to publish, and copy it straight out

The Other Rules That Touch a 2257 Record

Everything above is the federal record-keeping law. A working record also sits inside several other sets of rules, and producers usually meet them in the wrong order: the card networks first, a removal request second, and the statute itself last. Here is the rest of the map, with what each one asks and what Easy2257 does about it.

The rest of the federal picture

18 U.S.C. § 2257A is the companion statute, covering simulated sexually explicit conduct and lascivious exhibition, and it carries a certification route some producers can use. Easy2257 keeps the same record for that content as for § 2257 content rather than a lighter one.

18 U.S.C. § 2256 holds the definitions the other sections rest on: what sexually explicit conduct is, what a visual depiction is, and who counts as a producer.

28 C.F.R. Part 75, and where each paragraph already appears. Most of the regulation is the six requirements in other words. 75.2(a)(1) is Requirements 1 and 2, 75.2(a)(2) and (a)(3) are the cross-reference index, 75.2(e) is Requirement 6, 75.2(f) is the digital-records rule below, 75.4 is Requirement 5, 75.6 is Requirement 4, and 75.2(b) is the received-records rule in the foreign section above. Three paragraphs appear nowhere else on this page:

75.2(c): a record needs to be current only as of the original production date. When you publish more content with a performer you already hold records for, you add the new title to the existing record instead of starting a new one.
75.2(h): a producer may contract with a non-employee custodian, and the regulation says in its own words that doing so does not relieve the producer of liability under Part 75. Designating a custodian moves the address, the intake and the day-to-day custody. It does not move the duty.
75.5: inspection. No advance notice, normal business hours, once in any four-month period unless there is reasonable suspicion of a violation, and the investigator may copy anything subject to inspection at no cost to you. If you do not keep at least twenty normal business hours a week, you have to tell the inspecting agency when the records are available, and that window can never be less than twenty hours.

Removal, and the rights of the person depicted

The TAKE IT DOWN Act is covered above. Two things about it matter in practice: the clock starts when the request is submitted rather than when somebody reads it, and the intake has to be findable without an account.

State intimate-image laws run alongside it with their own windows. North Carolina's HB 805 sets 72 hours and others vary. Where more than one could apply, the shortest clock that fits the request is the one to work to.

The DMCA, 17 U.S.C. § 512, is a different path for a different problem: copyright, routed through a registered agent. Easy2257 has a registered agent for content on this site. For your own sites, registering one is yours to do, and it is cheap and easily forgotten.

18 U.S.C. § 2258A places a reporting duty on providers who become aware of child sexual abuse material. Your records exist to show that every performer was an adult; a report, if one is ever needed, is made by a person and not by a workflow.

18 U.S.C. §§ 2252 and 2252A are the statutes all of this sits against. They are why the record-keeping rules were written and why an inspection happens at all.

Signatures and governing law

The E-SIGN Act, 15 U.S.C. § 7001, and UETA make an electronic signature a signature. What makes one hold up later is what was captured alongside it, so each document signed through Easy2257 records the signer, the time, the document exactly as it was rendered to them, and a digest of the signed file.

Arizona law governs the Easy2257 Terms of Service and the Custodian of Records Agreement, which is where the custodian's records address is.

Rules about your business that are not about this record

These come up constantly and none of them is what a 2257 record answers. They are here so you can stop wondering.

State age-verification laws. Texas HB 1181 and the laws of roughly half the states now require adult sites to check the age of the person viewing. That is a different question from who appears in the content, it is answered by different technology, and a compliance record does not answer it. Easy2257 is not a viewer age gate and does not stand in for one. This is the most common misunderstanding about what this product is, so it is worth reading twice.

Section 230, 47 U.S.C. § 230 shapes a platform's liability for what its users publish. It is the backdrop for every platform customer and nothing here changes it.

The FTC Act, section 5 requires claims to be honest, which is why the copy on this site describes what the product does rather than what state it puts you in.

Privacy law: the CCPA, the other state privacy acts, and GDPR where a performer is in the European Union. The records you keep hold government identification and dates of birth. That is personal data wherever the performer lives, so the usual access rights and breach duties sit on top of the retention rules above.

What Easy2257 does, and what stays yours

Easy2257 is the custodian of your records. It holds the identification documents, the signed releases, the copies of the depictions and the URLs they are published at; it cross-references all of it; it keeps it for the retention period; it produces it on a lawful request; and it issues a signed certificate that a given record existed in a given state at a given time.

It does not decide whether what you stated is true. When you attest that you examined a performer's identification, or that you hold records received from another producer, or that a date was keyed in wrong, Easy2257 records your statement word for word and keeps it with the record. The examination duty, the truth of the attestation, and the obligations of the producer of record stay with you, because the statute puts them there.

A custodian holds and produces records. It cannot make an incomplete record complete.

How Easy2257 Handles This

Easy2257 is a 2026-built compliance platform designed around the actual regulatory environment — 2257, AN 5196, VIRP, and the TAKE IT DOWN Act — rather than the 1988 paper-records world the law was written for.

Create a production and add scenes, or use the Solo Creator flow if you produce alone
Invite talent via secure links — they complete ID verification and sign model releases on their own phone, with no one else seeing their documents
Bank-grade ID verification with document authentication and facial comparison; we never let unverified performers reach the scene-close step
Signed model releases stored as PDF — required by AN 5196 and VIRP, not optional
Depiction storage — keep a copy of the actual content tied to the performer record (28 CFR 75.2(a)(1))
Producer attestation — timestamped, IP-logged confirmation that you personally examined each ID (18 U.S.C. 2257(b)(1))
AES-256 encryption on every record, with SHA-256 integrity hashing for inspection-ready chain of custody
Custodian of Records service included on every paid plan — our address and contact appears in your 2257 statement, not yours
Unauthenticated removal portal at /report/removal — required by VIRP and the TAKE IT DOWN Act, with a 48-hour SLA enforced automatically
Monthly acquirer report (Producer plans and up) generated and emailed on the 2nd of each month, ready to forward to your processor

Solo Creator plan starts at $10/mo ($120/yr annual). Studio and Enterprise tiers handle multi-producer organizations.

See pricing · How it works · Get started free

This guide is for informational purposes only and does not constitute legal advice. Consult an attorney for guidance specific to your situation.

What Is 2257? Required Records, Forms & Statements (2026 Guide)

Ready to Get Compliant?