The laws and rules behind your records

A 2257 record sits where several sets of rules meet: a federal statute and its regulations, a newer federal takedown law and its state cousins, the card networks' own programs, and the ordinary law of signatures and contracts. This page names each one, says what it asks of you in plain words, and says what Easy2257 does about it, so you can see the whole picture in one place. The deeper articles are linked where they exist.

Federal record-keeping: the core#

18 U.S.C. § 2257. The statute. Anyone who produces a depiction of actual sexually explicit conduct must create and keep records proving the age and identity of every person depicted, must examine those documents themselves or through a custodian they designate, and must attach a statement to the content saying where the records are kept. The duty is the producer's and the statute says so directly. Easy2257 is the custodian you designate: it keeps, indexes and produces the records, and it records what you state about them. 2257 in plain English walks through the requirements one at a time.

18 U.S.C. § 2257A. The companion statute for simulated sexually explicit conduct and for lascivious exhibition, with its own effective dates and a certification route for some producers. Easy2257 keeps the same records for this content as for § 2257 content; it does not keep a separate, lighter record for it.

28 C.F.R. Part 75. The Department of Justice regulations that say how the statute is met. The parts that shape your records:

• 75.2(a)(1): what the record must contain for each performer, including a copy of the identification document and every name the performer has used. This is what identity verification and the performer record hold.
• 75.2(a)(1)(iii): a copy of the depiction itself, and a copy of any URL it is published at. Each depiction you add carries a reduced copy held by Easy2257 and the list of every place it is published; you can add to that list for as long as the content is online.
• 75.2(a)(2) and (a)(3): the records must be cross-referenced so that a performer can be found from a depiction and a depiction from a performer. The index in your compliance package does this.
• 75.2(e): secondary producers, which is what you are when you publish content whose original producer holds the age records. The received-records close-out covers this lane, and foreign talent and productions covers records that originate abroad.
• 75.2(f): records may be kept digitally, and copies must be true copies. Every file in your record carries a SHA-256 digest.
• 75.2(h): a producer may designate a third party as custodian of records. That designation is what the Custodian of Records Agreement records, and it does not relieve you of your own liability under the statute; the regulation says that in its own words and so does the agreement.
• 75.4: how long records are kept: seven years from creation or last amendment, and five years after the business ends. Retention and deletion explains what that means for removed content.
• 75.5: inspection. Records must be available for inspection at the custodian's address during business hours. Easy2257 holds the address, receives the request, and produces the records.
• 75.6: the statement that must appear on the content, naming the custodian and the records address. Your hosted 2257 statement is that notice.

18 U.S.C. § 2256. The definitions every other section uses: what counts as sexually explicit conduct, what a visual depiction is, and who a producer is.

Removal and the rights of the person depicted#

The TAKE IT DOWN Act (2025). A federal law requiring platforms to remove non-consensual intimate imagery within 48 hours of a valid request and to make the request process easy to find. Easy2257 hosts a public removal portal for your content, starts the 48 hour clock on each request, alerts you as it runs, and escalates a breach. Removals and takedowns covers the portal and the clocks.

State intimate-image laws. Most states have their own removal laws with their own windows; North Carolina's HB 805 sets 72 hours, and others vary. The portal applies the shortest clock that fits the request.

The DMCA, 17 U.S.C. § 512. Copyright takedowns follow a different path through a registered agent. Easy2257 has a registered agent and a notice process for content on this site; for your own sites, the agent is yours to register.

18 U.S.C. § 2258A. Providers that become aware of child sexual abuse material have a reporting duty. Easy2257's records exist to show that every performer was an adult; if a report is ever needed, it is made by a person, not by a workflow.

Card-network programs: rules, not laws#

Mastercard AN 5196, with the Mastercard Standards (SPME § 9.4.1). Written consent from every performer before publication, a removal process with deadlines, and a monthly report to your acquiring bank. Visa's Integrity Risk Program (VIRP Tier 1 § 3.1) asks for the same three things on the Visa side.

These are contract terms between you, your processor and the networks. They are not law, and no agency enforces them, but losing them means losing card payments, which is why they matter as much as the statute. Easy2257 collects performer-signed releases as part of every scene, runs the removal portal, and generates the monthly acquirer report on Producer plans and up. Mastercard AN 5196 and Visa VIRP has the detail, including who actually has an acquirer to report to.

Signatures and contracts#

The E-SIGN Act (15 U.S.C. § 7001) and UETA. Electronic signatures are valid signatures. Every release, consent and attestation signed through Easy2257 is captured with the signer, the time, the document as rendered, and a digest of the signed file, which is what makes it hold.

Arizona law. The Easy2257 Terms of Service and the Custodian of Records Agreement are governed by Arizona law, where the custodian's records address is.

Laws that touch your business but not these records#

State age-verification laws. Texas HB 1181 and the laws of roughly half the states now require adult sites to verify the age of viewers. Those laws are about who may see your content, not about who appears in it. Easy2257 is not a viewer age gate and does not stand in for one.

Section 230 (47 U.S.C. § 230). Shapes a platform's liability for what users publish. It is the backdrop for every platform customer and is not changed by anything Easy2257 does.

The FTC Act, § 5. Honest claims. Easy2257 says only what it does, on every page, and describes its own coverage in the same terms on this site, in the help centre and in the agreements.

Privacy law: CCPA and the other state privacy acts, and GDPR for performers in the European Union. The records you keep with Easy2257 hold government identification and dates of birth. That is personal data wherever the performer lives, and the usual rights of access and the usual breach duties apply on top of the retention rules above. What we store, and how to export it lists exactly what is held.

18 U.S.C. §§ 2252 and 2252A. The statutes against child sexual abuse material. Compliant 2257 records never trigger them; they are the reason the record-keeping rules exist and the reason an inspection happens at all.

What Easy2257 does, and what stays yours#

Easy2257 is the custodian of your records. It holds the identification documents, the signed releases, the copies of the depictions and their URLs, it cross-references all of it, it keeps everything for the retention period, it produces the records on a lawful request, and it issues a signed certificate that a given record existed in a given state at a given time.

It does not decide whether what you stated is true. When you attest that you examined a performer's identification, or that you hold records received from another producer, or that a date was keyed in wrong, Easy2257 records your statement word for word and keeps it with the record. The examination duty, the truth of the attestation, and the obligations of the producer of record stay with you, because the statute places them there.

Reading further#

The primary sources are short enough to read directly:

• 18 U.S.C. § 2257 and § 2257A.
• 28 C.F.R. Part 75.
• 17 U.S.C. § 512.
• 15 U.S.C. § 7001.