Every adult content creator is legally required to maintain records proving performers are 18+, keep them for 7 years, post a compliance statement on every site where their content appears, and make the records available for federal inspection. Most guides skip this entirely. This one doesn't.
18 U.S.C. § 2257 is a federal record-keeping law that has been on the books since 1988. It was designed to prevent the production of child sexual abuse material by requiring producers of sexually explicit content to verify and document the age of every performer appearing in that content. The implementing regulations are at 28 C.F.R. Part 75.
The law applies to any "producer" of "sexually explicit conduct" — a category that includes creators on OnlyFans, Fansly, ManyVids, cam sites, and independent platforms. If you produce sexual content and publish it, you are a producer under the statute.
Important: even if you are the only performer and you're clearly an adult, the law still applies. It does not make exceptions for solo creators. The compliance burden falls on you as both the performer and the producer — you have to keep records on yourself.
What counts as "sexually explicit conduct" under 2257
Defined in 18 U.S.C. § 2256(2)(A). Includes any visual depiction — actual or simulated — of:
Sexual intercourse (genital-genital, oral-genital, anal-genital, oral-anal) — same-sex or opposite-sex
Bestiality
Masturbation
Sadistic or masochistic abuse
Lascivious exhibition of the anus, genitals, or pubic area
Non-explicit nudity (e.g., tasteful topless work) may fall outside 2257 — but the line is contested and prosecutors interpret "lascivious exhibition" broadly. Best practice: keep records for any adult-oriented content you publish.
Primary vs. secondary producer
Primary producer: You were physically present when the content was created — filming, performing, or directing. Solo creators are primary producers of their own content.
Secondary producer: You digitize, reproduce, publish, or distribute content originally produced by someone else. Both roles carry record-keeping obligations.
Collab content: If you film with another creator, you are a primary producer for them — which means you must collect and maintain their ID, legal name, stage names, and DOB, not just your own.
2257 applies to you if:
✓You produce adult content on OnlyFans, Fansly, or any platform
✓You appear in your own content (solo creator)
✓You film or direct other performers
✓You publish content created by someone else (secondary producer)
Enforcement
What happens if you don't comply?
First Offense
Up to 5 years federal prison
Plus fines. For failure to create or maintain compliant records, or to post required statements. 18 U.S.C. § 2257(i).
Subsequent Offenses
Up to 10 years federal prison
Each violation can be charged as a separate count. Plus civil penalties.
The realistic enforcement picture: Federal prosecutions under 2257 against small solo creators have historically been rare — DOJ inspections have focused on larger commercial producers. But this is a felony statute, the DOJ has actively inspected producers under it, and a missing-records charge is the kind of thing federal prosecutors stack on top of other charges. Compliance costs you almost nothing — it's paperwork, not money. Do it.
Records Custodian
Who is your records custodian?
The custodian is the person legally responsible for maintaining 2257 records. You can be your own custodian. The custodian's name and a physical street address (where records are actually kept) must appear on your site's compliance statement. This address becomes public — which is why putting your home address on it is a bad idea.
Don't use a bare P.O. Box. The regulation (28 C.F.R. § 75.6) requires the address where the records are actually located. A P.O. Box alone doesn't satisfy that. What works: an LLC's registered business address, a commercial mail-receiving agency (CMRA) with a real street address you use for storage/forwarding, or a virtual office that provides a physical suite.
Recommended
LLC as custodian (Wyoming or your state)
Your LLC serves as custodian. The LLC's registered business address becomes the compliance address — your legal name and home stay off the statement entirely. Cleanest separation between you and the public 2257 record.
Designate yourself. Keep encrypted records you can produce within a reasonable inspection window. Use a CMRA street address or virtual office — not your home — for the public statement.
Free
Working with Platforms
Platforms don't do this for you
OnlyFans, Fansly, etc. verify age for platform access — that is not 2257 compliance. Their TOS typically pushes the compliance obligation back onto you and requires you to certify you maintain records. You are still the primary producer.
Read Your TOS
Typical costs: CMRA / virtual office street address $10–30/mo. Wyoming LLC formation ~$100 first year + ~$60/yr renewal. Dedicated 2257 records custodian services run $300–600/yr.
Practical Setup
How to actually do this (30 minutes, one time)
A working setup most solo creators can use. Adapt as needed — this isn't legal advice, but it's a known-good baseline.
1
Create an encrypted "2257 Records" folder
Use Proton Drive (encrypted by default), a VeraCrypt container, or a password-protected encrypted disk image. This folder is sacred — it never touches public cloud, never gets backed up to a shared drive.
2
Build a per-performer folder for everyone (including yourself)
Inside the 2257 folder, create a subfolder named LastName_FirstName for each performer. Inside that, put: ID scan (front & back), hold-the-ID photo, signed model release, and a text file listing every stage name they've used.
3
Log every production in a single index file
A simple spreadsheet: date produced, title/description, performers (legal names), platforms where published. This is your retrieval index — when an inspector asks "show me records for [content]," you find it here in seconds.
4
Pick a public address that isn't your home
Form an LLC and use its registered street address, or rent a CMRA / virtual office. This address goes on your 2257 statement on every site — it will be public forever.
5
Post the 2257 statement on every site
Profile bio, footer link, link tree — anywhere your content lives. Use the template below. Same wording on every site; same custodian address.
6
Add a "new performer" intake step to your workflow
Before you ever film with a new collab partner: collect ID, hold-the-ID photo, signed release, and every stage name they've used. No records = no shoot. This is the single most important habit to build.
Don't Make These
Common 2257 mistakes
"They're verified on OnlyFans, so we're good."
Platform age verification is for platform access. It does not satisfy federal record-keeping. You still need your own copy of the ID, your own record.
Birth certificate as proof of age.
Must be a government-issued photo ID. A birth certificate alone has no photo — it doesn't tie the document to the performer in front of the camera.
Deleting the content to "end" the clock.
7-year retention runs from the last sale, distribution, or exhibition — not from the date you took it down. If anyone has ever downloaded it, the clock is still running.
New stage name, old records.
If a performer (you or anyone you've filmed with) adopts a new stage name later, update the record. Every name that's ever appeared on a release of the content needs to be on file.
Home address on the public 2257 statement.
Once it's published with adult content, it's public forever and archived by scrapers. Use an LLC business address or a CMRA street address.
No 2257 statement on the page where content is posted.
Statement must be reachable from every site where the content appears. Footer link is the standard. Missing statement is its own violation — separate from any records issue.
Checklist
The compliance checklist
Progress
0 / 18
What is 2257?18 U.S.C. § 2257 requires anyone who produces sexually explicit content to verify performers are 18+, keep records proving it, and make those records available for inspection. Applies to you even if you're the only performer. Violations can mean fines or federal charges.
1
Before Every Production
Required before any content is created
Verified every performer is at least 18 years old (including yourself)
Age must be confirmed before shooting begins, not after. Yes — you have to document yourself, too.
Obtained a government-issued photo ID from every performer
Driver's license, passport, military ID, or state ID. Must show photo AND date of birth. A birth certificate alone is NOT sufficient — it has no photo.
Made a legible copy of the ID
Physical or digital copy. Digital scans are fine — keep them organized and secured.
Captured a "hold-the-ID" verification photo (best practice)
Performer holding their ID next to their face, dated. Not strictly required by statute, but it's the industry standard and your strongest evidence of good-faith age verification if you're ever inspected.
Recorded each performer's full legal name, all stage names/aliases, and date of birth
Every stage name they've ever used must be on file. If they adopt a new stage name later, update the record.
Recorded the date of production and a title/description of the content
Each work must be identifiable from the records. Date produced + title/description for every piece.
Signed model release on file (best practice)
Not required by 2257 itself, but required by most platform TOS and standard for protecting yourself. Sign one for your own solo content too — documents your consent.
2
Your Records System
Ongoing storage and organization requirements
Designated a records custodian (with a real street address)
Can be yourself or your LLC. Custodian name and the physical street address where records are kept must appear on your public compliance statement. P.O. Box alone isn't enough — needs to be where the records actually live.
Records are indexed and retrievable on demand
By performer's name AND by title of work. Inspectors can request to see records during normal business hours — they must be findable in a reasonable window, not buried in unnamed folders.
Records will be kept for at least 7 years after the LAST sale, distribution, or exhibition
Not 7 years from production — 7 years from the last time the content was distributed or shown. If a clip sells in 2030, the clock restarts. "I deleted it from OnlyFans" doesn't end the clock if it still exists anywhere.
Records are stored encrypted, with controlled access
Encrypted drive (VeraCrypt), password-protected cloud (Proton Drive, encrypted Dropbox), or locked physical storage. Never in your Downloads folder, never on a shared device, never on unencrypted external drives.
3
Your Website Requirements
What must appear on your site
Compliance statement is posted on your site
Must be on every site where sexually explicit content appears. Use the template below.
Statement includes custodian name and physical street address
Must be the actual location where records are kept. A bare P.O. Box generally doesn't satisfy 28 C.F.R. § 75.6 — use an LLC business address, CMRA street address, or virtual office. Never your home.
Statement is reachable from every page where content appears
Footer link is the standard approach. The requirement is that a visitor can find it without digging.
4
Secondary Producer Rules
If you use content from other producers
Obtained the primary producer's 2257 records or a certification that they comply
If you publish content where you weren't the original producer, you must either get their records or get written confirmation that they maintain compliant records.
Your compliance statement names the primary producer
Secondary producer statements must identify who the primary producer is and where their records can be found.
Compliance Statement Template
18 U.S.C. § 2257 Record-Keeping Requirements Compliance Statement
All models, actors, actresses, and other persons who appear in any visual depiction of actual or simulated sexually explicit conduct appearing on, or otherwise contained in, this site were over the age of eighteen (18) years at the time the visual depiction was created.
Records required by 18 U.S.C. § 2257 and 28 C.F.R. Part 75 for all visual depictions of actual sexually explicit conduct appearing on this site are kept by the Custodian of Records at the following location:
[Your Full Name or Company Name], Custodian of Records
[Street Address — must be where records are actually kept]
[City, State, ZIP]
Last updated: [Month Year]
Post this on every site, profile, or page where your adult content appears — typically as a footer link labeled "2257 Statement" or "18 U.S.C. § 2257." Same wording everywhere; same custodian address.
5
Quick Sanity Checks
Review these periodically
Compliance statement date is current
No law requires dating the statement, but current year looks better and signals active maintenance.
All old content still has records on file
Content you published years ago still needs records. "I deleted it" doesn't clear the obligation during the 7-year window.
This checklist is for informational purposes only and does not constitute legal advice. 2257 compliance is complex and the law has been subject to ongoing litigation. Consult a qualified attorney before relying on this checklist for legal decisions.
2257 compliance costs — custodian services, storage, legal review — are deductible business expenses on Schedule C.
Talk to a creator CPA →
2257 compliance costs — custodian services, storage, legal review — are deductible business expenses on Schedule C.
Talk to a creator CPA →