Custodian of Records: Role, § 2257 Notice, and Inspections

Under 18 U.S.C. § 2257, the custodian of records is the person a producer designates to maintain, secure, and authenticate every performer’s age-verification file, and to hand those files over when federal investigators come to inspect them. The role carries personal responsibility for the records themselves, and the producer who designates a custodian stays legally liable for compliance even after the job is delegated. A first violation reaches five years in federal prison; a second reaches ten, with a two-year mandatory minimum.¹

What the Custodian Does

Every producer of sexually explicit content depicting real people must designate a custodian. That person is usually the producer or an employee with direct control over the files, but a producer may contract the job to a non-employee. Whoever holds the role takes personal responsibility for maintaining, securing, and authenticating all performer documentation.²

Authentication is the core of the job. When investigators arrive, the custodian is the person who answers questions, pulls files, and walks them through the filing system. For digital records, the custodian must be able to confirm the integrity of each file — that it is the original document collected before production, unaltered since.

What Has to Be in the Records

Before any filming or photography begins, the custodian’s file for each performer must contain the performer’s legal name, date of birth, and every other name they have ever used, including maiden names, aliases, and stage names.³

Each of those facts must be verified through a government-issued photo ID examined before production. The custodian keeps a legible copy of that ID, either as a physical photocopy or a digital scan. The file also holds a copy of the depiction itself and, for online content, the URL where the depiction appears. If the content was produced live on the internet, the file must include enough of the recording to identify the performer and tie them to their verification documents.⁴

A cross-reference index is required alongside the individual files. Every stage name or alias must be indexed by the title or identifying number of the specific work in which the performer appears, so that an investigator can start from a stage name and trace it to the performer’s legal identity and verified age. The primary producer must also record the date the original content was created.⁴

The ID rules shift by shoot location. For any production shot in the United States, the performer must present a U.S.-government-issued photo ID regardless of citizenship. For productions outside the United States, a foreign government-issued photo ID is acceptable if the performer is a foreign citizen; a U.S. citizen performing abroad still needs a U.S.-issued document. The ID must be valid as of the date the content was originally produced.⁵

Where a secondary producer relies on records from the primary producer, copies with home addresses and Social Security numbers redacted are acceptable, but the identification number from the performer’s photo ID must remain visible.²

The Notice That Names the Custodian

Every copy of covered content must carry a compliance statement identifying where the records are kept and who maintains them. The statement must give the street address where the records can be inspected; a P.O. box does not qualify. When the custodian is a non-employee, the statement must list that person’s name and business address. The title or identifying number of the work and its production date also appear in the notice.⁶

Placement depends on the medium. On physical media like DVDs or magazines, the notice appears in the credits or on the packaging. On websites, it must appear on every page displaying covered content, though the regulations allow a clickable or mouseover hyperlink labeled “18 U.S.C. 2257 Record-Keeping Requirements Compliance Statement” that opens the full notice in a separate window.²

Formatting has its own rules. The text must be at least 12-point type or no smaller than the second-largest typeface on the material, whichever is larger. Color must clearly contrast with the background. For electronic displays or on-screen notices with limited duration, the notice must be large enough and visible long enough for an average viewer to read it.⁶

Where Records Live and How Long They Stay

Records must be kept for seven years from the date they were created or last updated. If the producer goes out of business, the records must survive for five more years after closure. If the producing organization dissolves, the person who was responsible for the records continues that obligation for five years after dissolution.⁷

Records live at the producer’s place of business or at the business address of a non-employee custodian. Digital storage is permitted so long as the custodian can authenticate each record and produce it for inspection without unreasonable delay. Files should be protected against fire, theft, and unauthorized access regardless of format. The statute and regulations do not prescribe specific disposal methods once the retention period ends, so producers should treat the files as sensitive personal information and destroy them accordingly.

Producer Liability Does Not Transfer

Outsourcing the custodian role to a third party does not shift the producer’s own legal exposure. If something goes wrong with the records — files missing, IDs unverified, notices misplaced — the producer remains on the hook even when someone else physically holds and manages the documents.² Contracting the work out is a workflow decision, not a liability shield.

Changing or Replacing a Custodian

When a custodian leaves or the producer switches to a different person, the compliance notice on all content must be updated to reflect the new name and business address. For content already distributed, the producer should update notices on active platforms such as websites. Where the producing organization dissolves entirely, the person responsible for maintaining the records must continue to keep them for five years after dissolution.²

The regulations also permit listing a job title in the disclosure statement instead of a specific individual’s name. That option spares the producer from updating every notice each time the role changes hands.⁵

What an Inspection Looks Like

Federal investigators authorized by the Attorney General may inspect a producer’s records without advance notice. Inspections happen during normal business hours, defined by regulation as 9 a.m. to 5 p.m. local time, Monday through Friday, or at any other time when the producer is actively conducting business related to producing covered content. A producer who does not maintain at least 20 business hours per week must notify the inspecting agency of the hours during which records will be available, and those hours cannot total fewer than 20 per week.⁸

On arrival, the investigator must present credentials, explain the nature and scope of the inspection, and specify which records they want to see. The inspection should not unreasonably disrupt operations. At the end, the investigator may informally advise the custodian of any apparent violations.⁸

Under normal circumstances, a producer’s records can be inspected only once in any four-month period. The exception is when investigators have a reasonable suspicion that a violation has occurred, in which case additional inspections may happen sooner.⁸

During a routine inspection, an investigator may copy any record subject to inspection at no cost to the producer. A routine inspection does not authorize seizing original documents or hard drives. A law enforcement officer may seize evidence of any felony discovered during an inspection, but absent that, the authority is limited to reviewing and copying.²

Penalties When the Records Fail

A first conviction under § 2257 carries a maximum sentence of five years in federal prison. A second or subsequent conviction raises the range to a mandatory minimum of two years and a maximum of ten years. Both offenses also carry fines set under the general federal sentencing statute.¹

For an individual, the maximum fine for a federal felony is $250,000. For an organization, the cap is $500,000. If the offense produced a financial gain or caused a financial loss, the fine can be set at twice the gross gain or twice the gross loss, whichever is greater.⁹

A companion statute, 18 U.S.C. § 2257A, extends materially the same record-keeping duties to simulated sexually explicit conduct involving real people, with a limited certification-based exemption for producers who already collect performer identification in the normal course of business.¹⁰ If the content the custodian handles is simulated rather than explicit, the § 2257A framework applies alongside the duties described here.

1
Office of the Law Revision Counsel. 18 USC 2257 – Record Keeping Requirements
2
eCFR. 28 CFR Part 75 – Recordkeeping and Record-Inspection Provisions
3
Office of the Law Revision Counsel. 18 USC 2257 – Record Keeping Requirements
4
eCFR. 28 CFR 75.2 – Maintenance of Records
5
Federal Register. Revised Regulations for Records Relating to Visual Depictions of Sexually Explicit Conduct
6
eCFR. 28 CFR 75.6 – Statement Describing Location of Books and Records
7
eCFR. 28 CFR 75.4 – Location of Records
8
eCFR. 28 CFR 75.5 – Inspection of Records
9
Office of the Law Revision Counsel. 18 US Code 3571 – Sentence of Fine
10
Office of the Law Revision Counsel. 18 USC 2257A – Record Keeping Requirements for Simulated Sexual Conduct