Why records carry so much weight
Policies describe what a business intends to do. Records show what it actually did. When a payment partner, an auditor or a regulator examines an adult business, they test the records far more closely than the policies, because records are much harder to produce after the fact.
For an adult business, records serve several purposes at once. They demonstrate that every participant was an adult whose identity was confirmed. They show that each participant consented to the specific content. They allow the business to respond quickly to a complaint or a takedown request. They support tax and payroll reporting. They give payment partners a basis for releasing payouts and continuing the relationship.
A business with complete, well organised records can answer most questions within hours. A business with records scattered across email inboxes, old vendor portals and personal drives may need weeks, and in the meantime its partners may suspend services. Investing in record keeping early is far cheaper than reconstructing records under pressure.
The US 2257 record keeping regime
In the United States, 18 U.S.C. 2257 requires certain producers of sexually explicit content to create and maintain records verifying the age and identity of every performer. The statute is supported by federal regulations that set out in more detail what records must contain, how they must be organised and where the business must state that the records are held.
In general terms, the regime expects a producer to examine a performer's government identification before production, record the performer's legal name and date of birth along with any other names used, keep a copy of the identification and index the records so that each performer can be linked to the content in which they appear. Content subject to the regime typically has to carry a statement identifying where the records are kept and the custodian responsible for them.
The regulations distinguish between those who produce content directly and those who publish or distribute content produced by others, and set expectations for each. The precise scope and the obligations that attach to each role are technical, have been the subject of litigation and are best confirmed with US counsel.
When US rules reach a non-US business
Many adult businesses outside the United States still find that 2257 matters to them. Content may be produced in the United States, feature US-based performers, be sold to US consumers or be distributed through US platforms and partners. Payment partners and hosting companies with US connections often require 2257-style records as a contractual condition, whether or not the statute applies directly to the business.
As a result, many non-US studios and platforms adopt 2257-compliant record keeping as their standard, because it satisfies the most demanding of their partners and simplifies licensing to US buyers. A licensor selling a catalogue to a US distributor will usually find that the buyer insists on receiving records in a form that meets US expectations.
Whether the statute applies to a given business is a legal question that depends on the facts. What is clear is that a business seeking to work with US-connected partners should expect to be asked for records of this kind and should be able to produce them.
Other record keeping obligations
Age and identity records are the most visible obligation, but they sit alongside several others that any adult business needs to manage.
- Consent and release records for each production or upload, showing what each participant agreed to and how the content may be used.
- Contracts with performers, creators, agencies, licensees and suppliers.
- Corporate and financial records required by company law and tax authorities in each jurisdiction where the group operates.
- Payout and tax records for creators and performers, including tax identification and amounts paid.
- Moderation and takedown logs showing what content was reviewed, removed or reported, and when.
- Customer age assurance records where the law in a market requires the business to check that consumers are adults.
- Anti-money laundering records where the business or its payment arrangements are subject to such rules.
Data protection law runs across all of these. It governs how personal data is collected, secured, shared and eventually deleted, and in some cases it limits how long certain data may be kept.
What to keep for each item of content
The simplest way to organise records is around each item of content. For every scene, title, photo set or upload, a business should be able to produce a complete record pack.
| Record | Typical contents |
|---|---|
| Content identifier | Unique ID, title, production or upload date, location |
| Participant list | Every person who appears, with links to their identity records |
| Identity records | Legal name, other names, date of birth, copy of identification, verification method and result |
| Consent record | Signed release or captured consent tied to this content and its permitted uses |
| Producer details | Who produced it, and if acquired, from whom and when |
| Publication history | Where and when it was published, and any changes or removals |
The participant record should work in both directions. From any item of content you should be able to find every participant, and from any participant you should be able to find every item in which they appear. That cross-reference is what auditors and partners test most often.
Retention periods
Different obligations come with different retention requirements. Age and identity records under specific regimes, tax records, corporate records and anti-money laundering records each have their own periods, and these vary between countries. Some periods run from the date of production, some from the date content was last published and some from the end of a business relationship.
A practical approach is to build a retention schedule that lists each record type, the obligations that apply to it, the longest applicable retention period and the event that starts the clock. Where obligations conflict, for example where data protection law encourages deletion and another law requires retention, the schedule should record how the business resolves the conflict, usually by retaining for the legally required period and restricting access in the meantime.
Keep in mind that content often remains published, or is relicensed, long after it was produced. Records for a scene filmed many years ago may still be needed today if the scene is still available. Deleting records while the content remains in circulation is one of the most damaging mistakes a business can make.
Storing records securely
Records for adult businesses contain highly sensitive personal data, including identity documents for people who may not want their involvement in the industry known. A breach could cause serious harm to participants and severe consequences for the business.
Store records in a dedicated system with role-based access, encryption at rest and in transit, and a full audit log of who accessed what and when. Limit access to staff who need it, and review access rights regularly. Avoid keeping copies of identity documents in email, chat tools or shared folders. Where verification vendors hold evidence, make sure you can retrieve complete copies, and test that retrieval periodically.
Plan for continuity. If a key vendor fails or a contract ends, the records must still be available. If the business is sold or restructured, the records must transfer with the content. Back-ups should be held securely and tested. A records system that only one person understands is a single point of failure.
Write a short procedure describing how the records system works: where each record type lives, who may access it, how new records are created and indexed, and how records are retrieved for an audit. Train at least two people to run it. When staff leave, remove their access the same day and check that nothing they managed sits outside the main system.
Preparing for audits and partner reviews
Payment partners, card acquirers and licensees may audit records, either as part of onboarding, at periodic review or after a complaint. Audits usually involve sampling: the reviewer selects items of content or participants and asks for the full record pack for each.
To prepare, run your own internal sample tests at regular intervals. Pick items at random, including older content and acquired catalogues, and check that every record is complete and retrievable within a short time. Note any gaps, fix them and keep a log of what you found. This log is useful evidence in itself, because it shows that the business monitors its own controls.
When an external audit takes place, respond with complete packs rather than piecemeal documents. If a record is missing, say so and explain what you are doing about it, including whether the content has been taken down pending remediation. A reviewer who finds an undisclosed gap will question every other record.
Acquired and licensed catalogues
Buying or licensing content from another producer is a common source of record gaps. The seller may provide a warranty that records exist, but a warranty does not let you produce those records on request. Before acquiring content, obtain complete record packs for every item, check them against the content and store them in your own system.
Where the seller cannot provide complete records for some items, do not publish those items until the gaps are closed. Your partners will treat acquired content exactly as they treat content you produced, and an incomplete record for an acquired title is as serious as one for your own production. For group structures where one entity holds rights and another publishes, see our article on adult platform structures.
General information only
This article is general information about record keeping for adult businesses. It is not legal advice. Whether and how 2257 or any other regime applies to you depends on your facts, and you should take advice from qualified counsel in the relevant jurisdictions.
CCYFX works only with adult businesses that keep proper age, identity and consent records for everyone involved. To understand what we review, see our onboarding page.
