18 USC 2257 for OnlyFans Agencies: Custodian of Records

TL;DR. 18 USC 2257 is the US federal statute that forces producers of sexually explicit visual content to keep age and identity records for every performer, retain them for seven years, designate a custodian of records at a physical US address, and display a compliance statement. For an OnlyFans agency, the trap is the phrase "secondary producer": once you assemble, schedule, edit, caption, or post creator content across a roster, federal regulators can treat you as a producer on that content, even though the creator shot it. That means the 18 USC 2257 OnlyFans agency question is not academic. Getting it wrong exposes you to warrantless-style DOJ inspection demands and criminal penalties of up to five years in prison per violation (up to ten years for repeat offenses). This guide explains who counts as a producer, how to appoint a custodian of records, what to collect at onboarding, and how offshore agencies handle the US-nexus problem. It is educational, not legal advice.

Key sources for this guide: the statute at 18 U.S.C. 2257 and the secondary producer definition in 28 CFR 75.1.

The adult-content economy is now large enough that regulators pay attention to its plumbing. OnlyFans's FY2024 filing reported roughly $7.22B in gross fan spending, about $5.8B paid to creators, 4.63M creators, and 377.5M fans. When money and scale reach that level, the paperwork under it stops being optional. Most agency owners have internalized state age-verification laws and platform AI rules. Far fewer have read the federal production-side statute that sits underneath every explicit frame their team touches.

What 18 USC 2257 actually requires

18 USC 2257 (backed by its regulations at 28 CFR Part 75) is a record-keeping law, not a content ban. It does not tell you what you may publish. It tells you what you must prove and preserve about the people in the content.

At its core, any producer of a visual depiction of an actual human being engaged in actual (or, under the companion statute 2257A, simulated) sexually explicit conduct must do four things.

Collect age and identity records for every performer

Before content is produced, the producer must verify that each performer was at least 18 at the time of production. Verification is done by examining a government-issued photo ID, then recording the performer's legal name, date of birth, and every name the performer has ever used (stage names, maiden names, aliases, previous performer handles). You keep a copy of the ID and cross-reference it to the specific content. The point is that a regulator can pick any frame and trace it back to a verified adult.

Retain the records for seven years

Records must be kept for seven years from the date the content was produced, and for at least five years after you stop being a producer, whichever period is longer in practice. This is a long tail. Content you posted for a creator who left your roster two years ago still carries a live retention duty.

Organize records so they are indexable and inspectable

The regulations require records to be organized so that a specific depiction can be matched to a specific performer's records, typically alphabetically by every name used and cross-indexed to titles or URLs. A shoebox of IDs is not compliance. The DOJ standard assumes an inspector can walk in and pull the file behind any given image within a reasonable time.

Display a compliance statement (the "2257 notice")

The producer must affix a statement to the content describing where the records are kept. For online material, the accepted approach is a visible "18 U.S.C. 2257 Record-Keeping Requirements Compliance Statement" that names the custodian and gives a physical address where records are maintained. This is the line of small print you have seen at the bottom of adult sites. It is a legal artifact, not decoration.

Primary producer vs secondary producer

The distinction that matters most to agencies is who counts as a "producer."

• A primary producer is the person who actually films, photographs, or digitizes the sexually explicit conduct. For most OnlyFans content, that is the creator herself, shooting on her own phone.

• A secondary producer is broader. Under 28 CFR 75, a secondary producer includes anyone who produces, assembles, manufactures, publishes, duplicates, reproduces, or reissues content for commercial distribution, or who "inserts on a computer site or service" a depiction, or "otherwise manages the sexually explicit content" of a site or service that contains such a depiction.

Read that second definition slowly, because it is the whole ballgame for agencies. "Manages the sexually explicit content" is exactly what a management agency does.

Why managing multiple creators can make you a secondary producer

An OnlyFans agency does not shoot the content. Owners often assume that fact ends the conversation. It does not.

The agency's daily workflow is "managing content"

Consider what a white-label team actually does across a roster: it receives raw media from creators, selects which pieces get posted, schedules them, writes captions, builds pay-per-view sets, uploads to the creator's account, and runs the mass-message campaigns that distribute that content to fans. Every one of those verbs (assemble, publish, duplicate, reissue, insert, manage) maps onto the secondary-producer definition. The more of the pipeline you own, the more clearly you are managing sexually explicit content for commercial distribution.

A creator posting her own single account from her own phone is a primary producer with a self-contained duty. An agency running that pipeline for ten, twenty, or forty accounts is doing something categorically different at scale. Scale is precisely what turns "she posted a photo" into "we operate a content-distribution operation."

The multiplier: every creator, every piece

The exposure is not per-agency, it is per-depiction. Seven-year retention attaches to each piece of qualifying content for each performer. An agency managing forty creators who each post daily generates an enormous, continuously growing archive of records it may be obligated to hold and index. This is why 2257 compliance adult content obligations feel small for a solo creator and large for an operator. You are not carrying one performer's file. You are potentially carrying the files for an entire fleet.

Where the legal edges are genuinely unsettled

Be honest about two grey areas. First, the reach of the secondary-producer rule has been litigated for years. In the long-running Free Speech Coalition litigation, federal courts wrestled with the statute's constitutionality, narrowed some applications, and held that regulators generally must obtain a warrant before an inspection. The law is not static. Second, platforms like OnlyFans run their own performer-verification systems, which some argue shifts the record-keeping center of gravity to the platform. Neither point makes the statute disappear for a business that actively manages explicit content for distribution. Both are reasons to get a qualified adult-industry attorney to assess your specific structure rather than guess.

The custodian of records role

If any part of 2257 applies to your operation, you need a custodian of records. This is not a filing cabinet. It is a named human with legal responsibilities.

What the custodian actually is

The custodian of records is the specific person designated to hold, organize, and produce the age and identity records on demand. The custodian's name and a physical US address must appear in your compliance statement. When regulators come looking, they come looking for that person at that address. "Custodian of records OnlyFans" is not a title someone in your Discord picks up casually. It is the individual whose name goes on the public statement and who is answerable for the archive.

The three hard requirements

1. A named person. Not a company alone, not "the operations team." A statement should identify the individual serving as custodian (a business entity can be listed, but a responsible natural person is expected to be reachable).

2. A physical US address. The regulations contemplate records being available at a physical location in the United States. A PO box or an offshore address does not satisfy the intent. This is the single biggest structural problem for non-US agencies, and we address it below.

3. An availability window. Records must be available for inspection during normal business hours, and the regulations reference a minimum weekly availability (on the order of 20 hours per week) at the stated location, without advance notice being required to justify an inspection. The custodian, or a delegate at that address, has to be able to produce the files.

How to appoint one

• Pick a responsible person tied to a US legal entity, or engage a professional third-party custodian service. The regulations expressly permit a non-employee (third-party) custodian to hold the records rather than the producer doing it in-house, and permit records to be maintained digitally. Note that using a third-party custodian does not, by itself, relieve the producer of liability.

• Put the appointment in writing, and make the custody duty a named clause in your internal governance and in your creator agreements, so the chain of responsibility is documented. Your OnlyFans management contract clauses are the right place to define who verifies, who holds records, and who indemnifies whom.

• Keep the custodian's contact and address current in the displayed statement. A stale address is itself a defect.

What records to collect at creator onboarding

The cleanest agencies solve 2257 at the front door, not after a subpoena. Onboarding is where you build the evidentiary spine that protects the whole roster, and if intake is loose, every downstream duty inherits that looseness. Our guide to a creator's first 30 days on an agency roster covers where these steps slot in.

The minimum record set per performer

• A clear copy of a valid government-issued photo ID showing the performer is 18 or older.

• The performer's legal name and date of birth.

• Every alias, stage name, and prior handle the performer has ever used, so records can be indexed by all of them.

• A dated record of when verification occurred and who performed it.

• For any content that includes a second person on camera, the same full record set for that person. This is the most commonly missed item and one of the most dangerous, because collab and guest content lands on your roster with an unverified stranger in frame.

Store it like evidence, not like a chat attachment

IDs and dates of birth are among the most sensitive data you will ever hold. Treat the store as a security problem, not a Google Drive folder.

• Encrypt records at rest and in transit, restrict access to the smallest possible number of people, and log who accesses what.

• Keep the 2257 archive segregated from day-to-day content workflow, so a compromised operator account does not expose every performer's ID.

• Never route ID documents through disappearing chats or personal messaging apps where they cannot be retained or secured.

• Maintain a retention clock. Because the duty runs seven years, you need a system that does not silently delete records when a creator offboards. Retention here can outlive the working relationship.

Handled well, this same discipline pays off elsewhere. The clean chain of identity and consent you build for 2257 is exactly what you reach for when defending a creator against impersonation or non-consensual reposting. See our work on protecting creators from leaks and DMCA enforcement and on the TAKE IT DOWN Act, the 2025 US federal law criminalizing non-consensual intimate imagery with a 48-hour platform takedown rule.

DOJ inspection risk and penalty exposure

This is the section that changes behavior, so read it carefully and without panic.

What an inspection looks like

The enforcement scheme empowers the Department of Justice to inspect a producer's records. Historically the regulations contemplated inspections during business hours at the custodian's stated address, without advance notice and without individualized suspicion. Litigation has since pushed toward requiring a warrant in at least some circumstances, a meaningful protection but not a reason to be unprepared. The practical takeaway is unchanged: your custodian must be able to produce a complete, indexed record set for any depiction on demand. If the files are not there, or cannot be matched to the content, that is the violation.

The penalty exposure

The criminal penalties are serious and they are federal.

• A first violation of 18 USC 2257 is punishable by imprisonment of not more than five years, plus fines.

• A repeat violation, after a prior conviction under the section, carries imprisonment of not less than two years and not more than ten years, plus fines.

Note what is being punished. It is not the content. It is the failure to keep, index, or produce the records, or the failure to affix the compliance statement. You can run entirely lawful, consensual, adult content and still commit a 2257 violation purely on paperwork. That is the uncomfortable heart of this statute for operators: the risk is administrative in nature and criminal in consequence.

Why "we didn't know we were a producer" is a weak defense

The secondary-producer definition is broad on purpose. An agency that built its whole business around managing explicit content for distribution will struggle to argue it never considered itself a producer of that content. The defensible posture is not ignorance. It is a documented, good-faith compliance program: a named custodian, a real address, a real archive, a displayed statement, and written proof that you verify age at intake. Regulators and courts treat a genuine program very differently from an absence of one.

How offshore and non-US agencies handle the US-nexus question

A large share of OnlyFans agencies are run from outside the United States. The natural question is whether a foreign operator escapes a US statute. The honest answer is: it is complicated, and "we are offshore" is not a clean exit.

Where the US nexus comes from

2257 is a US law, but the content, the platform, the payment rails, the fans, and often the creators touch the United States constantly. OnlyFans operates in the US market, a large portion of paying fans are American, and the compliance statement itself presumes a US point of contact. An offshore agency distributing explicit content into the US market has meaningful US nexus even if its desks sit in another country. The statute's reach into foreign operators is unsettled and fact-specific, which is a reason for caution, not comfort.

Practical structures operators use

Without giving legal advice, here is how careful cross-border operators tend to think about it.

• Appoint a US-based custodian or use a professional third-party custodian service so there is a genuine physical US address and a responsible person who can respond to an inspection. This directly answers the requirement that most trips up offshore agencies.

• Push primary-producer record-keeping toward the creator and the platform, and document it in your agreements rather than leaving that division of responsibility implicit.

• Stand up a US legal entity if your distribution footprint and revenue justify it, so custody, contracts, and liability sit inside a structure built for the market you actually serve.

• Get jurisdiction-specific advice. The interaction of your home country's law, US law, and platform terms needs a real attorney who works with adult-industry clients across borders. Do not resolve it from a forum thread.

Do not confuse 2257 with the other three compliance layers

Agency owners routinely blur four separate regimes. Keep them distinct:

• 18 USC 2257 is the federal production-side record-keeping statute covered here. It is about proving performers are adults and preserving that proof.

• State age-verification laws are consumer-side. They govern how sites confirm a viewer is an adult before showing content, and they vary state by state. We cover those in depth in age-verification laws for OnlyFans agencies.

• Platform and AI rules govern automation, chatbots, and disclosure on the platform itself. See our breakdown of AI chatting compliance rules.

• Non-consensual imagery law, including the TAKE IT DOWN Act, governs takedown and consent, not intake records.

A mature agency treats these as four lanes with four owners, not one vague "compliance" bucket. Conflating them is how gaps form.

Frequently asked questions

Does 18 USC 2257 apply to OnlyFans creators and agencies?

For any producer of explicit visual content depicting real people, yes, the statute's record-keeping duties are designed to apply. Whether it reaches a given agency turns on whether that agency counts as a producer, and the secondary-producer definition ("assembles, publishes, inserts, or otherwise manages the sexually explicit content") is broad enough that a firm actively managing and distributing creator content for a roster should assume it may be in scope. The platform and the creator having their own duties does not automatically remove yours. Get a qualified attorney to assess your specific setup rather than assuming you are exempt.

What is a secondary producer under 2257?

A secondary producer is anyone who produces, assembles, publishes, duplicates, reproduces, or reissues explicit content for commercial distribution, or who inserts a depiction onto a site or service, or otherwise manages the sexually explicit content of such a service. A primary producer actually films or photographs the conduct. The distinction matters because a management agency that schedules, edits, uploads, and distributes a creator's content is doing the exact activities the secondary-producer definition describes, even though it never held the camera.

Who can be the custodian of records for an OnlyFans agency?

The custodian is a named person, associated with a physical US address, who holds and can produce the age and identity records on inspection. It can be a responsible individual inside a US legal entity, or a professional third-party custodian service, which the regulations expressly permit, along with digital record storage. The custodian's name and address must appear in your displayed compliance statement, and records must be available during business hours (the rules reference roughly 20 hours per week) at that location.

What are the penalties for a 2257 record-keeping violation?

A first violation is punishable by up to five years of federal imprisonment plus fines. A repeat violation after a prior conviction carries between two and ten years plus fines. Critically, the offense is the record-keeping or labeling failure itself, not the content, so an agency running fully lawful adult content can still face criminal exposure purely for missing records, a broken index, or an absent compliance statement.

How long do we have to keep 2257 records?

Records must be retained for seven years from the date the content was produced, and kept for a further period after you stop being a producer (the regulations reference at least five years after ceasing production). In practice this means offboarded creators still carry a live retention duty, so your storage system must not auto-delete when a working relationship ends. Build a retention clock, keep the archive encrypted and access-controlled, and treat deletion as a scheduled, documented event rather than a cleanup.

Are we exempt because OnlyFans already verifies performers?

Not automatically. Platform verification is a genuine and helpful control, and it is one reason the record-keeping center of gravity for primary producers can sit with the creator and the platform. But it does not, by itself, erase a secondary producer's own obligations, and it does not give you a custodian, an address, an index, or a displayed statement. The safe posture is to document the division of responsibility in your contracts and still maintain your own defensible program. Have counsel confirm what platform verification does and does not cover for your structure.

Where WhaleFinders fits

We run OnlyFans content operations for agencies across a large, multi-creator footprint, which means we live inside exactly the workflows that trigger the secondary-producer question: intake, scheduling, editing, posting, and distribution at fleet scale. That vantage point taught us to treat 2257 as an onboarding discipline, not a legal fire drill. When WhaleFinders manages a roster on your behalf, age-and-identity intake, segregated encrypted storage, retention clocks, and a clean chain of consent are built into the standard operating procedure, so the paperwork spine exists before anyone needs it. We are operators, not your lawyers. On custodianship, entity structure, and cross-border nexus, retain qualified adult-industry counsel. What we can do is keep the day-to-day machine that touches every explicit frame running in a way a compliance program can actually stand on.

---

This article is for general educational purposes only and is not legal advice. 18 USC 2257 and its regulations are complex, actively litigated, and fact-specific, and their application to any particular agency depends on your structure, jurisdiction, and workflow. Consult a qualified attorney experienced in adult-industry and record-keeping law before making compliance decisions.