2257 Recordkeeping

18 U.S.C. 2257 imposes recordkeeping requirements on producers of certain sexually explicit content. Key requirements include:

• Performer identification — records must confirm each performer's legal name and date of birth, verified against a government-issued ID
• Custodian of records — a designated custodian must maintain and make records available for inspection
• Record retention — records must be retained for a minimum of 7 years
• Alias tracking — all names, stage names, and aliases used by the performer must be recorded

AgeEvidence integrates 2257 recordkeeping directly into the verification workflow:

1. Verification submission — the performer completes a full_kyc verification flow: video recording, ID document capture, liveness challenges, and face matching.
2. Admin review— an admin reviews the evidence, extracts the legal name and date of birth from the ID document, and confirms the performer is at least 18 years old.
3. Automatic record creation— on approval, a performer record is created automatically. No separate API call is required. The record includes:
   • Legal name and date of birth
   • Document type (passport, driver's license, or national ID)
   • Hashed document number (for lookup without storing the raw number)
   • Archived document path in secure storage
   • Link to the source verification
4. Alias registration— stage names and companion names are registered via the API and linked to the performer record.

Performer records are subject to strict retention and auditability requirements:

• 7-year minimum retention — records are retained for at least 7 years from creation, regardless of whether the performer is still active
• Immutable access audit trail — every access event is logged with the actor (admin ID or API key prefix), IP address, user agent, access type (view, download, review, audit, export), and timestamp
• No deletion during retention — performer records cannot be deleted during the retention period, even in response to GDPR erasure requests (legal obligation basis)
• Deactivation without deletion — records can be marked inactive (performer no longer creating content) without deleting the underlying data

Records can be exported for compliance inspections and audits:

• JSON export — individual or bulk export through the admin API
• Complete data — exports include all record fields, associated verification data, and the full access audit trail
• Export logging — export events are themselves recorded in the audit trail
• Signed URLs — document images are accessible via time-limited signed URLs (1 hour for admin, 1 hour for export)

2257 recordkeeping is relevant for:

• Creator platforms — platforms where users upload sexually explicit content
• Adult content producers — studios and independent producers
• Content distribution networks — services distributing adult content produced by others

If your platform does not involve sexually explicit content, the full_age or age_only verification levels may be more appropriate. See Age-Only Verification or Full KYC & 2257 for details.