2257 for solo creators: yes, it applies to you, and here's the file to build

The most stubborn piece of paperwork folklore in creator spaces goes like this: "18 U.S.C. § 2257 is a studio regulation. I only film myself, alone, in my own bedroom, for my own OnlyFans — so it doesn't apply to me." I believed a version of that for about a week when I started self-producing. Then I actually read the thing, and the logic collapsed: 2257 puts the record-keeping duty on the producer of sexually explicit content. When you film yourself and publish it, there is a producer in the room. It's you.

Before anything else: I'm not a lawyer. I spent years writing and reviewing contracts in a different industry, and I maintain my own 2257 file now as a self-producer — that's the seat I'm writing from. This post is how I think about the regulation as the person who has to comply with it, not legal advice. For anything that affects your real exposure, pay a lawyer who knows adult-industry law in your jurisdiction.

Does 2257 apply if I only film myself?

The short version: the statute and its regulations (28 CFR Part 75) attach to anyone who produces visual depictions of actual sexually explicit conduct. "Produces" is defined broadly enough that the person who sets up the tripod, performs, edits the clip, and uploads it is squarely inside it. Nothing in the text carves out "unless the producer and the performer are the same person." A solo self-shooter is a one-person studio, and the studio obligations come with the camera.

The myth survives because the regulation reads like it was written for studios — and it was, in the sense that nobody drafting it in the late '80s imagined a creator economy where the performer, producer, editor, and distributor are one person with a ring light. But "the rule wasn't written with me in mind" and "the rule doesn't apply to me" are very different sentences. The first is true. The second is the folklore.

What softens the blow is that solo compliance is genuinely easy. You are the performer, so you already have everything the file needs. Building it takes an evening. The creators who get hurt by 2257 aren't the ones who built a slightly imperfect file — they're the ones who decided the whole thing was studio stuff and built nothing.

What does a 2257 record actually contain?

For every performer in every explicit depiction you produce — which, solo, means you, in everything — the file holds:

• A copy of a government-issued photo ID. Not "I checked it once" — an actual legible copy retained in the records. You examined the ID to verify legal name and date of birth; the copy proves you did.
• Legal name and date of birth. The real one, even though it never appears anywhere public.
• Every alias, stage name, professional name, nickname, and maiden name the performer has ever used. Yes, all of them. My file lists names I haven't used in years. The point is that an inspector can connect any name a depiction was ever published under back to a verified legal identity.
• The title or identifier of each depiction and its date of production. Filename, scene title, URL — something that pins this record to this content, and when it was made.
• A cross-reference system. The records have to be organized so they can be retrieved by legal name, by any alias, and by the title/URL of the depiction. For a studio that's a database. For you it's a spreadsheet.

A few details around the edges of this list — like the inspection-availability rules, which were drafted for businesses with premises and office hours and sit awkwardly on a person shooting in their apartment — are genuinely contested and have been litigated. I'm not going to pretend I can tell you how those shake out. I'm not a lawyer; how the inspection provisions apply to a home-based solo creator is an ask-a-lawyer item, full stop. The core record-keeping duty above is the uncontested part, and it's the part you can just do.

What's the difference between a primary and secondary producer?

The regulation splits "producer" in two, and the plain-language version is worth having in your head:

A primary producer is whoever actually creates the depiction — points the camera, captures the image. A secondary producer is whoever publishes, reproduces, or reissues it afterward — the site that licenses your scene, the distributor that re-cuts it.

Solo, you're the primary producer of everything you shoot, and arguably the secondary producer of everything you publish too — both hats, one head. The distinction starts mattering when content changes hands: a primary producer keeps the full records including the ID copy they personally verified; a secondary producer's obligations are met partly through copies of records obtained from the primary. If you ever license a clip to someone else's site, that's the machinery that kicks in. Day to day, filming yourself for your own pages, the takeaway is simpler: there is no version of the producer definition you fall outside of.

Doesn't OnlyFans already have my ID?

It does. You uploaded your ID, did the face match, filled out the tax form. And none of that is your 2257 file.

Platform verification exists to satisfy the platform's obligations — their banking relationships, their own compliance posture, their terms of service. OnlyFans's terms make creators responsible for legal compliance on the content they upload, and 2257's duty runs to the producer, not the host. "OnlyFans has my ID somewhere in their systems" gives you no records you control, no cross-reference tying your aliases to your depictions, nothing you could produce if you were ever the one asked. The platform's file is theirs. The producer's file is yours, and only one of you is the producer.

The same logic applies in reverse, and it's worth saying because the assumption is so common: a platform's compliance page doesn't cover you, and your file doesn't cover them. Each layer of the distribution chain answers for itself. Exactly where a platform's responsibilities end and a creator's begin on a given site is — again, not a lawyer — a question for someone with a bar card, because it turns on terms of service and regulatory readings I'm not qualified to settle. But "I verified with the platform, so I'm done" is the version of the myth I'd most like to kill.

What's a custodian of records when the company is one person?

Every explicit depiction is supposed to carry a statement identifying where the 2257 records are kept and who keeps them — the custodian of records. On studio sites it's that legalese block in the footer naming a person and a street address.

When you're a one-person operation, the custodian is you. That's the easy part. The uncomfortable part is the address: the statement points to a physical location where the records are maintained, and for a solo creator working from home, the obvious candidate is the place you sleep. Some creators use a lawyer's office as the records location, some use a business address, some structure it other ways — and which of those arrangements satisfies the regulation while protecting your privacy is one of the most important ask-a-lawyer items in this entire post. I'm not a lawyer, and this is exactly the kind of question where a few hundred dollars of real legal advice buys you something a blog post can't: an answer that accounts for your state, your entity, and your safety.

What I'll say from the operator's seat: don't let the address question stall the file. Build the records first. The custodian statement is a formatting problem; the missing file is the substantive one.

What does a working setup look like for one person?

Mine is unglamorous, which is the point. One folder, backed up in two places, that contains:

• identity/ — the ID copy, plus a single document listing legal name, date of birth, and every name I've ever performed or published under. When a new alias appears (a collab handle, a platform variant), it gets added the same day.
• productions/ — one line per published piece of content in a spreadsheet: production date, title/filename, where it was published, and which performer record it points to. Solo, that last column is boring. It won't stay boring.
• forms/ — a completed 2257 form per performer. I built a free §2257 generator into the site that produces a clean PDF with the ID image embedded — it's one of the four paperwork tools I published precisely because this form is the one every self-producer needs and nobody hands you. The tool generates the form; you keep the record. Nothing you type touches my server.

Update it the day you publish, not "eventually." A 2257 file reconstructed eighteen months later from platform timestamps and memory is a worse file than one maintained in real time, and the habit costs about ninety seconds per upload.

On retention: keep everything for as long as you're publishing, and assume a multi-year tail after you stop — figures like seven years after ceasing business circulate, and the exact math is another confirm-with-a-lawyer detail (still not a lawyer). Storage is free. My working rule is simpler: the file outlives the content, period.

What changes the day you shoot with a second person?

Everything about the file, and nothing about the principle.

The day another performer is in your frame, you are the primary producer of a depiction featuring someone whose identity you have not verified yet — so before the camera rolls, you do for them exactly what you did for yourself: examine a government photo ID, keep a copy, record legal name and date of birth, list every alias, and tie their record to the production in your cross-reference. If they're also going to post the content on their pages, they're a producer too, and they need the same records from you. Two one-person studios, two mirrored files. That mutual-paperwork moment is exactly what a content-trade agreement is built around, and it's why I treat the 2257 exchange as step one of any collab conversation, not an awkward afterthought at the shoot.

This is also the moment the stakes change. Solo, every fact in your file is about you, verified by you, with no real uncertainty in it. With a second performer, the file is now your evidence that you verified someone else's age and identity — which is the entire reason the statute exists. If there was ever a time to have a lawyer sanity-check your records practice, it's before your first collab, not after.

The myth says 2257 starts applying when you stop being solo. The truth is it applied from your first upload — going solo just meant the file was easy. Build it while it's easy. The version of you that books a first collab, or licenses a clip, or gets the email you never expected, will inherit either a clean folder or a scramble.

— Sly