The 2257 Form Explained: What OnlyFans Creators Actually Need to Do

Alice McKinley

Alice McKinley is a Content Protection Specialist at CopyrightShark (since 2023), helping OnlyFans, Fansly, Patreon creators and more with DMCA enforcement, platform reporting, and long-term protection strategies.

Published Mar 19, 2026

Share

Every adult content creator on OnlyFans has seen the term “2257 form” on compliance pages and in creator forums, usually alongside horror stories about federal fines, prison time, and permanent account bans. But here is what most guides will not tell you: if you are a solo creator posting exclusively on OnlyFans, your direct obligations under 18 U.S.C. 2257 may be far less burdensome than you think. OnlyFans’ parent company, Fenix International Ltd, voluntarily acts as the custodian of records and secondary producer for content on its platform. That changes the equation significantly. This guide breaks down exactly what the 2257 form requires, who actually needs to comply, and where the real risks lie, especially when you start collaborating with other creators. No legal jargon, no product pitches, just the facts from the actual statute and DOJ regulations.

What is a 2257 form and why should creators care?

18 U.S.C. 2257 is a federal law passed in 1988 that requires producers of certain sexually explicit content to keep records verifying every performer is 18 years or older. The official name is the “Child Protection and Obscenity Enforcement Act” record-keeping provision. When people talk about a “2257 form,” they typically mean the model release form and ID documentation packet that satisfies those record-keeping requirements.

The law defines “sexually explicit conduct” broadly. It covers actual intercourse (vaginal, anal, oral), masturbation, and lascivious exhibition of genitalia or pubic areas. If your content includes any of that, 2257 applies, at least in principle. The question of exactly how it applies to you as a platform creator is where most guides get it wrong.

Why does this matter practically? Two reasons. First, federal violations carry real penalties: up to 5 years for a first offense, up to 10 years for repeat violations. Second, and more immediate for most creators, platforms enforce their own 2257-derived rules independently of federal enforcement. OnlyFans can terminate your account for 2257 non-compliance without the DOJ ever getting involved.

The term “2257 compliance” gets thrown around to mean different things: the federal statute obligations, the model release documentation, the platform verification rules, and the custodian of records designation. If any of these legal terms are unfamiliar, our DMCA and copyright glossary covers the basics. This guide treats each concept separately because they have different implications for different types of creators.

Who needs to comply: primary vs secondary producers

The 2257 framework divides producers into two categories. This distinction is where most guides stop being useful.

A primary producer is any person who actually films, photographs, or otherwise creates a depiction of sexually explicit conduct. If you set up a camera and film yourself, you are a primary producer. If you hire or collaborate with another performer and direct or film the content, you are also a primary producer. The obligation here is the strictest: you must create and maintain the full records set.

A secondary producer is any person who publishes, reproduces, or distributes content created by someone else but does not itself produce the original depiction. Think distributors, hosting platforms, and aggregators. Under 28 CFR 75.7, a secondary producer still has 2257 obligations, but those obligations are significantly different from a primary producer’s. The secondary producer can satisfy the law by obtaining a copy of the primary producer’s records, rather than independently verifying every performer.

What most guides miss: under 28 CFR 75.7, a secondary producer can also designate a single custodian of records who maintains those records on behalf of all secondary producers in a distribution chain. When a platform voluntarily takes on that custodian role, the individual creators distributing through that platform get meaningful coverage.

The real-world effect: OnlyFans, as a secondary producer with custodian status, sits between federal inspectors and individual solo creators. For solo content you produce yourself and post only to OnlyFans, your direct exposure is substantially different from what you would face if you were selling the same content through your own website.

OnlyFans and the secondary producer exemption

OnlyFans’ 2257 compliance page (onlyfans.com/usc2257) explicitly names Fenix International Ltd (the UK-based parent company) as the designated custodian of records. This is not an accident or legal technicality. It is a deliberate business decision that has direct implications for creators on the platform.

Under 28 CFR 75.7(c), a secondary producer who obtains records from a primary producer and maintains them satisfies the secondary producer’s obligations. OnlyFans has structured its compliance program so that the platform itself serves this function. The age verification and identity documentation you submit when creating an account and uploading content feeds into Fenix’s record-keeping system.

What this means for solo creators on OnlyFans

If you are a solo creator (meaning all content you post shows only yourself, and you are not collaborating with other performers), your practical 2257 compliance picture looks like this:

• OnlyFans has your age verification documentation on file (passport, government ID)
• Fenix International Ltd is the designated custodian of records for content on the platform
• Your content’s production records are effectively held at the platform level

This does not mean you have zero obligations. You still need to ensure your account’s age verification is complete and current. You still cannot post content involving other performers without their records. And if federal inspectors ever requested records for your content, OnlyFans would respond as the custodian.

What it does mean: you do not need to maintain a separate, independent 2257 records archive for solo content posted exclusively to OnlyFans, in the way you would if you were running your own adult website.

The limits of platform coverage

This protection has real limits that matter. Platform coverage does not extend to:

• Content you also host on personal websites or other platforms
• Collab content (other performers’ records are your direct obligation as primary producer)
• Content you sell through your own direct-to-fan stores outside OnlyFans
• Any situation where you are the primary producer and distributing outside OF

The secondary producer exemption also assumes OnlyFans continues operating its compliance program correctly. If the platform’s records are ever found deficient, individual creators could face scrutiny. In practice, the compliance risk for a solo OF creator is real but significantly lower than what most fear-based guides suggest.

When 2257 fully applies to you: collaborations and personal sites

The picture changes completely the moment another performer appears in your content.

Collab shoots make you a primary producer under 18 U.S.C. 2257, full stop. It does not matter that you are posting the content to OnlyFans. You personally filmed or participated in creating explicit content depicting another person. That triggers your direct obligation to collect, verify, and maintain that performer’s records. OnlyFans’ platform-level compliance does not cover the records you are personally required to hold for your co-performers.

For collab content, you need:

• The performer’s legal name (as shown on government ID)
• Date of birth
• A copy of a valid government-issued photo ID showing age (passport, driver’s license, or similar)
• Any aliases the performer uses professionally
• The date(s) of content production
• Your own name and address as the records custodian

Personal websites are an entirely separate situation. If you run your own website and post explicit content there, you are both the primary producer (of your own content) and the secondary producer responsible for your own distribution. There is no platform custodian to absorb any of that. You need a complete 2257 records system and a publicly displayed custodian of records statement on the site.

The decision framework is straightforward:

See our Fansly guide for how this plays out on a different platform with different compliance terms.

2257 record-keeping requirements: the complete checklist

When you do have direct 2257 obligations (which you will for any collab content), here is exactly what the law requires you to keep.

For each performer:

• Full legal name (exactly as on government ID)
• Date of birth
• Any professional aliases or stage names (including usernames, handles, and screen names)
• A copy of a government-issued photo ID showing name and date of birth

Acceptable IDs include a U.S. passport, U.S. driver’s license, U.S. state ID card, foreign passport (if it includes date of birth), or similar official document. The copy must be legible. A photo taken on a phone works as long as the details are clear.

For each production:

• Date(s) on which the content was produced
• Title or identifying description of the content
• Your name and address as the records custodian (or your designated custodian’s information)

Retention period: You must keep these records for 7 years after the last date on which the content was commercially distributed, or after the content was removed from distribution. That is the longer of the two. If you posted a collab video in 2023 and removed it in 2025, your records obligation runs until 2032.

Model release form for OnlyFans collabs should capture all of the above in a single signed document. A good release also includes:

• The performer’s written consent to the specific content being produced
• Payment or compensation terms (if any)
• Scope of permitted use (platforms, duration, exclusivity)
• Both parties’ signatures with date

The consent and compensation elements are not strictly required by 2257, but they protect you in other ways: platform policy compliance, civil disputes, and proof of non-coercion if questions ever arise.

How to store 2257 records securely

The law requires that 2257 records be kept at a specified address and be available for inspection by the Attorney General (in practice, this means DOJ officials). “Available for inspection” doesn’t mean publicly accessible. It means accessible when a legitimate inspection notice is given.

Digital storage is fully acceptable. There is no requirement to keep physical paper records. What matters is that:

• Files are organized and retrievable by content title or performer name
• The storage location has a specific, identifiable address (your home, business address, or a legal custodian’s address)
• You can produce the records within the inspection period if requested

Practical folder structure for digital records:

/2257-records/
  /performers/
    /[performer-alias]/
      - legal-id-copy.jpg
      - model-release-signed.pdf
  /productions/
    /[content-title-or-date]/
      - production-date.txt
      - performers-list.txt

Encryption: No legal requirement for encryption exists in the statute, but basic security is sensible. A password-protected folder or encrypted drive protects performer data from exposure if your device is compromised.

Cloud storage: Google Drive, Dropbox, iCloud, and similar services work for storage as long as you control the account and can access files reliably. Don’t delete records to free up space. The 7-year retention period is a legal obligation, not a suggestion.

Designating a custodian: If you work with a manager, agency, or legal representative who handles your compliance, you can designate them as custodian of records. This must be in writing, and their address becomes the official records location. The designation must be disclosed on any applicable content (a 2257 statement).

For solo OnlyFans creators, the practical advice is: set up a minimal folder structure for any collab records, keep it current, and don’t overthink it. The platform handles the rest.

Platform comparison: OnlyFans vs Fansly vs personal site

No other guide makes this comparison directly, so here it is. The 2257 obligations differ meaningfully across platforms based on what each platform commits to in its compliance posture.

Fansly’s compliance approach is somewhat less transparent than OnlyFans’. Fansly does conduct identity verification for creators, and its terms of service require compliance with applicable laws including 2257. But Fansly has not published a dedicated 2257 compliance page with a named custodian in the way OnlyFans has. The practical implication: creators on Fansly should treat their obligations more conservatively and maintain their own records for all content.

If you operate on both platforms plus your own website, the safest approach is to maintain complete records for everything, regardless of platform coverage. The per-platform analysis matters mainly when you are platform-exclusive and trying to understand your realistic risk exposure.

See our OnlyFans content protection guide for related compliance information specific to the platform.

Penalties for non-compliance: realistic risk assessment

The statutory penalties are real: a first offense conviction under 18 U.S.C. 2257 carries up to 5 years in federal prison. A second or subsequent offense raises that to 10 years. Those are the maximums. Actual sentences vary based on circumstances, cooperation, and prosecutorial discretion.

The most famous enforcement example is the Girls Gone Wild prosecution in the mid-2000s. Mantra Films, the company behind Girls Gone Wild, faced 2257 charges among other counts after a federal investigation found inadequate age verification records for performers. The case resulted in substantial fines and reputational damage. This was a commercial production company at scale, not an independent creator.

The realistic enforcement picture for independent creators differs substantially. The DOJ’s Adult Entertainment Enforcement Unit has historically focused on commercial producers and distributors, not individual creators posting on subscription platforms. Unannounced inspections are legally permitted but practically rare for small operations. There is no public record of a solo OnlyFans creator facing criminal prosecution solely for 2257 record-keeping failures.

Two more immediate risks matter more for most creators:

Platform enforcement: OnlyFans can permanently ban your account for 2257 violations independently of federal action. If a collab partner files a complaint or if a platform audit flags your content, your account can be terminated without a court ever getting involved. This is the more immediate risk for most creators.

Civil liability: Performers can sue producers for various harms including invasion of privacy, failure to obtain proper consent, or distribution of content beyond agreed scope. Proper model release forms and records protect you in civil disputes, not just regulatory ones. The TAKE IT DOWN Act and related federal laws are expanding civil liability exposure for content creators in ways that make good record-keeping more important, not less.

The model release form: what it must include

A 2257-compliant model release for adult content is not the same as a standard photography release. The requirements are stricter and the consequences of getting it wrong are more serious.

Elements required for 2257 compliance:

• Legal name of the performer (as on government ID)
• Date of birth
• All aliases/stage names
• Government ID number or type and issuing jurisdiction (state, country)
• Date(s) of production
• Your name and contact information as the records custodian

Elements that protect you beyond 2257:

• Explicit description of content being produced (general or specific)
• Consent to specific acts depicted
• Permitted platforms and distribution channels
• Duration of consent (perpetual or time-limited)
• Payment terms and any exclusivity provisions
• Right to withdraw consent (and conditions/limitations)
• Both parties’ signatures with date

For OnlyFans collabs, the release should specifically name OnlyFans/Fenix International Ltd as a permitted distribution platform, as well as any other platforms where you intend to post. A release that only covers “digital distribution” is ambiguous.

Where to get a release form: Law firms specializing in adult entertainment will draft one for your specific situation. Template releases are available through adult industry legal organizations, and our free DMCA template generator can help with the takedown side. Whatever template you use, have it reviewed by an attorney familiar with 2257 before you rely on it.

One thing worth stating plainly: a signed release does not give you unlimited rights over a performer’s likeness and content forever. If your collab partner later sends a takedown request or a cease-and-desist, you need the release to defend your right to keep the content up. Having both the release and the 2257 records is what gives you a legally defensible position.

AI-generated adult content and 2257

18 U.S.C. 2257 requires records for “actual human beings” depicted in sexually explicit conduct. An AI-generated image or video with no real performer does not create a 2257 obligation because there is no performer whose age needs to be verified.

This is the current legal position under the plain text of the statute. Regulators have not issued guidance specifically addressing AI-generated adult content and 2257, and there have been no prosecutions in this space as of early 2026.

This area is moving fast, though. Congress has shown interest in both AI-generated CSAM (child sexual abuse material, which is already addressed under separate statutes regardless of whether content is AI-generated) and in regulating AI-generated content more broadly. A synthetic performer who looks like a minor triggers entirely separate laws even without 2257 applying.

Platform policies also apply independently of federal law. OnlyFans and Fansly both have their own policies on AI-generated content, which are stricter in some respects than the federal statute. Verify current platform rules before posting AI-generated content, because those rules change more frequently than the law does.

For AI-only content with no real people, you have no 2257 records obligation today. You still need to comply with platform terms, and the regulatory environment is active enough that it’s worth monitoring.

Non-US creators: does 2257 apply to you?

This is genuinely complicated, and any definitive answer requires a lawyer familiar with both your home jurisdiction and US law. Here is the honest picture.

18 U.S.C. 2257 applies to content “produced in the United States” or content that is “intended for distribution in the United States.” OnlyFans is a US-connected platform distributing to US subscribers. Content posted to OnlyFans by a UK, EU, Canadian, or Australian creator is distributed to US audiences through a platform with a US legal presence.

The US DOJ has not historically pursued foreign creators for 2257 violations in isolation. But if your content is accessible to US subscribers (which it is on OnlyFans), the legal argument that 2257 applies to your distribution activity is not frivolous.

Fenix International Ltd operating as custodian helps UK/EU creators specifically, because the custodian arrangement means the platform-level compliance is handled regardless of where the creator is located. For solo content on OnlyFans, this is the most practical protection available to non-US creators.

For collab content or content on personal websites accessible to US users, non-US creators face the same analysis as US creators with the added complexity of jurisdiction. If you have any significant US audience and produce collab content, the conservative approach is to maintain 2257-compliant records regardless of your location.

Fansly is in the same position. Non-US creators distributing through it face the same theoretical reach of 2257.

The bottom line for non-US creators: if you are solo-only on OnlyFans, your practical risk is low because Fenix’s custodian arrangement covers the platform-level compliance. If you collaborate or run your own site, consult an attorney who handles cross-border adult industry law.

Protect your content after getting compliant

Getting your 2257 compliance sorted is step one. Step two is making sure the content you worked to create (and legally document) doesn’t end up stolen, leaked, or reposted without your consent.

Content creators who take 2257 compliance seriously tend to also care about what happens to their content after it leaves the platform. Leaked OnlyFans content, stolen Fansly videos, and scraped subscription content all represent both a financial loss and a potential source of ongoing compliance headaches if content ends up on platforms where the original 2257 documentation isn’t accessible.

CopyrightShark handles the removal side: identifying where your content has been leaked, filing DMCA takedowns, and getting it deindexed from search engines and removed from leaker sites. The compliance work you do upfront -maintaining clean records, having solid model releases -makes the removal process faster and more effective, because you have clear proof of ownership when filing.

If you have already had content leaked and want to know your removal options, our OnlyFans content protection guide covers the specific platforms and process in detail.

Frequently asked questions