A common and reasonable assumption: you licensed some content, the seller sent over the model IDs and the signed releases, you put it all in a folder, and the compliance question is closed.
The assumption is half right. Federal record-keeping law has a specific provision for producers who acquire content rather than shoot it, and using it is exactly what you should be doing. But it is a route with conditions attached, and the conditions are where people come unstuck — usually on one or two very specific items rather than on the whole scheme.
First: which kind of producer are you?
28 C.F.R. Part 75 splits producers in two. A primary producer actually films or photographs the sexually explicit conduct. A secondary producer publishes, reissues, reproduces, inserts on a computer site or service, or otherwise manages the explicit content — including where someone else created it.
If you bought content and are publishing it, § 75.1(c)(2) is very likely to cover you. There is an exclusion at § 75.1(c)(4) for activity limited to transmission, storage, retrieval, hosting, formatting or translation without selection or alteration of the content — but choosing what to buy and what to publish is selection. Do not assume the exclusion applies to you because you did not hold the camera.
You can also be both at once, if some of your catalogue is your own work and some is acquired. The records are per depiction, so the analysis is per depiction too.
The provision that helps: § 75.2(b)
This is the one to know. A secondary producer may satisfy the requirement to create and maintain records by accepting copies of the primary producer's records. You do not have to re-examine identification for a shoot you were not at — which would be impossible anyway, since § 75.2(a)(1) requires the examination to happen before production.
But the same provision attaches a condition that is easy to skim past: the secondary producer must also keep a record of the name and address of the primary producer from whom the copies were received.
This is the single most commonly missing element. Buyers carefully file the IDs and releases and never record who they got them from, or record a trading name and an email address rather than a legal name and a physical address. On its own that omission makes the record set incomplete, no matter how good the rest of the file is.
What actually has to be in the file
§ 75.2(b) lets you accept copies of “the records described in paragraph (a)” — so the question becomes what paragraph (a) requires. An ID and a release is usually not the full set.
| Legal name and date of birth | Obtained by the primary producer’s examination of a picture identification card before production. | § 75.2(a)(1) |
| A legible copy of that document | The card actually examined. May be redacted — but see the warning below. | § 75.2(a)(1) |
| Every other name used | Maiden name, alias, nickname, stage name, professional name. Without these you cannot build the index. | § 75.2(a)(1) |
| The date of original production | You need it to confirm the identification was examined beforehand, and because the record need only be current as of that date. | § 75.2(c) |
| A copy of the depiction | The record contains the content, not just a reference to it. | § 75.2(a)(1) |
| The seller’s name and address | A separate, express requirement of the secondary-producer route. The most commonly missed element. | § 75.2(b) |
Worth noting what is not on that list: the model release. A release is essential commercially, it is what platforms and payment providers ask for, and it is what protects you in a consent dispute. But it is not one of the elements § 75.2 enumerates. Plenty of buyers receive a beautiful release and an ID and are missing the alias list and the production date, which are the parts the regulation actually names.
The redaction trap
Sellers redact, and they are entitled to. § 75.2(b) permits copies to be redacted to remove information not needed to confirm the performer's name and age — addresses, phone numbers, social security numbers and the like. A careful, privacy-minded seller will do this as a matter of course.
But the identification card number may not be redacted. The regulation carves it out explicitly. A seller who blacks out the document number — often the most instinctively private-looking field on the page, and precisely the one a thoughtful seller reaches for first — has handed you a defective record. Check this on every file you already hold, not just on new acquisitions.
If you find redacted document numbers in your archive, go back to the seller and ask for clean copies. This is also why a right to obtain unredacted records on demand belongs in your purchase agreement — see below.
Six things that stay yours regardless
Accepting the seller's records covers the performer-identification half. The rest of Part 75 still applies to you as the producer who is publishing.
Your own disclosure statement
Under § 75.6 the statement identifying where the records are held must appear on the matter you publish, naming your custodian at a street address where records can actually be made available. No post office box. The seller’s statement covers the seller’s publication, not yours.
The URL where you publish it
The record must identify where the depiction is published. You are publishing to a new location, so that entry is yours to create — the seller cannot supply it.
The index
§ 75.3 requires records to be retrievable by any name the performer uses and by the title or identifier of each depiction. A folder of PDFs named after invoice numbers is not an index.
Segregation
§ 75.2(e) requires the record set to be kept apart from all other records, to contain nothing else, and not to sit inside anything else. Cross-referencing to your asset library is fine. Co-mingling is not.
Retention, on your clock
§ 75.4 runs seven years from creation or from the last amendment or addition. Publishing at a new location is an addition, so in practice your clock usually starts at your publication, not the original shoot. Five further years if you cease business.
A custodian who can authenticate
§ 75.2(f) permits digital records provided they include scanned copies of the identification and there is a custodian able to authenticate each digital record. A shared drive with no named custodian does not meet this.
The retention point catches people out in a useful direction. Because publishing at a new URL is an addition to the record, and § 75.4 runs from the last addition, your seven years generally start from your publication rather than from a shoot that may have happened years earlier. Retention is a calculation to be recomputed, not a date to be stamped once.
If the content was produced outside the United States
Two things change, and both are worth resolving before money moves.
§ 75.9 sets out a certification statement covering foreign producers — broadly, certifying either that the foreign producers maintain the records the statute requires, or that they maintain equivalent performer information under tax, labour or industry-standard arrangements, and that you hold copies of those records or certifications. The wording is prescribed. Get it from counsel rather than paraphrasing it.
§ 75.1(b) limits which identification documents qualify at all. A foreign government-issued equivalent counts only in defined circumstances, and the test turns partly on where the producer maintaining the records was located on the original production date. The practical consequence is awkward: a document that was perfectly valid while an offshore seller held the file may not qualify once a US-based buyer is the one holding it. This is genuinely easy to get wrong and expensive to discover late.
The part that belongs in the contract
Here is the uncomfortable truth about acquired content: you are relying on the seller's word that identification was examined before production and that the document was genuine. You cannot verify either from a scan. No filing system fixes that.
So the protection sits in the purchase agreement, not the compliance folder. At minimum:
- A warranty that the records are complete and accurate, and that identification was examined before production.
- A warranty that every name and alias used by each performer has been disclosed.
- A right to obtain unredacted records on demand, including the identification card number.
- An obligation on the seller to preserve their own copies for at least your retention period.
- Notice to you if the seller receives a withdrawal request, a takedown notice or an inspection.
- Indemnity for loss arising from defective or falsified records.
- For foreign-produced content, the § 75.9 certification or the underlying records to support it.
Keep the executed agreement with the record file. If your records are ever questioned, the terms you negotiated are part of the story of how you came to hold them.
A practical intake checklist
Run this on every acquisition, and retrospectively on anything already in your catalogue.
- 1 Confirm you are a producer at all — and if so, that you are the secondary producer under § 75.1(c)(2).
- 2 Check the identification card number is visible and unredacted on every copy.
- 3 Check the date of original production is recorded, and that it falls after the identification was examined.
- 4 Check every alias is listed, not just the performing name on the invoice.
- 5 Record the seller’s legal name and street address against the file.
- 6 Add your own publication URL and title to the record once the content goes live.
- 7 File it in your segregated record store, indexed by name, alias and title.
- 8 Set your retention date — and recalculate it whenever you add a new title or URL.
- 9 Publish your own § 75.6 statement on the pages where the content appears.
- 10 Keep the purchase agreement with the file. It is part of your evidence, not just your commercial paperwork.
The items above also appear in our readiness checklist under the studio and reseller track, if you would rather tick them off than read them.
One thing no service can do for you. You can engage a non-employee custodian to hold the records, and § 75.2(f) expressly allows digital record-keeping where a custodian can authenticate each record. But § 75.2(h) states that such a contract does not relieve the producer of liability under the Part. Outsourcing changes who holds the file. It never changes who answers for it.
If you are also running a platform where others upload, the analysis shifts again — our guide to § 2257 for platforms covers that side, including where the exclusions bite and what a complete record set requires end to end.
This article is general information, not legal advice. ProntoID and Brooks & Keitt Sàrl are not a law firm. § 2257 is a federal criminal statute whose application turns on facts specific to your content, your transaction and your jurisdiction, and parts of it remain subject to constitutional challenge. Take qualified advice before relying on anything here — particularly on foreign-produced content.