§ 2257 and GDPR Readiness Checklist — For Platforms, Creators and Studios

Choose a role above to begin.

Platform

0 of 29 confirmed

Do the rules apply to you at all? 0/3

You have determined whether you are a “producer” under 28 C.F.R. § 75.1(c)critical The § 75.1(c)(4) exclusion covers transmission, storage, retrieval, hosting, formatting and translation without selection or alteration. If you curate, you are almost certainly not excluded. Answer this before building anything else. Read more → You know whether you are a primary or secondary producer — per depictioncritical You can be both at once. Content you produce is one analysis; content users upload or you acquire is another. The records are per depiction, so the question is too. You have identified which jurisdictions actually reach youimportant US federal record-keeping, UK Online Safety Act, EU DSA, and state-level age verification laws each have their own trigger. Being in scope for one says nothing about the others.

§ 2257 record content 0/6

Every record holds name and date of birth taken from an examined picture IDcritical § 75.2(a)(1). Examined before production — which is why verification at upload time fits the secondary-producer route far better than the primary one. A legible copy of the identification document is retainedcritical Not a reference to it, not a verification result alone. The document itself. Every other name the performer uses is capturedcritical Maiden names, aliases, nicknames, stage names, professional names. Without them you cannot build the index the next item needs. A copy of each depiction and its URL sits inside the recordcritical § 75.2(a)(1). This is the element most identity-verification setups are missing entirely, because they are keyed on people rather than on content. Records are retrievable by any alias and by title or URLcritical § 75.3. This is a schema decision, not a reporting feature you can add later. You have confirmed which identity documents actually qualifyimportant § 75.1(b) restricts foreign documents depending on where the performer and the record-keeping producer were located. A US-based producer has a narrower acceptable set than most systems assume.

§ 2257 record handling 0/5

The record set is segregated from all other recordscritical § 75.2(e): segregated, containing nothing else, not contained within anything else. Cross-referencing to your KYC system is required; co-mingling with it is prohibited. Retention is a calculation, not a stored datecritical § 75.4 runs seven years from creation or last amendment or addition. Since adding a new title resets it, a date written once at signup will under-retain for every active creator you have. Your § 75.6 statement names a real street addresscritical On the matter you publish, naming your custodian, at an address where records can actually be produced. No PO box. Everyone involved understands that liability does not transfercritical § 75.2(h): engaging a custodian does not relieve the producer. If anyone in your organisation believes a vendor absorbed this, correct it now rather than during an incident. You have a continuity answer if you cease tradingimportant § 75.4 requires a further five years. Acquirers ask this in diligence and “we had not thought about it” is an expensive answer.

Removal and consent withdrawal 0/3

You can act on a removal request within 48 hourscritical The TAKE IT DOWN Act notice-and-removal obligation has been enforceable since 19 May 2026 for covered platforms. This is a tighter clock than anything in GDPR. A signed release never blocks a removalcritical Consent to publish is revocable. If your process defers to a prior signature, it is built the wrong way round. Withdrawal sets a status your publication code actually readsimportant Any code treating “a release record exists” as “publication is authorised” will keep publishing after someone exercises a right you told them they had.

GDPR foundations 0/6

Your lawful basis is documented — and it is not consentcritical For a retained evidential record, Article 6(1)(f) with Article 9(2)(f) is durable. Article 9(2)(a) consent is withdrawable under Article 7(3) by the person most motivated to withdraw it. Read more → A DPIA existscritical Article 35(3)(b) makes it mandatory for large-scale Article 9 processing. Identity verification on an adult platform typically involves biometric data and data concerning sex life. Your Article 30 records of processing are currentcritical Covering everything you do, not only the part you outsourced. Your privacy notice names the identity provider and what they doimportant Including that they may be a separate controller with their own retention period. The relationship with your identity provider is correctly characterisedcritical Controller-to-controller, processor under Article 28, or joint under Article 26. Getting this wrong means the wrong contract, and it is the first thing a DPO checks. You have your own Article 27 representative if you need oneimportant Established outside the EU or UK and processing at scale? Your vendor’s representative does not cover you.

GDPR in operation 0/6

Rights requests have a named destination and a written procedurecritical Article 12 gives you a month. The difficulty is never the deadline, it is not having decided in advance who assesses identity and who actions it. You have decided in advance what you will refuse to erase, and whycritical Article 17(3) permits refusal. What it does not permit is complying silently in part — say what is kept, on which exception, until when, and that they may complain to a supervisory authority. Failed automated verifications have a human review routeimportant Article 22 gives a right not to be subject to solely automated decisions with significant effect. Blocking a creator from their income may clear that bar. The fix is cheap and improves the product anyway. Your Chapter V transfer basis is documentedcritical For Article 9 data, standard contractual clauses with a transfer impact assessment is more defensible than an adequacy mechanism alone. Ask your vendors to show you theirs. Article 14 is handled where data arrives from someone other than the subjectimportant A user uploading a third party’s document triggers it. The 14(5)(b) disproportionate-effort exemption rests on a contact position recorded at the time, not reconstructed afterwards. You have a breach procedure that names people, not rolesimportant Articles 33 and 34 run on 72 hours. A procedure listing “the DPO will” without a phone number is not a procedure.

This checklist is general information, not legal advice, and it is not exhaustive. ProntoID and Brooks & Keitt Sàrl are not a law firm. § 2257 is a federal criminal statute with contested constitutional standing, and data protection analysis differs between the EU, the UK and Switzerland. Take qualified advice.

Photographer or creator

0 of 19 confirmed

Before the shoot 0/4

You examine a picture ID before production, every timecritical § 75.2(a)(1) is specific about the order. A check done afterwards does not satisfy it, however thorough. You keep a legible copy of the document you examinedcritical Not a note that you saw it. The copy itself. You ask for every name they work under, at the timeimportant Reconstructing an alias list years later from memory is how records become unreliable. You record the production dateimportant It is what demonstrates the examination happened first.

The release itself 0/4

The release is specific to that shootcritical A release carried over from a previous session does not cover new content, and saying it does is the kind of claim that unravels badly. Its scope actually covers what you are doing with the contentcritical Publication, commercial use, the territories, the platforms. A release too narrow for the use is worse than none, because it looks like cover and is not. Bilateral confirmation where the model can still be reachedimportant A release the model confirms themselves is worth substantially more than one you attest to on their behalf. Read more → Older paper releases are stored somewhere retrievableimportant Paper fades, floods, and gets thrown out by someone tidying up. If it only exists in a drawer, it effectively does not exist. Read more →

Your records 0/5

Each record contains a copy of the depiction and where it is publishedcritical § 75.2(a)(1). Records are per depiction, not per person — a folder named after the model is not the same thing. You can retrieve a record by alias or by titlecritical § 75.3. If someone names a specific set and you cannot find its record within the hour, you do not have an index. The record set is kept separately from everything elsecritical § 75.2(e). Not inside your general client folders, and containing nothing else. Retention runs seven years from creation or last additioncritical § 75.4. Publishing an old set somewhere new is an addition, and it restarts the clock. Your § 75.6 statement appears on what you publishcritical Naming a custodian at a real street address. This is the item independent photographers most often skip entirely.

Data protection 0/6

You understand that you are a controller of your models’ datacritical Holding identity documents and images of identified people makes you one, regardless of how small your operation is. Read more → You have a lawful basis and you can state itimportant For the retained record, legitimate interests plus legal claims is more durable than consent. Models are told what you hold, why, and for how longimportant A short written notice given at the shoot. This is cheap and it prevents most disputes from starting. Identity documents are stored securely, not on a laptop desktopcritical Article 32. A passport scan in an email thread or a sync folder is the most common real-world failure in this whole list. You know the small-organisation exemption does not rescue youimportant Article 30(5) exempts organisations under 250 people from records of processing — except where processing involves special categories of data. Which yours does. You know what you would do if a model asked you to delete everythingimportant Article 17(3) may let you keep the record. Deciding the answer in advance means giving a consistent one.

Studio or reseller

0 of 21 confirmed

Your position 0/3

You know you are a secondary producercritical § 75.1(c)(2) covers publishing, reissuing and inserting on a computer site — including content someone else created. Buying and choosing to publish is selection, so the hosting exclusion is unlikely to help. Read more → You are using the § 75.2(b) route knowinglycritical It lets you satisfy the requirement by accepting copies of the primary producer’s records. It is the designed route for your situation, not a workaround — but it has conditions. You understand liability did not come with the discountcritical § 75.2(h). The seller handing you a folder does not make the records their problem once you publish.

What you received 0/5

The ID card number is visible and unredacted on every copycritical § 75.2(b) permits redacting addresses and phone numbers — and expressly not this. A privacy-minded seller blacks it out first, which is exactly the problem. You have the primary producer’s legal name and street addresscritical An express element of § 75.2(b), and the one most often reduced to a trading name and an email. A brand is not a legal name. Every name each performer uses was suppliedcritical Not just the one on the invoice. Without the full list you cannot index under § 75.3. You know the original production datecritical It is what shows the identification was examined before the shoot rather than afterwards. The chain is recorded where content changed hands more than onceimportant A to B to C happens. Recording only your immediate seller loses the link to whoever actually shot it.

Foreign-produced content 0/2

You have addressed § 75.9 if the content was shot outside the UScritical It sets out a prescribed certification covering foreign producers and their records. The wording matters; get it from counsel rather than paraphrasing. You have checked document eligibility given your locationcritical § 75.1(b) turns partly on where the record-keeping producer sits. A document valid while an offshore seller held the file may not qualify once you hold it. This trap is easy to hit and expensive to find late.

What stays yours 0/5

You publish your own § 75.6 statementcritical Naming your custodian at your street address, on the matter you publish. The seller’s statement covers the seller’s publication. You add your own URL and title to each recordcritical You are publishing to a new location. The seller cannot supply that entry. You maintain your own index and segregated storecritical § 75.3 and § 75.2(e). A folder of PDFs named after invoice numbers is not an index. Retention runs from your publicationcritical Publishing at a new location is an addition under § 75.4, so your seven years usually start later than the original shoot. A custodian who can authenticate each digital recordimportant § 75.2(f) allows digital records on that condition. A shared drive with no named custodian does not meet it.

Contract and data protection 0/6

Your purchase agreement carries warranties on record completenesscritical You cannot verify from a scan that the examination happened before production. The protection lives in the contract, not the filing system. Read more → You have a right to obtain unredacted records on demandimportant Which is what you will need the moment you discover a blacked-out document number. The seller must preserve their copies for at least your retention periodimportant Your clock may run years past theirs. If they delete on their schedule, your fallback disappears. You have a lawful basis for holding data about people you never metcritical You now hold identity documents belonging to performers who have no relationship with you at all. Read more → Article 14 is addressedcritical The performers did not give you their data — your seller did. That is indirect collection, and it carries an obligation to inform unless 14(5)(b) applies. You know what happens when a performer contacts youimportant They may have no idea you exist. Being ready for that call is better than improvising it.

§ 2257 and GDPR:
what have you actually got?

Which one are you?

Work through the gaps with us

§ 2257 and GDPR: what have you actually got?

Which one are you?

Work through the gaps with us

§ 2257 and GDPR:
what have you actually got?