Section 2257: what actually turns a photo on your directory into a federal record-keeping duty
A federal law most operators have never heard of, until it applies to them
Ask most classifieds operators about 18 U.S.C. § 2257 and you will get a blank look, and the reaction makes sense. The statute was written in 1988 for pornography producers: studios that hire performers, film sex acts, and need to prove to a federal inspector that nobody on set was underage. A directory that only hosts classified ads, never hires a performer, and never points a camera at anyone feels like it is reading someone else's law.
The statute itself does not share that intuition. It says that whoever "produces" a visual depiction of "actual sexually explicit conduct" made after November 1, 1990, and involved in interstate commerce, must create and maintain individually identifiable records for every performer shown in it. Nothing in that sentence requires the producer to have hired anyone, paid anyone, or been in the room when the picture was taken. The word doing the work is "produces," and Congress and the Department of Justice have both defined it far more broadly than a working photographer would guess.
What actually counts as "actual sexually explicit conduct" matters more here than the word "sexually explicit" suggests. The definition, in 18 U.S.C. § 2256(2)(A), lists five categories: sexual intercourse, bestiality, masturbation, sadistic or masochistic abuse, and, as the fifth and most frequently overlooked, "lascivious exhibition of the anus, genitals, or pubic area of any person." That fifth category requires no act at all. A still photograph that exhibits those body parts can trigger the statute on its own, with nobody filmed doing anything, but only if the exhibition is lascivious in character, and that word does real legal work rather than decorative work. Mere nudity is not automatically lascivious: in Connection Distributing Co. v. Holder, the full Sixth Circuit upheld the statute's reach over nude photographs in a swingers' magazine only because those specific images were found lascivious on their facts, a judgment made image by image rather than a line a computer could draw from pixels alone.
The records the law demands are specific and unglamorous: the performer's name and date of birth, verified by examining a government-issued identification document, plus any other name the performer has ever used, including a stage name. Those records have to be kept at the producer's business address, available for inspection by the Attorney General at any reasonable time, and a statement disclosing where they are kept has to appear on every copy of the material, which the statute defines to include every page of a website on which the image appears. For an organization, that statement must name the individual, by title and business address, responsible for keeping the records.
None of this is a civil matter you settle with a fine and an apology. A first violation carries up to five years in prison and a fine; a second violation, after a prior conviction under the same section, carries a mandatory two to ten years. The statute does not ask whether you meant to break it. It asks whether the record exists, correctly filled out, where an inspector can find it.
Why a classifieds directory counts even when it never touches a camera
The part of the law that actually reaches a directory is not the primary producer definition above, it is the second branch of it: the secondary producer. Both the statute, in 18 U.S.C. § 2257(h)(2), and the Department of Justice's own regulation, at 28 C.F.R. § 75.1(c)(2), extend "producer" to include anyone who assembles, publishes, duplicates, or reproduces a qualifying depiction for commercial distribution, or who "inserts on a computer site or service a digital image of," or "otherwise manages the sexually explicit content of," a computer site or service that contains one.
That second phrase was written with websites specifically in mind, not photographers. A platform that never shot a frame of film can still be the entity the law is talking about, because the statute cares about who controls what a visitor sees on the page, not who held the camera on the day the picture was taken. An advertiser uploading their own photo does not make the platform disappear from that sentence; it makes the platform the thing managing the site the photo now lives on. No publicized Department of Justice action against a classifieds or escort-advertising site has rested on this particular clause; the cases that shut sites in this space down were built on prostitution-facilitation and trafficking theories instead, not on recordkeeping. That gap is worth naming honestly: it means this exact application has not been tested in court against a site like this one, not that the text stops short of reaching it.
The same regulation also carves out an exemption that looks a great deal like the logic behind Section 230 of the Communications Act. A business whose activity is limited to "transmission, storage, retrieval, hosting, formatting, or translation... of a communication, without selection or alteration of the content," stays outside the producer definition entirely, and deleting a specific piece of content in a manner consistent with Section 230(c) does not count as the kind of "selection or alteration" that would pull a business back in. A pure, passive pipe is protected. The statute never pretended a web host should carry the same obligations as a studio.
The dial that decides which side of that line an operator sits on is defined in 28 C.F.R. § 75.1(k), and it is narrower than it first sounds: "manage content" means making editorial or managerial decisions concerning the sexually explicit content of the site specifically. The same section says in plain words that managing solely advertising, copyright compliance, or other, non-sexually-explicit content does not count. A directory that rejects a photo because the advertiser used someone else's copyrighted image, or because the ad violates a category rule unrelated to nudity, is not making the kind of decision this regulation is describing.
What is that kind of decision, then. It is a judgment call made specifically about how much of a body a photo is allowed to show before it crosses from permitted to not, applied case by case rather than through a fixed rule a moderator checks against. That is the exact activity a classifieds directory's photo review team performs every day, for reasons that have nothing to do with this statute, which is exactly why it is worth knowing the statute is watching that decision too.
The same bright line your payment processor already drew for you
Here is the detail most operators are missing, and it cuts in their favor if they already have the habit: most directories already ban exposed genitals, anus, and pubic area in advertiser photos, and they did it for a completely different reason. That line is close to the exact dividing line between a merchant category a card network will underwrite as "adult, non-explicit" and one it will treat as pornography, with all the processing cost and account risk that a high-risk merchant classification already carries for a directory that depends on recurring card payments.
That is a genuinely useful coincidence, not a separate problem to solve twice. A photo policy written to keep a merchant account in a sane risk category, enforced consistently, happens to land on almost the same side of 18 U.S.C. § 2256(2)(A)(v) as a photo policy written for this statute. Get the payment-driven rule right and applied without exceptions, and the federal recordkeeping question mostly answers itself: no qualifying depiction, no producer obligation, no records to keep.
The danger is never the written policy. It is the exception nobody wrote down. A VIP account manager who quietly waves through a borderline photo rather than losing a top advertiser to a competitor, a regional team that applies a looser standard because nudity reads as less remarkable in one market than another, a new moderator improvising a judgment call nobody trained them to make consistently: each of those is, in the exact words of the regulation, an editorial decision made specifically about the sexually explicit content of the site. That is the one thing the hosting exemption does not cover.
This is also where the economics of moderation and the economics of liability stop being two separate conversations. Who is actually reviewing a listing before it goes live, and whether that person has a rule they can apply without exercising judgment about nudity specifically, decides more about this statute's reach than any written policy on a page nobody checks against. A rule that exists on paper but gets overridden by whoever answers the phone is not a rule a regulator, or a plaintiff's lawyer, will treat as the operative standard.
What a records obligation would actually require if you ever cross the line
Some operators run, or are considering running, a tier that does allow fully explicit images, whether as a premium category or a different brand altogether. If that describes your business, the obligation attaches the moment the first qualifying image goes live, not after a complaint, not after a question from a processor, and not after legal counsel gets around to it.
The record required is specific and it is not the record most directories already have. It is the performer's current legal name and date of birth, confirmed by examining a government-issued identification document in person or through a process that actually inspects the document, plus every other name, alias, or stage name that performer has ever used. That has to sit at a real business address, in a form ready to be produced to the Attorney General on request, with a named person responsible for it.
Do not assume the identity verification your platform already runs doubles as this record. The identity check most directories already run answers a different question: who placed this ad, and are they real and of age. Section 2257 asks who is depicted in this specific image and how old they are, which is frequently the same person on a self-posted listing, but is a legally separate record with its own content requirements, its own storage rule, and its own inspection right, that an age-verification vendor's output was never built to satisfy on its own.
The statement requirement is easy to miss because it sounds like paperwork rather than substance: every page carrying a qualifying image needs a visible disclosure of where the records are kept, and for a business, the name, title, and business address of the person who keeps them. A platform that builds the records but never posts the statement has still committed a separate violation under the statute's own unlawful-acts list, independent of whether the records themselves are accurate.
What to do, in order
Write the nudity line into the actual moderation guide in terms a reviewer applies without a judgment call: no exposed genitals, anus, or pubic area, full stop, with no case-by-case exception built into the written rule itself. A bright rule, consistently applied, is what keeps ordinary photo moderation inside the regulation's "does not manage sexually explicit content" exclusion rather than inside the producer definition.
Require sign-off from whoever handles compliance before any exception to that rule, for any advertiser, any market, or any format. That single override is the specific act the regulation describes as managing the sexually explicit content of the site, and it is cheaper to require a conversation before it happens than to discover it happened after the fact.
Put a records custodian's name, title, and business address in writing today, even while you believe no content on the platform currently qualifies. If you turn out to be wrong about where your own line actually sits, in practice rather than on paper, you want that person and that address to already exist rather than to invent them while fielding the question.
If any part of the business does or will host fully explicit images, build the performer-identity record, separately from any age or account verification you already keep, before the first qualifying image goes live. Treat the launch of that category as a compliance project with its own records pipeline, not as a content setting you flip on.
Ask whoever advises the business on this to confirm, in writing, which images on the platform today would meet the lascivious-exhibition definition under current enforcement practice, rather than guessing from the plain English of a fifty-year-old statute. A short, specific answer now is far cheaper than discovering the gap during an inspection.
