What Non-Compliance Actually Costs: The Legal Side of Shooting Adult Content in the US

Adult content production is legal in the United States. That surprises some people, given how often the industry gets treated as a legal gray zone in casual conversation. It isn't. What it is, though, is one of the more heavily documented corners of media law — a mix of a federal record-keeping statute that hasn't changed much in decades, a rapidly expanding pile of state age-verification laws, and a newer layer of rules written not by lawmakers but by Visa and Mastercard.

This guide walks through what actually applies, to whom, and where in the country the rules get stricter or looser. It's written for two audiences: the solo creator shooting content in a spare bedroom and selling it through a subscription platform, and the production company renting a soundstage and running a full crew. Their obligations overlap more than either group usually expects.

One thing up front: this is general information, not legal advice. Adult content law sits at the intersection of federal statute, state obscenity law, and private payment-network policy, and a mistake in any one of those areas can end a business fast. If you're about to start producing, budget for an hour with an attorney who specializes in this area — firms like Silverstein Legal or the First Amendment Lawyers Association network handle this work regularly, and the cost is small next to what a compliance failure can do.

The federal floor: 18 U.S.C. § 2257

Every producer of sexually explicit content in the US — whether that's a studio with forty crew members or a single creator filming themselves — is bound by the same federal statute: 18 U.S.C. § 2257, along with its companion for simulated content, § 2257A. The law requires producers to verify, with a government-issued photo ID, that every performer is at least 18, and to keep those records on file. A "Custodian of Records" has to be named, and that person's business address has to be disclosed wherever the content is published, typically as a compliance statement linked from the site or platform.

Records need to be kept for seven years, and for five more years after a producer goes out of business. Federal inspectors can show up and request access to them, generally with limited or no advance notice. Skipping this isn't a paperwork slip — a first offense can carry up to five years in prison, and it climbs from there for repeat violations.

Here's the part independent creators tend to miss: if you shoot and sell your own content on OnlyFans, Fansly, or a personal site, you are a "primary producer" under the statute, full stop. The platform's own age-verification process doesn't cover you. You still need your own ID records, your own custodian, and your own compliance statement, separate from whatever the platform requires at sign-up.

There's also the underlying question of obscenity, which is a state-law concept, not a federal one. Content is judged against the Miller test — whether it appeals to prurient interest, is patently offensive under local community standards, and lacks serious artistic, literary, political, or scientific value. Almost all commercial adult content clears this bar without issue, but "almost all" is doing real work in that sentence, and the standard shifts depending on which state's jury would be deciding it.

What changed in the last two years

Two developments have reshaped compliance since 2025, and neither came from Congress writing a new porn law.

The TAKE IT DOWN Act, signed in May 2025, requires platforms to build a working notice-and-takedown process for non-consensual intimate imagery — including AI-generated deepfakes — and to remove reported content within 48 hours of a valid request. The removal-process requirement became fully enforceable in May 2026, with the FTC handling violations. This applies most directly to platforms, but producers who host or distribute their own content need the same process in place.

Card network rules now sit on top of federal law, and in practice they're the stricter of the two. Visa's Integrity Risk Program (VIRP) and Mastercard's AN 5196 both require signed, dated model releases for every performer in every piece of monetized content, an accessible takedown portal, and periodic compliance reporting from merchants processing adult payments. A producer can be fully compliant with § 2257 and still lose payment processing over a VIRP or AN 5196 gap — the card networks enforce faster and more aggressively than the Department of Justice does. If you're monetizing content at all, this isn't optional paperwork; it's what keeps your merchant account open.

What non-compliance actually costs

It helps to separate this into the risk that shows up in a courtroom and the risk that shows up in your bank account, because for most producers today, it's the second one that actually ends businesses.

The federal exposure is the most severe on paper. A first § 2257 violation carries up to five years in prison; subsequent violations carry up to ten. This is a criminal statute, not a civil one, and it applies regardless of whether anyone was actually harmed — the offense is failing to keep proper records, not producing illegal content. DOJ inspectors are entitled to show up and review a producer's records with little or no advance notice, and a custodian of records who can't produce them, or produces incomplete ones, is the exposure point. In practice, DOJ inspections of small and independent producers are uncommon, but they're not theoretical, and the statute doesn't scale its penalties down for a solo creator versus a studio.

State obscenity prosecution is rarer, but real, and it depends entirely on geography. Because the Miller test is judged against local community standards, the same content can be legally unremarkable in Los Angeles and prosecutable in a county with a more conservative jury pool. This is the mechanism behind the handful of obscenity cases brought against producers in states without a court ruling like California's — prosecutors don't need to prove the content is illegal everywhere, just that it fails the standard where the case is filed.

Card network enforcement is where most real-world consequences actually land, and it moves faster than either of the above. A VIRP audit finding or a Mastercard GRIP letter triggers an acquirer investigation, and the escalation path is short: reduced payment options, then card acceptance switched off entirely, then termination. Get placed on Mastercard's MATCH list — the shared blacklist acquiring banks check before approving a new merchant account — and a business is effectively locked out of mainstream card processing for five years, not just with the processor that dropped it, but industry-wide. For a creator or studio whose revenue runs through card payments, that's not a fine to absorb; it's close to a shutdown, since the fallback options (crypto, bank transfer, high-risk-only processors charging 10–15% fees) rarely replace the lost volume. Attorneys who work this space are blunt about the ordering: a processor will drop a merchant for VIRP or AN 5196 gaps long before the DOJ ever opens a § 2257 inspection.

The TAKE IT DOWN Act adds a newer, civil layer. Failing to maintain a working 48-hour notice-and-removal process is treated as a violation of the FTC Act, opening the door to FTC enforcement action, and the law's criminal provisions are already being used — the first conviction under the Act came down in April 2026. For a producer who also operates their own site, this sits on top of the card-network obligations rather than replacing them.

Then there's civil exposure from performers themselves. A model release isn't just paperwork for a card network audit — it's what stands between a producer and a right-of-publicity or privacy lawsuit if a performer disputes how their image was used or claims they didn't consent to a specific use of the footage. An incomplete release can unwind a producer's card-network compliance and expose them to a civil claim at the same time.

The compounding cost is reputational, and it's easy to underestimate. Once a business has been flagged by one processor or shows up on MATCH, opening new merchant accounts and business bank accounts gets noticeably harder, and talent agencies — who carry their own compliance exposure by working with a producer — tend to steer performers away from studios that can't show clean records. None of this requires a criminal conviction to hurt. A single audit finding can do it.

Fifty states, not one law

Federal law sets a floor. States build very different structures on top of it, and the gap between them has widened sharply.

As of mid-2026, 27 states require commercial adult websites to verify a visitor's age before granting access, if a third or more of the site's content is sexually explicit — Texas, Florida, Louisiana, and most of the South and Midwest are in this group. The Supreme Court settled the constitutional question in Free Speech Coalition v. Paxton (2025), upholding Texas's law 6–3. A "click if you're 18" checkbox no longer satisfies these statutes; most now require ID-based or third-party age assurance. Roughly the other half of the country — California, New York, Illinois, Washington, and most of the Northeast — has no such law on the books yet, though that list keeps shrinking as more states pass their own versions.

That's about accessing content, though. The rules around producing it are a separate, older question, and this is where the state you shoot in matters most.

California is the one state with a court decision directly protecting adult film production. In People v. Freeman (1988), the California Supreme Court held that state pandering law didn't apply to hiring performers for a legitimate film intended for commercial distribution — effectively carving adult film production out of prostitution law. That single ruling is a large part of why the industry concentrated in the San Fernando Valley in the first place, and no other state has an equivalent precedent.

Florida illustrates what that gap looks like in practice. The state has no law that bans adult filmmaking outright, and production is legal on paper. But without a Freeman-style ruling to fall back on, Florida prosecutors have brought obscenity charges against adult producers in the past, including a well-documented case against producer Ray Guhn. Attorneys who work in this space generally describe Florida's legal footing for production as workable but genuinely riskier than California's — worth knowing given how often Miami gets pitched as an up-and-coming shooting location.

Independent creators vs. full production companies

The two groups carry overlapping obligations, but the practical weight lands differently.

Independent creators (solo performers selling through OnlyFans, Fansly, ManyVids, or a personal site) need, at minimum: their own § 2257 records and named custodian, even though they're a "one-person studio"; a business entity — most attorneys recommend an LLC, both for liability protection and because it separates a legal name from a stage name on public filings; a general business license from their city or county, the same one any home-based business would need; and their own model release for any collaborator who appears in their content, since the platform's terms of service don't substitute for this. Zoning rarely becomes an issue at this scale unless local law specifically restricts "adult businesses," which usually targets storefronts rather than home-based online creators.

Full production companies carry all of that, plus: local filming permits for each location, which may require disclosing the nature of the shoot depending on the jurisdiction; workers' compensation insurance and general liability coverage, since performers and crew are typically treated as employees or contractors under state labor law; STI testing protocols, which the industry has run for years through organizations like PASS (Performer Availability Screening Services) independent of any state mandate; and, for shoots in Los Angeles County, a health permit under Measure B — the 2012 county law requiring a permit and periodic inspections for any scene involving penetrative sex. Companies distributing through their own paid site also inherit the full VIRP/AN 5196 card-network stack directly, rather than relying on a third-party platform to carry it.

A basic compliance checklist

• Form a business entity (LLC is standard) and get an EIN

• Register for a general business license in your city/county

• Check local zoning if you're renting or building a dedicated studio space

• Set up § 2257 record-keeping and name a Custodian of Records before your first shoot, not after

• Collect government-issued ID and a signed model release from every performer, every time

• Confirm your payment processor's Visa VIRP / Mastercard AN 5196 requirements if you're monetizing directly

• Build a takedown/removal process that satisfies the TAKE IT DOWN Act if you host content yourself

• If your audience includes any of the 27 age-verification states, confirm your site's verification method meets that state's standard

• Get liability and, if you have employees or regular contractors, workers' comp coverage

None of this is designed to be a deterrent from the industry — it's a legal one, with well-worn paths through it. But it's a business with more overlapping compliance layers than most people assume going in, and the businesses that last are the ones that treat the paperwork as part of the production, not an afterthought.