This case is headed to the Supreme Court, and there is a decent chance they may agree to hear it. There is a directly conflicting ruling out of the 10th Circuit in Denver. A split on a point of law (a Circuit split) is often a reason for the Supreme Court to step in, so that the conflict can be resolved.
I had to deal with 2257 compliance in my work for an adult website. It works like this:
1. The photographer (or production company) must verify identity with a government-issued ID. If shot in the United States, the government-issued ID must be an American identification, even if the model is not from the United States, such as a cute chick on vacation for a couple weeks just traveling on her passport. Note that if you shoot outside the United States, a foreign ID is fine. Are you shooting in El Paso? You can go to prison for shooting your Estonian model on her passport and visitor's visa, but if you take her to Juarez and shoot her there, you're in the clear.
2. The photographer must keep a copy of the ID, the model's contract, AND the pictures for five years after the last publication of the photographs. In addition, if published on the Internet, you have to keep a complete list of all URLs (including thumbnails!) of any picture you publish, even when those URLs change or come down. You better not be using any database-driven stuff with auto-generated URLs, because you now have to track every one of them, no matter how they change.
3. The records must be cross-indexed by model's real name, any stage names, any dates of publication, any dates of recording, title of product or production, and URL. Use three year old footage in a new DVD? You get to dig back through your compliance records and update your cross-indexes.
4. The records must be SEPARATE from your normal day-to-day business records. That is, you have to keep this stuff for the ordinary course of your business, and THEN you must keep a SEPARATE copy for the government.
5. You must publish the REAL name and address of the person who holds the records on each copy of your product -- DVD, mag, or book -- AND on EVERY PAGE of your website (a "click here for 2257 info" link is *not* acceptable).
6. This person must be available at least 20 hours a week, 52 weeks a year, for unannounced visits from the FBI, who may rifle through your records (and copy any or all of them, to dig through at their pleasure) looking for violations without a warrant or any cause at all, probable or not.
7. Violation of any of this can land you in prison, even if your models are not under the age of 18. You can do years in prison and pay thousands in fines if the only thing wrong is that you screwed up the cross-indexing.
8. If you sub-license or sell your content (such as your website's affiliates), you have to give un-redacted copies of your records to the person you sell/give the content to. Are you a DVD producer who posts your movies on HotMovies? HotMovies gets a copy of your records, complete with the model's real name and address. The model doesn't get any right to opt out, either; if they can also turn around and sell or sub-license your content, THEIR licensees get your model's information, and YOU can't do anything about it, and you have no control over who it all goes to!
9. If you receive sub-licensed or sold content, you likewise have to keep a complete set of records. It is *not* sufficient to simply keep track of where your content came from so the FBI can back-track. You have to have your own independent, complete set of records, all lined up, cross-indexed and separated from your daily business records, and ready for inspection whenever the FBI decides to materialize.
10. You are required to keep records even if you go out of business, be available for FBI inspection 20 business-time hours per week even if you go on vacation or operate out of your home.
11. In addition to "actual sexually-explicit conduct" (which is poorly defined and can cover Hollywood movies but for some reason does not) and "simulated sexually-explicit conduct," they also cover "actual sadomasochistic conduct," which is not defined. The regulations don't mention the corresponding (but must also exist, and is likewise not defined) "simulated sadomasochistic conduct." The best we in the adult industry can figure out, "actual sadomasochistic conduct" really hurts.
12. There are huge exceptions carved out for mainstream Hollywood producers. If you shoot porn, you're subject to all this, but if you work for a big studio and shoot James Bond appearing to bang whomever his latest girl is, you aren't.
13. Fuck any of this up and you can go to prison, even if every model you have is older than my great-grandmother and looks it.
One major streaming provider told me at one point that they employed 10 people full-time who did nothing but 2257 compliance, as their only function. That's easily a half-million dollars a year in employee costs, before you even give them a computer to work on. The Justice Department has not given any indication of what kinds of compliance documentation is acceptable -- they don't have a "standard form" -- so everybody has to make it up as they go along and hope they're in the clear when the FBI shows up.
It's important to note that a handful of under-age models have made it into adult productions in the last 30 years, the most famous being Traci Lords. In every case, the models used fake identification, and when the producers found out what had happened, they pulled the products. It is simply not true to suggest that porn producers routinely use under-aged models; it didn't happen before this law was enacted, and it doesn't happen now. The whole thing is nothing more than a thinly-veiled attempt to drive porn companies out of business with compliance costs.