How to comply with 18 USC 2257A

Question

We want our app to comply with 18 USC 2257A, which states that

(...) producers of pornography, or depictions of any sexual activity using actual people, are required to verify that the performers are of legal age (18–years–old or older) by maintaining records of the performers’ names and ages. They also are required to disclose the location of these records,...

So I suppose we basically need to disclose the exact geolocation of the datacenters that store this kind of content.

We're currently using Google's Firebase, hence Google Cloud Storage to keep our files. And, as I would expect, they have no guarantee about which zone the servers are located.

My question is: is it possible in any way to achieve compliance with 18 USC 2257A while using Google Cloud Storage (Or perhaps any other cloud storage service)?

If not, if you have suggestions of providers that may offer the service that we need, I'm happy to hear them.

Answer 1

So I suppose we basically need to disclose the exact geolocation of the datacenters that store this kind of content.

That is incorrect. You need to identify a place of business where federal investigators may inspect the records without first making an appointment for access. The location of cloud storage is not particularly relevant.

is it possible in any way to achieve compliance with 18 USC 2257A while using Google Cloud Storage (Or perhaps any other cloud storage service)?

Yes. You must store the records as required by the statute and by the regulations issued under the authority of that statute, 28 CFR Part 75. I only scanned the regulations, but it seems that the "location" of the records is the place where they are available for inspection, not necessarily the place where digital files are stored. (The regulations also provide that you may indeed keep the records in digital form.) But consider, for example, what would happen if the FBI came knocking for an inspection and a local utility company accidentally severed the fiber cable on the next block. Such a network outage happened at my company a few years ago, and the incident disabled all of our redundant networking, so we had no internet access whatsoever for several hours. The investigators would probably tolerate such a disruption, but it is probably better to have a copy on site in addition to any off-site copies you might have.

Regardless, you should hire a lawyer with relevant experience, because you need advice from someone who can find out whether there has been any litigation that may have a bearing on your rights and obligations, and you should find out what state and local law have to say about this, if anything. This is a criminal statute, and trying to protect yourself from criminal liability without qualified legal advice is quite possibly going to leave you vulnerable.