Platform Reporting Obligations to NCMEC, Explained

US platforms that host user content will, sooner or later, encounter apparent child sexual abuse material (CSAM) or related exploitation. When that happens, federal law imposes a specific duty. This is a plain summary of what 18 U.S.C. 2258A actually requires, what the CyberTipline is, what a report should contain, and what changed under the REPORT Act of 2024. It is a description of statutory obligations, not legal advice. Consult counsel for your specific situation.

The core duty: report once you have actual knowledge

Section 2258A applies to "providers," a broad category that covers electronic communication service providers and remote computing service providers. The central obligation is in subsection (a): a provider that obtains actual knowledge of facts or circumstances involving an apparent violation of the listed offenses "shall, as soon as reasonably possible," make a report to the CyberTipline operated by the National Center for Missing and Exploited Children (NCMEC).

Two words carry a lot of weight. First, actual knowledge. The trigger is actual knowledge, not constructive or imputed knowledge. A provider that has actually become aware of apparent CSAM must report. Second, apparent. The statute does not ask providers to adjudicate whether a crime occurred. It asks them to report apparent violations. NCMEC staff and, ultimately, law enforcement handle the review and investigation.

What is reportable

The reportable offenses are the child pornography provisions at 18 U.S.C. 2251, 2251A, 2252, 2252A, 2252B, and 2260. Following the REPORT Act, the list also includes section 1591 where the violation involves a minor (child sex trafficking) and section 2422(b) (coercion and enticement of a minor). We return to that change below.

No monitoring mandate

This is the point platforms most often get wrong. Section 2258A(f), the "protection of privacy" provision, states that nothing in the section shall be construed to require a provider to monitor any user, subscriber, or customer; to monitor the content of any communication; or to "affirmatively search, screen, or scan for" the facts or circumstances that would be reportable.

In plain terms: US law requires you to report apparent CSAM once you have actual knowledge, but it does not require you to go looking for it. Many platforms choose to scan proactively, which is permitted, but the statute itself does not compel proactive detection. This distinction matters when platforms design trust and safety programs and when they describe those programs publicly.

What the CyberTipline is, and who does the reviewing

NCMEC established the CyberTipline in 1998 as the centralized US mechanism for reporting suspected online child sexual exploitation. It receives reports from the public and from registered providers. NCMEC reports it has received well over 195 million CyberTipline reports since inception, and that more than 1,400 companies are registered to report.

It is worth being precise about how reports are handled. The platform is the reporting entity under US law. NCMEC is not a law enforcement agency and does not itself prosecute. NCMEC staff may review content reported to the CyberTipline, add context, and then make reports available to law enforcement for independent review. Reporting is not an automated pipeline that ends in an arrest. People review these reports at multiple stages. Platforms should describe the process in those terms rather than implying that a report triggers automatic action.

What a report should contain

Subsection (b) describes information a provider may include, at its discretion, to the extent the information is applicable and reasonably available. This includes information identifying the involved individual, such as email address, IP address, and URL; historical reference information such as the date and time of the reported content; geographic location information; and the images, videos, or other content at issue, along with the complete communication when relevant. More complete reports help NCMEC and law enforcement act on them, but the statute frames much of this content as within the provider's discretion.

Preservation

When a provider submits a report, subsection (h) treats the submission as a request to preserve the contents of the report. The preservation period is now 1 year after submission. Providers may voluntarily preserve for longer to help prevent or reduce online child sexual exploitation. Preservation is not the same as production; it holds the material so that law enforcement has a realistic window to seek it through proper legal process.

Penalties for failure to report

Subsection (e) sets civil penalties for a knowing and willful failure to report. After the REPORT Act, the amounts are tiered by provider size. For an initial knowing and willful failure, the figures are up to $600,000, or up to $850,000 for larger providers. For a second or subsequent failure, they rise to up to $850,000, or up to $1,000,000 for larger providers. Before the 2024 amendments these figures were $150,000 and $300,000.

What the REPORT Act of 2024 changed

The REPORT Act (S.474, 118th Congress) was signed into law on May 7, 2024. According to analysis from Thorn and law firm summaries, it made several concrete changes:

• It added child sex trafficking (section 1591, where a minor is involved) and coercion and enticement (section 2422) to the reportable categories, so reporting is no longer limited to CSAM-type offenses.
• It extended the preservation period from 90 days to 1 year.
• It increased the civil penalties for knowing and willful failure to report, as set out above.
• It directed NCMEC to issue guidance to help providers identify content indicating trafficking or enticement; NCMEC released that guidance in October 2024.

The practical effect is a broader reporting scope, a longer preservation obligation, and higher exposure for providers that knowingly fail to report.