The REPORT Act modernizes how online service providers report child sexual exploitation to the National Center for Missing and Exploited Children (NCMEC) and the length of time that Electronic Service Providers are required to maintain related records. The act updated the provisions under Title 18 USC 2258A and 2258B and extends evidence preservation, broadens reporting obligations, raises penalties, and clarifies liability protections for vendors and victims. It helps ICAC investigations catch up and ensure the evidence will be there when needed. Here is what investigators need to know.
What the REPORT Act Requires
1. Extended Evidence Preservation
Providers must preserve CyberTipline reports for at least one year, up from 90 days. They may voluntarily preserve content longer to combat child sexual exploitation. They also must follow NIST cybersecurity standards when storing such reports.
(Congress.gov)
2. Broadened Reporting Duty
Providers must report not only child sexual abuse material but also child sex trafficking, coercion, or enticement of a minor into prostitution or other illegal sexual activity, including possible or imminent violations.
(Congress.gov)
3. Increased Penalties
The law raises fines significantly:
- Up to $850,000 for providers with under 100 million monthly active users.
- Up to $1 million for providers with 100 million or more users.
Previous limits were $150,000 and $300,000 respectively.
4. Vendor Liability Protection with Conditions
Vendors that store or transfer CSAM for NCMEC are shielded from civil or criminal claims, but only if they meet certain cybersecurity requirements.
5. Protections for Minors Reporting
Minors or their representatives who report CSAM via CyberTipline (even if the report includes their own depiction) are protected from civil or criminal liability.
How the REPORT Act Supports Digital Investigations
Search warrants often rely on preserved records from providers. The extra time to collect records ensures that when investigators make it to the report in the massive backlog of Cybertip reports, there will still be evidence.
- A Snapchat search warrant needs stored content and metadata. The one-year preservation ensures data remains available when needed. Link: Snapchat search warrants
Many trafficking cases did not generate CyberTipline reports in the past because they did not involve traditional child sexual abuse material. With the REPORT Act, service provider requirements means more cases are entering law enforcement pipelines. These reports also give investigators access to valuable digital identifiers such as IP addresses, payment methods, and communication records, allowing them to act before offenders move victims or erase evidence. In addition, higher reporting rates give task forces like ICAC and federal agencies a broader intelligence picture, helping them connect offenders across platforms and jurisdictions. This makes it possible to dismantle trafficking networks rather than addressing isolated incidents.
Summary of Key Legal Changes
| Change | Detail |
|---|---|
| Preservation | From 90 days to 1 year; storage must follow NIST standards |
| Scope | Adds child sex trafficking, coercion, enticement of minors |
| Penalties | Maximum fines: $850K (<100M users); $1M (≥100M users) |
| Vendor Protection | Liability shield if cybersecurity standards are met |
| Minor Reporting | No liability for minors or their representatives reporting CSAM of themselves |
