REPORT Act

Concerns about the online sexual exploitation of minors, including child sexual abuse material (CSAM), online enticement, grooming, and child trafficking, have grown in the digital age. The CyberTipline, operated by NCMEC, serves as the central U.S. mechanism for receiving and processing reports of suspected child sexual exploitation. Under federal law, electronic communication service providers (ECSPs) and remote computing service providers (RCSPs) are required to report apparent instances of child sexual abuse material (CSAM) and related crimes to NCMEC, which then shares the information to appropriate law enforcement agencies. In recent years, online exploitation reports have risen dramatically, reflecting both increased detection by platforms and the proliferation of encrypted, anonymous, and generative AI technologies. Policymakers and advocacy organizations like NCMEC and RAINN argued that the existing framework did not adequately cover grooming, enticement, or child-trafficking offenses while law enforcement organizations reported that short required data-retention periods hindered investigations due to the growing volume of reports. A 2024 report by the Stanford Internet Observatory (SIO) found that while the CyberTipline remained “an enormously valuable public-private partnership,” its data-retention rules, system capacity, and provider-interface design had “not kept pace with the scale and complexity of modern online exploitation.” == Prior law ==

Before the enactment of the REPORT Act, federal reporting requirements for online providers were governed by 18 U.S.C. § 2258A, created through the PROTECT Our Children Act of 2008. Under this framework, providers had to submit reports to the CyberTipline, preserve related content and subscriber information for at least 90 days, and cooperate with law enforcement or face civil penalties for willful failure to report. Critics said the standard of “actual knowledge” was too narrow, excluding behaviors such as grooming, enticement, and trafficking. The 90-day retention period was viewed as insufficient for lengthy investigations, and the statute did not clearly address liability for vendors that processed CSAM data or for victims who self-reported exploitative imagery. The Stanford Internet Observatory concluded that these limitations led to inconsistent reporting practices and placed strain on investigative capacity. == Legislation ==

The REPORT Act was introduced in the 118th Congress as S. 474, sponsored by Senator Jon Ossoff and co-sponsored by Senator Marsha Blackburn. Blackburn had been active in child-online-safety legislation since 2022, having co-sponsored the Kids Online Safety Act and held hearings on technology’s impact on minors. While the full Senate passed S. 474 by unanimous consent on December 14, 2023, policy observers noted significant trade-offs were discussed during the legislative process. The bill passed the House of Representatives on April 29, 2024, and was signed into law on May 7, 2024. A Congressional Budget Office analysis estimated that implementation would have little net budgetary impact but would modestly increase federal oversight and guidance activity. Provisions The Act expands the list of offenses requiring reports to NCMEC to include child sex trafficking, coercion or enticement of a minor, and other online exploitation crimes. It replaces the “actual knowledge” requirement with an obligation to report when a provider becomes aware of an apparent violation, broadening when companies must notify authorities. The Act extended protections to companies that contract with NCMEC to process or store CSAM, provided they comply with statutory requirements A further provision in the REPORT Act authorizes NCMEC to issue guidelines on how to recognize indicators of online enticement of children for sexual purposes and child sex trafficking. NCMEC released those guidelines in October 2024. Under the prior version of 18 U.S.C. § 2258A, providers that knowingly and willfully failed to report could be fined up to $150,000 for the first offense and $300,000 for patterns of violation. The REPORT Act increased the fines substantially with maximum penalties of $600,000–850,000 for the first offense and $850,000–1,000,000 for patterns of violation. == References ==