For any platform that allows user-uploaded images or video -- and especially platforms hosting adult content -- detecting and reporting child sexual abuse material (CSAM) is both a legal obligation and a moral imperative. Under 18 U.S.C. § 2258A, electronic service providers (ESPs) that obtain actual knowledge of apparent CSAM on their platform must report it to the National Center for Missing & Exploited Children (NCMEC) via the CyberTipline. Failure to report carries fines of up to $300,000 per violation.

This guide covers the legal framework, the technical tools available for detection, how to build a detection pipeline, and how to implement NCMEC CyberTipline reporting.

Legal Obligations Under 18 U.S.C. 2258A

The PROTECT Our Children Act of 2008 (Public Law 110-401) established the mandatory reporting requirement codified at 18 U.S.C. § 2258A. Key provisions:

  • Who must report: Any "electronic service provider" (ESP) -- defined broadly to include any provider of an electronic communication service, remote computing service, or any other entity that provides users with the ability to communicate, create, or share content. This includes social media platforms, hosting providers, cloud storage services, messaging apps, and adult content platforms.
  • What triggers reporting: "Actual knowledge" of any facts or circumstances from which apparent CSAM is evident. Note: the law does not require you to actively search for CSAM, but if you become aware of it (through user reports, automated detection, manual review, or any other means), you must report it.
  • Where to report: Exclusively to NCMEC via the CyberTipline. You may not report directly to law enforcement -- NCMEC serves as the clearinghouse and forwards reports to the appropriate law enforcement agencies.
  • When to report: "As soon as reasonably possible" after obtaining actual knowledge. There is no specific hour or day deadline in the statute, but unreasonable delay exposes the provider to liability.
  • Content preservation: Upon submitting a report, the ESP must preserve the reported content and associated data (IP addresses, timestamps, account information) for at least 90 days, or longer if requested by law enforcement (18 U.S.C. § 2258A(h)).

Penalties

Violation Penalty
Failure to report (knowing) Fine up to $150,000 per report not filed
Failure to report (second offense or pattern) Fine up to $300,000 per report not filed
Failure to preserve content Same penalty structure as failure to report

Additionally, knowingly possessing, distributing, or producing CSAM carries separate criminal penalties under 18 U.S.C. §§ 2251-2252A, with sentences ranging from 15 to 30 years for production offenses.

Perceptual Hashing: The Foundation of Detection

The primary technical approach to CSAM detection is perceptual hashing -- algorithms that generate a compact "fingerprint" of an image or video that is robust to minor modifications (resizing, cropping, compression, color adjustments). Unlike cryptographic hashes (SHA-256, MD5), perceptual hashes produce similar outputs for visually similar inputs.

PDQ (Perceptual hash, Discrete cosine transform, Quality metric)

Developed by Meta (Facebook) and released as open source, PDQ is the most widely adopted perceptual hashing algorithm for CSAM detection. It produces a 256-bit hash from an image and includes a quality metric that indicates hash reliability.

  • Input: Any image (JPEG, PNG, BMP, etc.)
  • Output: 256-bit hash + quality score (0-100)
  • Matching: Hamming distance between hashes. A distance below a threshold (typically 31 bits for a 256-bit hash) indicates a match.
  • Robustness: Resistant to resizing, JPEG compression, moderate cropping, brightness/contrast adjustments.
  • Speed: Can process thousands of images per second on commodity hardware.
  • Source: Open source via Meta's ThreatExchange: github.com/facebook/ThreatExchange

PhotoDNA

Developed by Microsoft Research and Dartmouth College, PhotoDNA is the original perceptual hashing system purpose-built for CSAM detection. It is used by NCMEC itself and by major platforms (Microsoft, Google, Facebook). PhotoDNA is not open source -- access is provided through Microsoft's licensing program, typically at no cost for qualifying organizations.

TMK+PDQF (Temporal Match Kernel)

Also developed by Meta, TMK+PDQF extends perceptual hashing to video content. It generates frame-level PDQ hashes and uses a temporal matching kernel to compare video sequences, accounting for different frame rates, re-encoding, and clip extraction.

CSAI Match (Google)

Google's Content Safety API includes a CSAM detection component that uses deep learning classifiers trained on known CSAM (in partnership with NCMEC). Unlike hash-based matching, CSAI Match can detect previously unknown CSAM. Access requires application and approval from Google.

Hash Databases

Perceptual hashing is only useful if you have a database of known CSAM hashes to match against. The primary sources:

  • NCMEC Hash Sharing Program: NCMEC provides hashes of confirmed CSAM from CyberTipline reports to qualifying ESPs. This is the largest and most authoritative hash database. Participation requires an agreement with NCMEC.
  • Meta ThreatExchange: A platform for sharing threat indicators, including PDQ hashes of known CSAM. Participation requires Meta approval.
  • IWF (Internet Watch Foundation): UK-based organization that maintains a hash list of confirmed CSAM. Available to qualifying organizations, particularly those operating in the UK or EU.
  • Project Arachnid (Canadian Centre for Child Protection): Maintains a database of known CSAM URLs and hashes, with an API for automated detection and removal.

Building a Detection Pipeline

A robust CSAM detection pipeline operates at multiple stages of the content lifecycle:

Stage 1: Upload-Time Scanning

Every image and video uploaded to the platform is hashed and compared against known CSAM hash databases before it is published or stored permanently.

  1. Content is uploaded to a staging area (not yet visible to other users)
  2. PDQ hash is computed for images; TMK+PDQF for video
  3. Hashes are compared against the NCMEC hash database and any other subscribed databases
  4. If a match is found: content is quarantined, the uploader's account is flagged, and a CyberTipline report is initiated
  5. If no match: content proceeds to the next stage of the moderation pipeline

Stage 2: Classifier-Based Detection

Hash matching only catches known CSAM. To detect previously unseen material, platforms should deploy machine learning classifiers trained to identify likely CSAM. Google's CSAI Match and similar classifiers can flag content for human review without matching against a specific hash database.

Important: classifier-based detection produces probabilities, not certainties. Flagged content must be reviewed by a trained human moderator before a CyberTipline report is filed. False positives are common, especially on adult content platforms where legal content may share visual characteristics with flagged categories.

Stage 3: Re-Scanning Existing Content

Hash databases are updated regularly as new CSAM is identified. Platforms must periodically re-scan their existing content library against updated hash databases. A weekly or daily re-scan cycle is standard practice.

Stage 4: User Reporting

Provide a clear, accessible mechanism for users to report suspected CSAM. User reports should be triaged by trained moderators and, when warranted, result in a CyberTipline report.

NCMEC CyberTipline Reporting

The CyberTipline is NCMEC's centralized reporting system for online exploitation of children. ESPs can submit reports via:

  • Web form: Manual submission at report.cybertipline.org
  • API (ESP Reporting API): Automated submission for platforms with significant volume. Requires registration as an ESP with NCMEC.
  • XML file upload: Batch reporting via structured XML files.

Report Contents

A CyberTipline report must include as much of the following as is reasonably available:

  1. Reporter information: ESP name, contact information, report date
  2. Incident information: Date/time of upload or discovery, type of content, URL where content was found
  3. Uploader/suspect information: Username, email address, IP address at time of upload, registration information, any known identifying information
  4. Uploaded content: The actual image or video (or a preserved copy), file metadata, hash values
  5. Additional context: How the content was discovered (hash match, user report, manual review), any communications associated with the content

Implementing Automated Reporting

TrustGate's moderation API integrates CSAM detection with automated CyberTipline report preparation:

// TrustGate content moderation with CSAM detection
const moderationResult = await fetch('https://api.trustgate.dev/v1/moderation/scan', {
  method: 'POST',
  headers: {
    'Authorization': 'Bearer tg_live_...',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    content_id: 'img_xyz789',
    content_url: 'https://cdn.example.com/uploads/img_xyz789.jpg',
    scan_types: ['csam_hash', 'csam_classifier', 'age_estimation'],
    uploader: {
      user_id: 'user_456',
      ip_address: '203.0.113.42',
      upload_timestamp: '2026-04-11T14:30:00Z'
    }
  })
});

// Response structure
// {
//   "content_id": "img_xyz789",
//   "scan_results": {
//     "csam_hash": { "match": false, "databases_checked": ["ncmec", "iwf"] },
//     "csam_classifier": { "flagged": false, "confidence": 0.02 },
//     "age_estimation": { "estimated_age": 28, "confidence": 0.91 }
//   },
//   "action": "approved",
//   "report_required": false
// }

// If CSAM is detected, TrustGate automatically:
// 1. Quarantines the content
// 2. Preserves all associated metadata per 18 U.S.C. 2258A(h)
// 3. Prepares a CyberTipline report draft for ESP review
// 4. Flags the uploader account for investigation

Best Practices

  1. Never delete suspected CSAM before reporting. Preservation is a legal requirement. Quarantine the content (remove from public access) but retain it in a secure, access-controlled storage system for at least 90 days.
  2. Train human moderators. Automated detection is the first line, but human review is essential for classifier-flagged content and for making the final determination on borderline cases. Moderators must be trained on legal definitions and on recognizing the psychological impact of the work. Provide mental health support.
  3. Log everything. Maintain detailed audit logs of all scanning activity, matches, moderator decisions, and CyberTipline reports. These logs are essential for demonstrating good-faith compliance.
  4. Update hash databases regularly. NCMEC and other providers update their hash databases continuously. Re-ingest updated hashes at least weekly.
  5. Defense in depth. Use multiple detection methods (hash matching + classifiers + user reporting + manual review). No single method catches everything.
  6. Secure your detection infrastructure. CSAM hash databases and any quarantined content must be stored with strict access controls. Limit access to authorized personnel only. Encrypt at rest and in transit.
  7. Document your procedures. Maintain written policies for CSAM detection, reporting, and content preservation. These policies should be reviewed by legal counsel and updated annually.

Integration with Platform Compliance

CSAM detection does not exist in isolation. It is one component of a broader content moderation and compliance system. Platforms should integrate CSAM scanning with their 2257 record-keeping (to verify performer ages at upload time), age verification (to prevent minors from accessing the platform), and payment compliance (payment processors require CSAM detection as a condition of service).

TrustGate's moderation module provides a unified pipeline where content passes through CSAM scanning, age estimation, content classification, and jurisdiction-specific rule enforcement in a single API call. The goal is to make robust content safety the default, not an afterthought. See our regulatory tracker for reporting obligation details by jurisdiction.