CSAM protections and platform reporting

Full Title:
STOP CSAM Act of 2025

Summary#

This bill, the STOP CSAM Act of 2025, tightens protections for child victims in federal court, changes how online service providers must report apparent child sexual abuse material, and creates new civil and criminal liabilities for some online platforms. Its broad goals are to protect victims, improve reporting to the National Center for Missing & Exploited Children (NCMEC), and increase transparency and accountability by big tech companies. The bill also changes restitution rules and authorizes money for court-related victim services.

Key changes:

  • Expands who counts as a “covered person” and creates a broad category of “protected information” (names, contact details, medical or school records, online account identifiers, and more) that courts must presumptively protect from public disclosure.
  • Requires many online providers to report to NCMEC’s CyberTipline “as soon as reasonably possible” and no later than 60 days after learning of apparent child pornography or other listed child-exploitation risks, and specifies detailed data elements that reports should include.
  • Creates new civil claims allowing victims to sue interactive computer service providers or app stores for knowing, reckless, or intentional promotion, aiding, or hosting of child sexual exploitation, with damages (actual or $300,000), attorneys’ fees, and no statute of limitations.
  • Imposes criminal and civil penalties on providers who knowingly fail reporting or preservation duties, and adds a new criminal/fine-based provision for providers that intentionally host or knowingly promote child pornography.
  • Expands restitution rules, allows courts to appoint trustees to hold restitution for victims (including certain foreign victims), and authorizes federal funding for these court programs.

What it means for you#

  • Children and victims

    • Greater privacy in federal cases: courts must presume protected information about child victims (now called “covered persons”) should not be publicly disclosed.
    • Victims get broader ways to seek money and other relief, and courts can create trusts to hold restitution payments for minors, incapacitated persons, or some foreign victims.

  • Parents and guardians

    • Parents or guardians can consent to include account material in CyberTipline reports when they notify a provider.
    • Guardian ad litem (court-appointed advocates for a child) must try to gather and present a child’s views and use age-appropriate forms.

  • Online platforms, app stores, and large providers

    • Must report apparent child pornography or signs of listed offenses to NCMEC promptly (no later than 60 days).
    • Large providers (over 1,000,000 monthly users and >$50M revenue) must submit annual transparency reports to the Justice Department and FTC describing reports, policies, safety measures, and trends; those reports may be published (with redaction).
    • Face new criminal fines, civil penalties, and a private civil cause of action if they intentionally, knowingly, or recklessly promote, aid, host, or make available child sexual exploitation material.
    • Have limited defenses for liability tied to removing material promptly (48 hours or 2 business days for smaller providers) and some protections for encryption use, but may still face civil exposure.

  • NCMEC and law enforcement

    • NCMEC’s role as the clearinghouse is reinforced. It may compare technical identifiers (hashes) and make reports available to federal, state, local, or certain foreign law enforcement agencies designated by the Attorney General.

  • Federal courts

    • New duties to protect victims’ identifying information, to appoint trustees or fiduciaries for restitution funds, and to manage victim-impact reporting and guardian-ad-litem work.

Expenses#

The bill authorizes specific annual appropriations for court-related victim services but does not provide a full government cost estimate.

  • Authorized appropriations included in the bill:

    • $25,000,000 per fiscal year to the U.S. courts to carry out certain guardian ad litem provisions.
    • $15,000,000 per fiscal year to the U.S. courts for administering trustee or fiduciary arrangements to hold restitution funds for victims.

  • Fines and penalties:

    • New criminal fines for reporting violations and for the new provider offense (up to $850,000–$1,000,000 for large providers on initial or repeat violations; up to $5,000,000 in cases involving serious harm).
    • Civil penalties range from $50,000–$250,000 for certain reporting or preservation violations, and $100,000–$1,000,000 for annual-report related violations; penalties may be trebled if an individual is harmed.
    • Collected fines and penalties are to be deposited into the Child Pornography Victims Reserve.

  • Other likely costs (not estimated in the bill text):

    • Compliance costs for providers (staff, systems to preserve data, reporting formats, annual reports).
    • Enforcement costs for DOJ, FTC, courts, and potential impact on NCMEC operations.

No comprehensive fiscal note is included in the bill text. No publicly available information on the total long-term cost or savings is provided in the material supplied.

Proponents' View#

The bill text and title indicate several aims that could be offered in support:

  • The bill appears intended to strengthen privacy and safety for child victims in federal proceedings by expanding “protected information” and creating a presumption against public disclosure.
  • It appears intended to improve reporting and the quality of information sent to NCMEC so law enforcement can identify and protect victims and investigate offenders more effectively.
  • The bill appears intended to increase transparency by requiring large online providers to publish annual reports about how they detect and prevent child sexual exploitation.
  • It appears intended to create stronger tools for victims to obtain compensation and hold platforms accountable when they intentionally or recklessly enable exploitation.
  • The bill provides targeted funding to courts for guardian ad litem services and for trustees to manage restitution payments.

Opponents' View#

The bill’s design raises several potential concerns and trade-offs that emerge from the text:

  • One concern is the expanded civil liability and new criminal fines for providers. This could expose many platforms and app stores to lawsuits and heavy penalties, creating legal and financial risk for the companies the law targets.
  • The bill does not fully explain how enforcement resources will be funded beyond the limited appropriations for courts; increased enforcement could require additional DOJ, FTC, NCMEC, or court resources.
  • The civil remedy section narrows no statute-of-limitations and limits Section 230 defenses for specified claims. This may raise questions about how existing immunity for online platforms will interact with the new private causes of action.
  • Reporting requirements include detailed account-level data and may require platforms to collect, preserve, and disclose sensitive user information. This could raise privacy and compliance burdens. The bill allows inclusion of account content if a user or guardian consents, but many reporting scenarios involve material identified without user consent.
  • The bill requires NCMEC to make reports available to designated foreign law enforcement agencies. It is unclear what safeguards govern sharing with foreign agencies and how those safeguards will be applied.
  • Definitions such as “publicly available” or the scope of “protected information” are broad in places. It is unclear how courts and providers will apply those terms in practice, and this vagueness could lead to litigation over scope and implementation.
  • The bill provides defenses and exceptions for encryption, but it also creates incentives and inquiries that could pressure providers to change encryption or design choices; how this will affect user privacy and security is not spelled out.

What is unclear from the bill text:

  • A full government cost estimate (beyond the two appropriation amounts) is not provided.
  • How the Attorney General or FTC will handle publication and redaction of provider annual reports in practice.
  • The operational details and timelines for NCMEC forwarding reports to foreign agencies and the safeguards that will apply.