CSAM on your forum: the federal duty to report
No forum owner wants to think about it, but any site that accepts uploads or private messages can be abused. U.S. law sets a clear duty once you know, and it doesn't require you to scan everything.
- A provider that obtains actual knowledge of an apparent violation involving child sexual abuse material must report it to NCMEC's CyberTipline as soon as reasonably possible.
- A completed CyberTipline report is treated as a request to preserve its contents for 1 year.
- The law does not require providers to monitor users or affirmatively scan content.
- Knowing and willful failure to report can bring fines of up to $600,000 for a first violation by a provider with under 100 million monthly active users.
Who has to report
18 U.S.C. 2258A, reporting requirements of providers applies to a "provider," which 18 U.S.C. 2258E, definitions defines to include electronic communication service and remote computing service providers. A forum that lets members post and message typically fits this description.
The duty
The law says a provider "shall, as soon as reasonably possible after obtaining actual knowledge" of facts or circumstances showing an apparent violation of the federal child pornography statutes, or of certain child sex trafficking or enticement statutes, report them to NCMEC's CyberTipline. The provider may also report facts indicating a violation "may be planned or imminent."
Preservation
A completed CyberTipline report "shall be treated as a request to preserve the contents provided in the report for 1 year." The provider must also preserve reasonably accessible related files that may give context, store them securely and limit staff access to what's needed.
No duty to scan
The statute says nothing in it requires a provider to "monitor any user," monitor the content of communications, or "affirmatively search, screen, or scan" for this material. The duty is triggered by actual knowledge.
Penalties
A provider that "knowingly and willfully fails to make a report" faces a fine of up to $600,000 for a first failure if it has under 100,000,000 monthly active users ($850,000 for larger providers), and higher amounts for later failures.
A simple admin playbook
- Don't download, forward or share the material. Restrict access to the post or upload.
- Report through NCMEC's CyberTipline.
- Preserve the reported content and related logs securely for at least a year.
- Ban the account and document what you did and when.
- Write a short internal procedure so any moderator knows to escalate immediately.
Related: the TAKE IT DOWN Act for forums and data breach response.
General information, not legal advice. Sources: 18 U.S.C. 2258A, reporting requirements of providers; 18 U.S.C. 2258E, definitions.
Published October 31, 2026. We do not use affiliate links on this page; see our Affiliate Disclosure.