Does Google Scan Photos You Upload? What Triggers a Report.

Do I have to share a file for it to be detected?

No. As we have discussed with many clients in the past, there is a common misconception that cloud backup is a safe haven. In reality, backing up your photos can still expose them to Google’s detection systems. While these systems are automated, the results of their scans are routinely checked by human reviewers. If a flagged file is sent to a human reviewer and found to be illegal, it will be reported to NCMEC, which can trigger a federal criminal investigation.

Do I have to publicly share a file for it to be detected?

No. Google scans files that are uploaded to its services, including those that it identifies as child sexual abuse material (CSAM). This includes files shared with specific individuals, those shared via a link, and those stored through Google Photos.

Can Google remove my content or suspend my account?

Yes. Google has the ability to remove flagged content and suspend the associated account. Google’s policies allow the company to take these steps if it detects CSAM or other violations of its Terms of Service.

Are companies required to scan their services?

No. While Google has developed systems to detect CSAM, it is not legally required to monitor users or affirmatively search for violations. Section 2258A of the United States Code imposes no such duty. In fact, Section 2258A(f) explicitly states: “Nothing in this section shall be construed to require a provider to, (1) monitor any user, subscriber, or customer of that provider; (2) monitor the content of any communication of any person described in paragraph (1); or (3) affirmatively search, screen, or scan for facts or circumstances described in sections (a) and (b).”

Therefore, the tools Google uses to identify and report CSAM are used at the company’s discretion, rather than as a legal mandate.

Which Google photos and files can be scanned?

Google states that scanning begins when users affirmatively upload or back up images to its services. The process is designed to ensure that users are aware of when their content is being uploaded to Google’s cloud storage and then scanned by the company’s automated detection systems.

With this in mind, it is important to consider both the ways that you can affirmatively upload or back up images to Google and the ways that images can be automatically uploaded to Google without your knowledge.

How images get to Google

There are a few different ways that an image can find its way into Google’s cloud storage. These are the ways that you will need to consider when thinking about whether or not you are uploading or backing up images to Google. Some of these methods can result in automatic uploads after users enable a feature.

What happens when Google images are backed up?

When you enable the backup feature in Google Photos, your images can be backed up to Google automatically. This can result in you potentially exposing yourself to potential federal investigation without your knowledge. For example, users who have their backup settings on may find that the images they take on their devices are automatically backed up to Google.

How are Google Photos different from Google Search?

Google Search indexing is operationally separate from the process of scanning images and videos that users have affirmatively uploaded or backed up to their private cloud accounts. When Google Search indexes images, it is indexing images that have been made available online. This process is completely different from how images get into Google’s cloud storage and are then scanned by its automated detection systems.

Can you access my Android photos without my knowledge?

If you use an Android device, your photos and videos are not automatically sent to Google. As long as you do not have backup turned on or do not affirmatively send your Android photos to Google using another service, Google will not be able to scan your photos and videos.

However, remember that when you send a Gmail attachment or you send a photo using Google Chat, you are transmitting an image to Google’s servers. This will trigger Google’s scanning process as well.

Can you stop Google from scanning photos and videos?

If you are concerned that you are exposing yourself to a potential federal investigation by backing up images or videos through Google Photos, you can turn off the backup feature in your device’s settings. This will prevent future images and videos from being automatically uploaded to Google.

However, turning off backup does not necessarily stop Google from scanning images and videos that have been uploaded to its cloud storage in the past. If you want to stop Google from scanning your content that you have uploaded to its cloud storage, you will need to delete the files.

What actually triggers Google to flag a photo?

How is hash matching used to identify CSAM?

Google uses hash matching to identify child sexual abuse material (CSAM). Hash matching allows Google to quickly identify known CSAM without having to manually review every image and video that users upload or back up to its services. This process involves converting the image and video into a hash, which is a digital fingerprint, and then comparing the hash with a database of known CSAM hashes.

Because every file has its own unique hash, this allows Google to quickly identify suspected CSAM. This process is a primary driver of the automated detection systems that are used by Google, other major tech companies, and even various law enforcement agencies. This detection system is far more efficient than human review, and it enables Google to find CSAM on its platform far more often.

How are hash matching and AI used to identify images and videos that are flagged?

Hash matching and artificial intelligence are used to identify images and videos that are flagged for review by Google’s human reviewers. In addition to identifying known CSAM through hash matching, Google uses AI to identify suspected CSAM. While the use of AI has been shown to identify suspected CSAM that has not been previously seen, AI is also prone to generating false positives. When an image or video is flagged by Google’s detection systems, it is then sent to a human reviewer for confirmation of whether or not it contains child sexual abuse material.

What role do human reviewers play in identifying CSAM?

Human reviewers play a critical role in identifying CSAM on Google. As a result, their involvement is meant to mitigate some of the errors that are produced by Google’s automated detection systems. A human reviewer is able to examine the file to see if it contains CSAM and then report it to NCMEC if necessary. This process is particularly important when it comes to hash matching because images that do not contain child sexual abuse material can still trigger a reported hash match. A human reviewer can consider the context of the image, which allows it to distinguish legitimate and non-sexual imagery from other content that may otherwise produce a reported hash match.

What happens when an image or video is flagged?

When an image or video is flagged, several things can happen, including:

• Being reported to NCMEC,
• Removal of the content,
• Suspension of the user’s account,
• Restricting access to its services,
• Taking other steps that are consistent with its Terms of Service.

When Google detects child sexual abuse material, it reports the file to NCMEC. NCMEC is the center responsible for collecting reports and facilitating the investigation of child sexual abuse in the United States, and it may forward this information to federal law enforcement. Reports from Google can lead to the initiation of a federal criminal investigation for suspected possession of child sexual abuse material. When dealing with reported images, it is important that you reach out to a lawyer so that you can help protect yourself.

When does Google report a photo to NCMEC?

When does Google have to report an image?

Google is obligated to report suspected images and videos that contain child sexual abuse material under 18 U.S.C. § 2258A. Section 2258A requires providers of electronic communication services or remote computing services to report to the CyberTipline of the National Center for Missing & Exploited Children, as soon as reasonably possible, whenever they obtain actual knowledge of any facts or circumstances indicating an apparent violation of the federal child pornography or sexual exploitation laws involving a minor. While this provision requires reporting for apparent violations, the law allows for more discretion when reporting suspected sexual abuse of children.

Where does Google send these reports?

Rather than reporting directly to federal prosecutors, providers send their CyberTipline reports to the National Center for Missing & Exploited Children (NCMEC). NCMEC is a private nonprofit organization that is not a law enforcement agency per se. When NCMEC receives a report, it evaluates the report and then decides whether it warrants referral to law enforcement. This process of referral helps clear up some of the false positives that may result from providers’ automated detection systems.

Does Google include the image in the CyberTipline report?

No. Section 2258A does not require it. Under Section 2258A(b), a provider may, at its sole discretion, include the offending images in its CyberTipline report. This includes images that do not have a corresponding hash in the database, as well as images that trigger a hash collision with a known CSAM hash. Google can also include information about the user’s account, such as the user’s name, IP address, and the photos or videos that triggered a reported hash match.

Does Google report other violations as well?

Although Section 2258A requires Google to report an apparent specified child exploitation offense, it also provides leeway for Google to report other violations as well. Google can also report suspected violations of its Terms of Service if it comes across the relevant content. In these cases, Google may report such information to the Federal Bureau of Investigation (FBI) or other law enforcement agencies.

Does Google have to report when it possesses an image that is not apparent CSAM?

No. Section 2258A requires providers to report when they have actual knowledge of facts which indicate, on a good faith basis, an apparent specified child exploitation offense. As long as an image does not contain what appears to be child sexual abuse material, it is not considered a reportable image.

However, that is only as long as the provider does not have actual knowledge that it has images that it should report. If an image does not contain CSAM and is not a reportable image and then the image later becomes clear as containing CSAM, this can trigger an obligation to report under Section 2258A. If Google is not required to report it, the user has the right to keep the image on Google.

Where is Google’s CSAM reported from located?

Google reports suspected child sexual abuse material from its data center locations. Google has data centers and cloud data center locations all over the world. Depending on which data center you use for your files, Google may report images and videos that you store in various jurisdictions. However, for many users, the reports will come from Google’s U.S. data centers.

If any of this describes your situation, it is worth talking it through with counsel. Spodek Law Group can be reached at 212-300-5196.

Does a Google suspension mean police are investigating?

If Google suspends your account, does it mean you are being investigated?

If Google suspends your account, this suspension may affect all of the services to which you have linked your account. This includes Gmail, Google Photos, Google Drive, and more.

If you find out that Google suspended your account because of suspected child sexual abuse material, it may mean that a CyberTipline report has been submitted. Because a CyberTipline report can trigger a federal criminal investigation, law enforcement may find out about the report before you find out about the suspension.

What happens after a CyberTipline referral is sent?

Once a law enforcement agency receives a CyberTipline referral, it will search for information about the account holder. If the report includes an IP address, the law enforcement agency may contact the internet service provider associated with the IP address, and the ISP may turn over information about the internet subscriber.

Law enforcement may also use a CyberTipline referral as probable cause when applying for a search warrant. This search warrant can be for the Google account, the person’s home, and electronic devices such as their smartphone or computer.

How do I know whether Google submitted a CyberTipline report and whether federal law enforcement has opened an investigation?

If Google suspends your account, it does not establish that Google has submitted a CyberTipline report. Similarly, just because Google has submitted a CyberTipline report does not establish that law enforcement is investigating you. While a CyberTipline report is an indicator that an investigation may be imminent, there are several reasons why a CyberTipline report may not lead to an investigation.

If your account is disabled, how do you appeal your account suspension?

If your account is disabled, Google provides an option to appeal the suspension in some cases. When attempting to regain access, however, the appeal process does not provide you with information about whether Google reported suspected CSAM or if federal law enforcement has opened an investigation. Additionally, when appealing, there is no guarantee that your account will be reinstated.

Can I restore my disabled account?

When attempting to restore your disabled account, you must choose to appeal the decision. When appealing the decision, you should include any additional information that is relevant, but there is no guarantee that Google will grant your appeal. If your account is reinstated, you will not necessarily find out if Google reported any images to NCMEC.

Is Google sharing every photo with the government?

Is it true that Google shares every photo with the government?

No. It is generally not true that Google shares every uploaded photo with the government. Instead, it relies on reports made to the National Center for Missing & Exploited Children (NCMEC) to notify the government of CSAM and other reported offenses.

When does the Fourth Amendment apply in Google cases?

The Fourth Amendment applies when a government agent or a private actor acting on behalf of the government (known as an agent of the state) conducts a search. In Google cases, this normally happens after a CyberTipline report is filed, as this often triggers the government to obtain search warrants and conduct subsequent searches. By agreeing to the Terms of Service for a service provided by Google, you have generally provided Google the ability to conduct enforcement scanning of its services.

In order to investigate a user, federal law enforcement must obtain more specific information. The Stored Communications Act (18 U.S.C. §§ 2701-2713) regulates how law enforcement can use warrants, subpoenas, or court orders to obtain access to stored communication records. If law enforcement receives a CyberTipline report and then attempts to search the user’s electronic devices, the user’s home, or the user’s Google account, this can constitute a search that requires a warrant for the search to be lawful.

Do CyberTipline reports include identifying information, such as IP addresses?

Yes. CyberTipline reports from Google may include a user’s IP address, geographic data, and other identifying information that was collected from the user’s Google account.

What information are providers required to include in CyberTipline reports?

Under Section 2258A, providers are required to report the identifying information of the account holder when such information is within the provider’s possession. This includes the user’s identity, IP address, geocoordinates, and device identifier if available. But, not all reports include these details.

Can government agents use a CyberTipline report to locate a suspect?

Yes. If a CyberTipline report includes identifying information, government agents may use the IP address and the geographic data to identify an internet subscriber, the user’s home, and even the user’s precise location.

Can government agents use a CyberTipline report to get access to the user’s account?

The government generally obtains access to a user’s account information under the Stored Communications Act (18 U.S.C. §§ 2701-2713). To do this, the government typically needs a warrant or an administrative subpoena.

When can government agents use the private-search doctrine to search a user’s account?

Under the private-search doctrine, government agents can review the same content that was identified in a private search. However, the doctrine does not allow them to use a private search to further search for other content without a warrant.

Does Google report searches for illegal content?

Does Google report searches for illegal content?

No. A Google search itself is not a reportable event. Unlike possessing, downloading, or accessing illegal images or videos, a simple Google search does not trigger a CyberTipline report. While searching for illegal material does not have a direct nexus to child exploitation offenses, this doesn’t mean that your search history is exempt from scrutiny.

Can your search history be used as evidence of a crime?

Yes. While conducting a search is not a crime, it can become part of the evidence if prosecutors can link your searches to other criminal activity. For example, if you search for an image and then that image is found on your device, federal prosecutors will use your search history as circumstantial evidence of your possession of illegal material.

Can the government obtain your Google search history?

The government can obtain your Google search history with the appropriate compulsory legal process. The Stored Communications Act (18 U.S.C. §§ 2701-2713) governs how law enforcement may request stored communication records, including search history.

But, even if law enforcement has the ability to obtain search history, they may not be able to obtain it unless they can prove probable cause and obtain a search warrant. This is particularly true when it comes to more invasive searches that may include searches of a user’s home.

Does possessing a Google search history mean that it will be admissible as evidence at trial?

Not necessarily. Even if the government has your Google search history, it must still establish that the data is admissible under the Federal Rules of Evidence. This includes proving that the evidence is relevant and properly authenticated, among other requirements. If the government’s evidence does not meet these requirements, you can file a motion to suppress the search history as evidence.

How can account records prove you conducted a search or uploaded an illegal image?

Account records can connect a search or upload to a specific timestamp, IP address, and account identifier. Law enforcement can then use the IP address to contact your ISP, which can provide a physical address for the internet subscriber. With the person’s physical location in hand, federal agents may seek a search warrant for the person’s home and electronic devices.

Talk to Spodek Law Group

Every case turns on its own facts, and general information is no substitute for advice about yours. Todd Spodek, managing partner of Spodek Law Group, and the firm's attorneys defend federal criminal and white collar matters nationwide. Reach the firm at 212-300-5196.