Dropbox Disabled My Account for CSAM: What They Sent NCMEC.

Dropbox is an electronic communication service provider covered under 18 U.S.C. § 2258A. As the statute explains, it’s the obligation of covered providers to report to the CyberTipline of the National Center for Missing and Exploited Children (NCMEC) as soon as reasonably possible after obtaining actual knowledge of facts or circumstances indicating an apparent violation of the enumerated child sexual exploitation statutes. Dropbox reports its suspected CSAM violations through the CyberTipline. NCMEC, in turn, processes and distributes this information to appropriate law enforcement agencies. As the DOJ explains, “ NCMEC is a primary resource for the DOJ and federal, state, local, international and tribal law enforcement agencies to combat child exploitation crimes including, but not limited to, child pornography, sexual exploitation, and missing and endangered children.” A covered provider report can actually precede the user’s account-disablement notification. The report includes the provider’s CSAM detection results and a summary of the account holder’s identity. This is based on information contained within Dropbox’s logs, such as: - The user’s IP addresses

• The user’s time stamps and activity
• The files flagged as CSAM
• The file-related metadata (file size, creation date, hash value, etc.)
• The user’s account identity
• Information about the device(s) the user utilized
• Other data from the user’s account and logs Importantly, the receipt of a disablement notice does not mean that criminal charges have been filed, even though your evidence has likely entered NCMEC’s law-enforcement pipeline. Rather, it simply means Dropbox is under the assumption that you’ve committed a crime, and that Dropbox is reporting your suspected crime(s) to NCMEC. It will be the federal government that decides whether or not it will file charges against you.

What information is usually inside a Dropbox CyberTipline report

While Dropbox CyberTipline reports are standardized, Dropbox may only send the data it deems pertinent, and no federal privacy statute entitles the account holder to learn what Dropbox sent. This means Dropbox doesn’t necessarily share all the data it has on users with NCMEC. An investigation report from Dropbox typically contains the following data:

1. Suspected CSAM Files

Most CyberTipline reports include the actual files Dropbox has flagged as CSAM. This is because Dropbox generally knows which files it flagged, and it knows when and how they came to be stored on Dropbox. In some cases, Dropbox will only report that its detection mechanisms flagged files for content that appears to be CSAM, and Dropbox will hold the files to be preserved and produced in response to a search warrant or other legal process.

2. Account Identifiers and Subscriber Details

A Dropbox CyberTipline report will also contain information about the Dropbox account holder that is believed to have uploaded or shared the CSAM content. This is done to aid federal agents and other authorities in establishing the identity of the account holder, which will include the email address used for account registration, the user’s name, billing address, payment method information, and other pertinent identifiers that Dropbox has on file.

3. Upload Timestamps and Transmission History

Investigators use timestamp data to determine when CSAM files were uploaded to Dropbox. When investigators have this information, they can then determine whether the alleged crimes took place during the user’s account’s lifetime. Dropbox will also identify when the files were shared with others, and the account identifiers of those others, which can assist law enforcement to identify other users who may have received the files.

4. IP Addresses

Dropbox will report the IP address(es) the user utilized when they uploaded the files, received the files, or otherwise accessed the content of the account holder’s Dropbox account. This helps investigators identify the network and the device(s) the user employed to connect to the internet.

5. Other Pertinent Device Information and File Metadata

Including, but not limited to:

• The browser utilized to access Dropbox
• The operating system used to access Dropbox
• The device(s) used to access Dropbox
• The hash value, file size, and date of creation/modification of any file that Dropbox has flagged as CSAM
• The file names
• The file type
• Dropbox folder location

6. Does Dropbox Send all the Information it Possesses to NCMEC?

Dropbox does not necessarily send all the information it possesses to NCMEC. Dropbox may only send information it believes is relevant, and Dropbox may possess data that it does not disclose in a CyberTipline report, including data that may not be available in a CyberTipline report.

7. Does Dropbox’s CyberTipline Report Definitely Contain GPS Data?

Dropbox may not have geolocation data like GPS coordinates. For example, while Dropbox may possess GPS data for mobile users, it doesn’t typically have GPS data for all uploads.

Although a CyberTipline report from Dropbox may report on a user’s IP addresses, these IP addresses do not inherently pinpoint a user’s location. IP addresses can pinpoint a user’s network, and they can provide an estimate of a user’s location. However, GPS data is required to pinpoint a user’s exact location.

8. Does Dropbox’s CyberTipline Report Include Information about Every Device Linked to the Account?

A Dropbox CyberTipline report does not necessarily contain information about every device linked to the account. Dropbox generally reports the device(s) that were linked to the CSAM detection. This may or may not include all devices that accessed the account.

9. Does Dropbox Preserve the Entire Account Pursuant to 18 U.S.C. § 2258A?

Section 2258A does not require a Dropbox account holder’s entire account to be preserved upon the filing of a CyberTipline report. Rather, it requires that Dropbox only preserve data “related to the report(s) made to the National Center for Missing and Exploited Children.” Accordingly, if Dropbox believes that certain parts of the account’s data are unrelated to the report, then Dropbox will not preserve these portions of the data.

Does Dropbox scan files for CSAM?

Dropbox, like most online services that allow users to store files, “may use automated tools to help detect child sexual abuse material (CSAM) among the files that users store.” (Dropbox CSAM policy). These automated tools are not foolproof, though; and Dropbox’s CSAM policy does not claim its detection is error-free, and it tells users who believe Dropbox made a mistake in taking action against their account that they can ask Dropbox to review that determination.

Is an internal automated flag a confirmed CyberTipline report?

No. An internal automated flag is not the same as a confirmed CyberTipline report. While Dropbox may automate the reporting process to NCMEC when its detection mechanisms flag a user’s file for abuse material, an automated flag is not inherently an admission that the file constitutes CSAM.

What types of tools are used by Dropbox to detect CSAM?

Dropbox uses the following tools (and possibly other tools as well) to detect CSAM:

• Cryptographic hashes: This is a technique used by the online industry to identify a copy of a file that it has on file. A cryptographic hash can identify the same file because, although two files may look the same, they can have different bits, meaning that the files contain the same visual information but are not exact copies of the same data. Therefore, a cryptographic hash match is only used to identify exact matches of a known file.
• Perceptual hashes: This technique is used to identify a visually similar image. Perceptual hashes identify that an image is visually identical to another image, without having to be an exact bitwise copy.
• Classifiers: These are tools used by the online industry to detect an image based on its content and not its similarity to any known image. Classifiers flag images as containing suspected CSAM, and then a provider confirms the flagged image. A human reviewer may confirm a suspected image, or a provider may use another automated tool to confirm the image. Once the file is confirmed as CSAM, the provider will store the hash of the image and enter the file into its database.

Can these automated tools make mistakes?

Yes. Dropbox’s automated CSAM detection tools can and will make mistakes. For example, the tools can incorrectly identify photos of medical procedures, photos of a user’s children at the beach, or even other non-CSAM imagery as CSAM. For example, with medical images, Dropbox would not have a cryptographic hash for a known CSAM image that would match medical imaging. Instead, Dropbox would be using either a classifier that misidentified the image as containing CSAM, or perceptual hash matching with an error.

Does federal law require Dropbox to scan everything

Do Dropbox’s reporting duties depend upon criminal intent?

No, Dropbox’s reporting duties under Section 2258A do not depend upon criminal intent. Section 2258A(a) states that “each electronic communication service provider shall in writing report to the National Center for Missing and Exploited Children promptly of any information that is or may be related to apparent violations” of the child pornography statutes. Dropbox’s reporting duties under Section 2258A do not depend upon criminal intent; rather, Dropbox’s reporting duties only depend upon Dropbox’s knowledge of “apparent violations” of the child pornography statutes.

Does federal law require Dropbox to proactively scan and monitor all of its users’ content?

No. Section 2258A does not require a covered provider, such as Dropbox, to proactively scan and monitor all of its users’ content, and a covered provider does not have to report if it doesn’t have actual knowledge that there was a violation of federal child pornography law.

Do the reporting fields in Section 2258A(b) apply to all Dropbox accounts?

The reporting fields in Section 2258A(b) are not mandatory for any Dropbox account: the statute provides that a report may, at the sole discretion of the provider, include that information, and only to the extent the information is within the custody or control of the provider.

Does Dropbox have a duty to report ASAP after it gets actual knowledge of an apparent CSAM violation?

Yes. Section 2258A(a) states that a covered provider “shall... report... as soon as reasonably possible after actual knowledge of the apparent violation.”

Does Dropbox have a duty to notify a user of a suspected CSAM violation before it reports?

No, Section 2258A does not require a covered provider to notify a user before making a CyberTipline report. Providers can make a CyberTipline report, and then notify the user.

What penalties does a covered provider face for knowingly failing to report?

A covered provider that knowingly and willfully fails to report a suspected CSAM violation is subject to a fine under Section 2258A(e) of up to $600,000 for an initial failure, or up to $850,000 if the provider has at least 100,000,000 monthly active users, rising to $850,000 and $1,000,000 respectively for any second or subsequent failure.

Can Dropbox be sued for making a good-faith reporting error?

No. 18 U.S.C. § 2258B(a) provides civil immunity to providers in CyberTipline report cases involving “good faith reporting of information that is required to be reported pursuant to section 2258A.”

What statutes are covered by Section 2258A?

Section 2258A covers apparent violations of 18 U.S.C. § 2252, 18 U.S.C. § 2252A, 18 U.S.C. § 2254, and 18 U.S.C. § 2255.

How long before NCMEC sends a Dropbox report to police

What is NCMEC’s Role in a Dropbox CSAM Case?

NCMEC, or the National Center for Missing and Exploited Children, acts as a clearinghouse between internet service providers (ISPs) and law enforcement agencies. NCMEC is not a law enforcement or prosecuting agency. Once NCMEC receives a CyberTipline report from Dropbox, NCMEC reviews the report and routes the information to any appropriate investigative agency.

Does NCMEC forward every CyberTipline report it receives?

NCMEC received 21.3 million CyberTipline reports in 2025 and 20.5 million in 2024. It does not refer every report to a specific investigative agency; some reports are made available to law enforcement as informational reports. Instead, NCMEC forwards reports based on priority, jurisdiction, and other factors.

For each report received, NCMEC will review the reported CSAM, evaluate how to handle the case, and assess where to forward the information. In other words, NCMEC’s review and triage begin before the report is referred to a specific law-enforcement agency.

How does NCMEC decide which investigative agency to forward a CyberTipline report to?

NCMEC forwards CyberTipline reports based on priority, jurisdiction, and available location data. If a report contains data that suggests that a user in Florida is involved in a child pornography case, then NCMEC will typically route the information to the Florida Department of Law Enforcement (FDLE), along with the FBI and Homeland Security Investigations (HSI) if appropriate. In other words, NCMEC determines how to forward each CyberTipline report based on the details of the report itself.

Where will NCMEC forward reports from Dropbox that originate in the United States?

When NCMEC identifies a user within the United States, it routinely forwards reports from Dropbox to the Federal Bureau of Investigation (FBI), Homeland Security Investigations (HSI), and the Internet Crimes Against Children (ICAC) task force.

How long does it take for NCMEC to forward a CyberTipline report to law enforcement?

NCMEC’s triage can begin within hours or days after Dropbox files a CyberTipline report. However, receiving a CyberTipline report does not necessarily mean an investigation has already been opened by the FBI, or another federal or state law enforcement agency. Depending on how well a CyberTipline report is detailed, and how far behind the FBI, or another federal or state law enforcement agency, is on its caseload, the time that it takes to receive a report from NCMEC can vary. Todd Spodek and the attorneys at Spodek Law Group handle federal cases of this kind from New York, Brooklyn, Queens and Los Angeles.

What if someone else used my Dropbox folder?

Can other information complicate my Dropbox CSAM case?

Yes, questions regarding the account holder’s knowledge of suspected CSAM can be complicated by shared folders and automatic uploads. Shared folders present a unique challenge because other users can upload and edit files, and automatic uploads via Dropbox sync can make it difficult to pin-point whether Dropbox account holders were actively involved in those uploads.

What are the different ways a user can upload content to their Dropbox account?

Dropbox offers multiple ways users can upload content, including:

• Browser Upload: Uploads directly from a browser window to Dropbox’s servers.
• Dropbox Sync: Uploads from files saved in Dropbox’s sync folder on a linked computer, smartphone, or other device.

What about shared folders?

Dropbox shared folders allow Dropbox users to invite other Dropbox users to view files or collaborate within folders. In shared folders, all users have the ability to upload, edit, and move files within the folder, provided their user roles allow this.

Can Dropbox tell where an upload came from versus where a login came from?

Yes, Dropbox stores different IP addresses for each action. Dropbox’s upload IP address, login IP address, and any other device IP address it has on file can all answer different attribution questions.

Therefore, just because a user logs into a Dropbox account from one IP address, it does not necessarily mean they uploaded a file from that IP address.

Does Dropbox keep separate logs for each type of user activity?

Yes. While it stores all pertinent information in the same database, Dropbox separates information regarding:

• Uploads
• Logins
• Sync clients
• Web sessions

Can Dropbox identify each linked device connected to the Dropbox account?

Yes, via Dropbox sync-client logs, Dropbox can identify linked devices connected to the user’s Dropbox account, and Dropbox can tell which devices that user’s computer has been used to connect to Dropbox’s servers. Dropbox can also identify which specific devices were used to upload files to Dropbox.

Does Dropbox provide audit logs for Dropbox Business accounts?

Yes. While Dropbox provides audit logs for Dropbox Business accounts, it is not clear whether Dropbox provides these logs to personal users. These logs provide a chronological record of user actions, and they are divided into the following two categories:

• File Activity: Includes file creation, edits, moving, renaming, and deletion.
• Sharing Activity: Includes inviting others to folders.

Is attribution for Dropbox Business accounts different than for personal Dropbox accounts?

Yes, because attribution for Dropbox Business accounts differ materially from attribution for personal Dropbox accounts. With personal accounts, there is one user who controls the account. With Dropbox Business, multiple users can have access, and attribution depends on whether the suspected CSAM violation involved the files of the user or the business owner.

What legal process gets Dropbox or ISP records?

How do investigators use an IP address to identify a suspect?

With a known IP address, investigators can identify the internet subscriber that Dropbox utilized. For example, if Dropbox reports that you uploaded a file from a specific IP address, FBI agents can subpoena that IP address’s ISP to identify you.

What legal process allows investigators to subpoena a user’s records?

ISP records obtained via subpoena are covered under the Electronic Communications Privacy Act (ECPA) of 1986. The ECPA is a federal statute that governs the disclosure of a user’s records when a user’s internet service provider (ISP) or stored content service provider (like Dropbox) is not making a voluntary disclosure.

Can Dropbox make voluntary disclosures to law enforcement agents?

Generally no. 18 U.S.C. § 2702 prohibits companies from voluntarily disclosing their customers’ stored content or communications to government officials. An exception is 18 U.S.C. § 2702(b)(6), which allows companies to voluntarily disclose customer records to NCMEC pursuant to the requirements of 18 U.S.C. § 2258A.

What are the requirements for compelled disclosure?

When a covered provider cannot make a voluntary disclosure, investigators can compel disclosure by subpoena, search warrant, court order, or other legal process, as governed by 18 U.S.C. § 2703.

• Basic subscriber records can be obtained by subpoena pursuant to 18 U.S.C. § 2703(c)(2). This is the case for most cases that involve IP addresses.
• Records that are more detailed can be obtained by a court order, which requires showing that a specific record is “relevant to an ongoing criminal investigation.”
• Finally, a search warrant is required for stored content. This is the case if Dropbox is asked to provide a copy of a user’s folder that Dropbox has stored.

Can a subpoena compel Dropbox to provide a copy of the files from a user’s account?

No, generally not. Subpoenas are generally used to compel the production of “basic subscriber information” under 18 U.S.C. § 2703(c)(2). However, to obtain “stored contents” as defined in 18 U.S.C. § 2510(4)(a), federal law enforcement agencies will need a search warrant. The statutory warrant requirement for stored contents is found in 18 U.S.C. § 2703.

What crimes and deadlines can follow a Dropbox CyberTip?

What are the penalties for the unlawful distribution of CSAM via Dropbox?

Federal law prohibits the unlawful distribution and receipt of CSAM via computers, among other things. U.S.C. § 2252A(a)(2)(B) applies to:

• A “person whoentionally receives an image of a minor engaged in sexually explicit conduct, knowing that the image of the minor is CSAM,”
• A “person who intentionally distrib u tes an image of a minor engaged in sexually explicit conduct, knowing that the image of the minor is CSAM.”

Under 18 U.S.C. § 2252A(b)(1), a conviction for the above offenses carries a five-to-twenty-year federal prison term.

There is no limitation period for prosecution for the unlawful distribution of child pornography by a computer. U.S.C. § 3299(a) states: “No limitation period shall run against any person charged with an offense under section 2252A of this title,... if the offense is committed, partly or wholly, by means of a computer, or by means of the transmission of any matter, writing, images, or images of CSAM... that utilizes the internet.”

What if someone uploaded CSAM to Dropbox without your knowledge?

Possession of CSAM is another federal crime, as discussed in detail here. Federal CSAM possession falls under 18 U.S.C. § 2252A(a)(5)(B). This is a separate crime from receipt or distribution. While CSAM distribution carries up to twenty years of federal prison time under 18 U.S.C. § 2252A(b)(1), federal CSAM possession generally carries up to ten years. Unlike distribution, however, possession does have a limitation period. When was the same file used to detect abuse material found, and is there a record of the user distributing the file via the Dropbox account?

Do CSAM convictions trigger sex-offender registration?

Yes, in most cases, a conviction for an offense under Section 2252A will trigger sex-offender registration obligations.

However, this varies from state to state and can vary from crime to crime. There is a significant difference between possession, receipt, distribution, and production under federal law. Each of these offenses have their own sets of elements that are required to be proven beyond a reasonable doubt. Additionally, unlike distribution and other offenses, possession has no ordinary mandatory minimum under 18 U.S.C. § 2252A(a)(5)(B).

What should I do before appealing or deleting anything?

Can my appeal statements be used in a criminal investigation?

Yes, the statements and information that you provide when appealing to Dropbox can later become evidence in a criminal investigation. The information that Dropbox collects during the appeal process will also be kept on file. We strongly recommend that you consult with legal counsel before appealing a disablement.

Can I delete files from my account?

If Dropbox has disabled your account, then you should assume that Dropbox is in possession of evidence that it will forward to law enforcement agents. Deleting or otherwise disposing of the files in your account can create exposure to additional criminal charges. For example, 18 U.S.C. § 1519 carries a maximum sentence of twenty years of federal imprisonment for evidence destruction in a matter pending with or in relation to a federal law enforcement agency.

What are my options for appealing my account disablement?

Your appeal options and timelines are established in Dropbox’s own policies, and not through 18 U.S.C. § 2258A or other federal statutes. Dropbox’s policy generally provides users one week to appeal account disablements, and the policy requires that users complete an appeal form.

What does it mean to preserve a Dropbox account?

If you have been accused of CSAM-related criminal offenses, there are several important steps that you can and should take to preserve evidence about your account. These steps include:

• Discontinue any activity within your account.
• Preserve the original files that are in the account.
• Discontinue updating Dropbox on your linked devices.
• Keep any linked computers, tablets, smartphones, and wearable devices.
• Preserve the disablement notice that you received from Dropbox.

Why should I consider a counsel-managed appeal?

While doing nothing is often the best approach for Dropbox users accused of CSAM crimes, there are some circumstances in which a counsel-managed appeal may be the better approach. The decision to make such an appeal may be the right choice if your goal is either (i) to preserve access to your account or (ii) to get more information about the suspected offense.

Contact a Federal Criminal Defense Attorney

Nothing here is legal advice, and the details of your case matter. Todd Spodek and Spodek Law Group take federal criminal and white collar cases nationwide, from offices in New York, Brooklyn, Queens and Los Angeles. You can reach the firm at 212-300-5196.