How Long Does NCMEC Take to Forward a Report to the FBI??

Last Updated on: 4th August 2026, 01:33 am

While federal law imposes reporting duties on providers under 18 U.S.C. § 2258A, it does not establish a fixed deadline for NCMEC to forward CyberTips to the FBI. The statute outlines what providers must do when they identify and report a “reportable offense,” but it does not establish a fixed number of minutes or hours for NCMEC’s referral; instead, it requires NCMEC to make each report available at the conclusion of its review.

No Average or Median NCMEC-to-FBI Forwarding Time Published

NCMEC does not publish an average or median time for forwarding CyberTips to law enforcement agencies. This lack of public data makes it impossible to determine how long it typically takes for NCMEC to notify the FBI of a reportable offense.

No Public Service Standard for Forwarding CyberTips to the FBI

NCMEC does not commit to public service standards regarding its processing and forwarding timelines. Without these standards, there is no objective benchmark for measuring NCMEC’s performance or timeliness in its referral process.

The CyberTip Process: Key Stages

The entire CyberTip process includes several stages, each of which contributes to the overall time from report to law enforcement action:

• Submission of a CyberTip to NCMEC by a provider.
• Review of the CyberTip by an NCMEC analyst.
• Routing of the CyberTip to the appropriate law enforcement agency.
• Access to the CyberTip by the receiving law enforcement agency.
• Review of the CyberTip by the receiving law enforcement agency.
• Initiation of a formal investigation based on the CyberTip.

The REPORT Act and Data Preservation

Under the REPORT Act, providers must preserve the electronic data related to a reportable offense for one year. Before the REPORT Act’s enactment, providers were required to preserve this data for 90 days. The current law extends this preservation period, ensuring that law enforcement agencies have sufficient time to access and use the reported data as necessary.

Why is there no reliable NCMEC to FBI timeline?

Does “Urgent” mean an “immediate” referral to the FBI?

While NCMEC refers to urgent reports, it has made no promise that an urgent CyberTip will reach the FBI within minutes or hours. Even if a report is made available through a shared system, this does not necessarily mean it has been formally referred to the FBI.

Are all “waiting” periods caused by law enforcement investigative delay?

NCMEC’s time to forward a CyberTip to law enforcement is distinct from the time it takes for that law enforcement agency to receive and begin investigating. While investigative delay is a factor, NCMEC’s referral time is a separate component.

Do NCMEC’s annual reports provide a reliable measure of CyberTip forwarding times?

No. NCMEC’s annual reports do not provide average or median forwarding times, but the 2025 report does state how many reports NCMEC referred and how many it designated as informational. The report focuses on general CyberTip statistics rather than detailed processing data.

Do NCMEC’s annual CyberTip totals reveal anything about the NCMEC referral backlog?

The annual CyberTip totals do not offer a reliable way to gauge a referral backlog. While they show the number of reports received, they do not specify how many of these reports were forwarded to law enforcement agencies.

Does NCMEC’s annual CyberTip count provide any way to predict how long it takes for a specific report to be routed to the FBI?

No. The annual CyberTip count is a broad statistic and cannot be used to predict the routing time for any individual report. Factors affecting a specific report’s processing are not captured by these total counts.

Are NCMEC’s annual reports and statistics in the CyberTipline FAQ useful for determining the timeline in an NCMEC referral?

No. The information provided in NCMEC’s annual reports and FAQ lacks the specificity needed to determine the timeline for an NCMEC referral. Specifically, the data on CyberTipline reports received does not relate directly to the referral process. For example:

• In 2024, NCMEC reportedly received about 20.5 million reports via the CyberTipline.
• In 2025, the CyberTipline received about 21.2 million reports from Electronic Service Providers (ESPs), with these reports containing about 61.8 million files.

What happens after a report reaches NCMEC?

Does NCMEC Review CyberTips?

NCMEC reviews CyberTips to triage them and then refer actionable reports to appropriate law enforcement agencies. Law enforcement agencies then decide whether to open criminal investigations.

How Does NCMEC Prioritize CyberTips?

NCMEC triages incoming CyberTips based on several criteria:

• Urgency: Reports indicating a direct threat to child safety are prioritized.
• Location Clues: Information pointing to a specific jurisdiction speeds up routing.
• Information Quality: Reports containing clear evidence or actionable data are fast-tracked.

What Happens if an Urgent CyberTip is Received?

Urgent CyberTips, including those involving imminent risk to a child, are prioritized. These reports are handled immediately to facilitate rapid intervention by law enforcement.

When Is a CyberTip Considered Actionable?

A CyberTip is deemed actionable when it contains enough specific and relevant information to support a potential law enforcement action. This can include information such as user identification data or specific child victim imagery.

What Happens if a CyberTip is Not Considered Actionable?

If a CyberTip is not considered actionable, it is categorized as an informational report. This may happen if the report is vague, lacks pertinent details, or is part of a series of identical reports about the same content.

What Are Informational Reports and Why Are They Sent to NCMEC?

Informational reports provide additional data that may be useful but does not immediately warrant an investigation. For example, this could include:

• Repetitive submissions of the same content.
• Reports of viral CSAM imagery that has already been reported many times.
• Reports with minimal actionable information.

Do NCMEC Analysts Describe the Suspected CSAM in a CyberTip?

Yes. NCMEC analysts label and describe the suspected CSAM to help law enforcement agencies prioritize the reports they receive. The analysts may note:

• Content Type: The specific nature of the CSAM.
• Estimated Child Age: An estimation of the age of the child involved.

Are Actionable Referrals and Informational Reports Sent to Law Enforcement Agencies on the Same Path?

No. Actionable referrals and informational reports are routed to law enforcement agencies through different processes. Actionable referrals are sent with an expectation of potential immediate action, whereas informational reports are often archived or shared in a manner that may be reviewed later.

What Are the Different Ways that Actionable Referrals Can Be Routed?

Actionable referrals can be routed in several ways, depending on the information available:

• Direct Referral: If the referral points to a specific jurisdiction, it can be sent directly to the relevant local or state law enforcement agency.
• FBI Referral: If the information is unclear or involves federal-level concerns, it may be sent to the FBI.
• NCMEC Database: Some referrals may be made available for law enforcement agencies to search in NCMEC’s database.

Does NCMEC send every U.S. report to the FBI?

Are All CyberTipline Reports Made Available to U.S. Federal Law Enforcement?

Yes. All CyberTipline reports are made available to U.S. federal law enforcement agents. This ensures that all reports are accessible to the agencies that have the most comprehensive jurisdiction over internet-based crimes against children.

Does the FBI Have Access to NCMEC’s Case Management Tool?

Yes. The FBI has access to NCMEC’s Case Management Tool. This tool allows FBI agents to view CyberTipline reports, track progress in cases, and manage referrals efficiently.

Does Homeland Security Investigations Have Access to NCMEC’s Case Management Tool?

Yes. Homeland Security Investigations (HSI) also has access to NCMEC’s Case Management Tool. HSI works closely with NCMEC to address internet-related crimes against children, especially those that cross state and international borders.

Do All Internet Crimes Against Children (ICAC) Task Forces Access NCMEC’s Case Management Tool?

Yes. All ICAC task forces have access to NCMEC’s Case Management Tool. The ICAC program is a national network of agencies dedicated to investigating child sexual abuse material (CSAM) and protecting children.

How Does NCMEC’s Case Management Tool Allow Agencies to Triage and Prioritize CyberTipline Reports?

The Case Management Tool helps law enforcement agencies triage and prioritize CyberTipline reports. The tool integrates various forms of information, such as urgency markers, geolocation data, and user profiles, allowing agencies to identify and prioritize high-risk cases.

How Does the Case Management Tool Help Police Redirect Reports to the Most Suitable Agency?

The Case Management Tool facilitates inter-agency communication and coordination. If a local or state agency receives a report that is better suited for another agency (e.g., federal law enforcement), they can forward the report and related information within the tool.

How Does NCMEC Use the Case Management Tool to Flag High-Priority Reports for Police?

NCMEC uses the Case Management Tool to flag high-priority reports to get the attention of law enforcement agents. NCMEC analyst and automated tools can quickly identify reports that present an imminent danger to a child.

When Does NCMEC Route All CyberTipline Reports to Federal Law Enforcement Agents?

NCMEC routes reports to federal law enforcement agents when it is either:

• Impossible or too difficult to identify a specific U.S. state.
• The U.S. state is known, but the specific area of jurisdiction cannot be identified.
• The suspected crime does not seem to fall into the jurisdiction of a local or state law enforcement agency.
• The report appears to have already been processed by one or more local or state law enforcement agencies.

If you are facing this situation, Spodek Law Group handles federal criminal defense matters nationwide, from offices in New York and Los Angeles.

What makes one CyberTip move faster than another?

While urgent CyberTips are prioritized, nonurgent CyberTips will fall into law enforcement’s queues. These will then have to wait for law enforcement agencies to finish their current investigations. Thus, nonurgent CyberTips will likely take longer to move into the actual investigative process.

Another factor is whether NCMEC analysts can identify where the report comes from. They will try to identify the possible incident location before routing the report. However, identifying a location can be challenging, especially if the report is provided by an online user. If the identity or location of the suspect is not included in the report, then analysts will try to look for clues in the suspect’s imagery or other online platforms.

The uncertainty regarding the location can lead to a jurisdictional issue, too. If the jurisdiction isn’t certain, NCMEC cannot immediately refer a CyberTip to a particular law enforcement agency. In these cases, NCMEC can route the CyberTip to federal law enforcement agencies such as the FBI. These agencies then route reports based on the appropriate state or country.

Electronic service providers send all the information they can, but sometimes the amount of information they can provide varies. For example, a report could include images, videos, account data, and other relevant files. Some reports include detailed information such as user details, child imagery, and the suspected location of the offender. Others may only include account data and a few images.

The amount and type of information provided by ESPs can also contribute to the time it takes for reports to be routed and reviewed. These reports are referred to the NCMEC analysts, who classify each based on the information available in the report. More than 10% of CyberTipline reports submitted by the technology industry in 2025 contained inadequate information for NCMEC to determine where the offense occurred.

For more than 53,000 CyberTips, NCMEC analysts identified that they were urgent or contained immediate-danger cases. These refer to cases that contain obvious threats to the children involved or imminent physical danger. NCMEC identified and escalated these CyberTips for law enforcement.

Ultimately, the time that it takes for a CyberTip to be routed to federal law enforcement depends on various factors, such as:

• Jurisdiction
• Type of offense
• Risk to the child
• Available identifiers
• Information quality

What can trigger a CyberTipline report?

Who is required to file a report with NCMEC?

Under 18 U.S.C. 2258A, companies in the United States that provide online services (including electronic service providers) are required to report suspected online child exploitation that they encounter on their platforms. The statute’s mandatory reporting duty is triggered by actual knowledge of specified facts or circumstances, not merely a reasonable belief that child exploitation has occurred.

What did the REPORT Act mandate?

The REPORT Act mandates that companies also report suspected online enticement of children and suspected child sex trafficking. This expansion ensures that various forms of online and offline exploitation involving children are documented and referred to law enforcement for action.

Who submits reports to the NCMEC CyberTipline?

NCMEC’s CyberTipline accepts reports from both members of the public and electronic service providers. This includes individuals who witness child exploitation and companies that identify it during regular platform monitoring or enforcement of their terms of service.

Which group submits reports to the NCMEC CyberTipline more often?

The vast majority of CyberTipline reports are submitted by electronic service providers (ESPs). Because they have advanced tools for content moderation and a legal obligation to report suspected exploitation, their contribution to NCMEC’s data is substantial.

Can suspected CSAM trigger a CyberTipline report?

Yes. Suspected child sexual abuse material (CSAM) is one of the primary triggers for a CyberTipline report. This includes any imagery or video depicting CSAM, as well as reports concerning the creation, possession, or distribution of these materials.

Can online enticement of children trigger a CyberTipline report?

Yes. Online enticement, often referred to as “grooming,” can lead to a CyberTipline report. This includes efforts to establish relationships with children for sexual purposes, solicitation of sexually explicit content from minors, or coordinating meetings between adults and children.

Can suspected child sex trafficking trigger a CyberTipline report?

Yes. Suspected cases of child sex trafficking, including the coercion, recruitment, or exploitation of minors for sexual services, can be reported via the CyberTipline. These reports are critical for initiating investigations that can rescue victims and prosecute perpetrators.

Can suspected child sex tourism trigger a CyberTipline report?

Yes. Suspected instances of child sex tourism can trigger a CyberTipline report. This includes travel by adults to exploit children, either within the U.S. or internationally, as well as facilitating these journeys.

Does a CyberTip mean an FBI case or conviction?

Does a CyberTipline report equal an indictment or conviction?

A CyberTipline report, though important, is merely the beginning of an investigation. It is considered a lead, not proof of guilt. It does not constitute an indictment, formal charge, or conviction. The reported behavior must still be investigated and proved beyond a reasonable doubt in court.

Does NCMEC publish its success percentage regarding criminal convictions?

NCMEC does not publish a formal success percentage for criminal convictions. Instead, it releases data on how many CyberTips it receives and the number of these reports it refers to law enforcement. This data shows that NCMEC facilitates thousands of investigations, but it does not say how many of these lead to convictions.

Can we find the FBI’s conviction rate for CSAM cases in NCMEC’s annual report?

No. NCMEC’s annual reports focus on CyberTip statistics and data provided by ESPs, rather than reporting prosecution or conviction statistics. These metrics would be managed by law enforcement agencies like the FBI or DOJ rather than NCMEC.

What triggers an FBI case or charges based on a CyberTipline report?

A CyberTipline report triggers an FBI case if sufficient evidence points to a crime that merits a federal-level investigation. The investigation would normally include subpoenas, warrants, and a forensic review of any electronic evidence. Only when this evidence is strong enough to show a crime has likely occurred will charges be filed.

Does a CyberTipline report alone provide probable cause for a search warrant?

No. A CyberTipline report provides a lead that could support the investigation needed for a search warrant. However, a report alone does not usually provide enough probable cause. Law enforcement agencies typically need further evidence, such as corroborating data or statements, to meet the probable cause standard.

How can an FBI agent prove the guilt of a person based on a CyberTipline report?

Establishing guilt involves more than having a CyberTipline report. Investigators must connect the suspected criminal activity (e.g., possessing or distributing CSAM) to a specific person. This requires evidence linking a device, IP address, or account to an individual through means like subpoenas, warrants, and forensic analysis.

Can a CyberTipline report and records from a provider become evidence in a criminal case?

Yes. A CyberTipline report and provider records attached to it can serve as evidence. These documents help document the initial investigation, identify suspects, and present evidence in court. However, they must be properly handled by federal investigators and validated during the legal proceedings.

Does a CyberTipline report alone establish the guilt of the suspected offender?

No. A CyberTipline report, however specific, does not establish a person’s guilt. It is considered a starting point for the investigation and must be corroborated by evidence and proven in a criminal trial.

Contact a Federal Criminal Defense Attorney

Nothing here is legal advice, and the details of your case matter. Todd Spodek and Spodek Law Group take federal criminal and white collar cases nationwide, from offices in New York, Brooklyn, Queens and Los Angeles. You can reach the firm at 212-300-5196.