What Is a CyberTipline Report and What's Inside Yours.

NCMEC is a private, non-governmental organization. It’s not a law enforcement agency, it’s not the Attorney General’s Office, it’s not the FBI, and it has no authority to make laws, impose penalties, or find that content is legally or factually “offensive.” NCMEC’s role in the CyberTipline includes serving as a clearinghouse and performing statutorily assigned law-enforcement-support functions.

Companies that work with NCMEC provide information based on suspicion that their users have posted prohibited content. They report that information to NCMEC, and then NCMEC passes that information along to the appropriate law enforcement agency. However, as the NCMEC website clarifies:

“The National Center for Missing and Exploited Children (NCMEC) may receive reports of suspected child pornography (including child sexual abuse material, child exploitation material, etc. ) from Internet Service Providers (ISPs).... However, the CyberTipline is not a fact-finding body. It does not conduct legal reviews or make determinations..... While CyberTipline reports may be used in support of investigations, they do not constitute evidence in a court of law.”

This is key. If a law enforcement agency is using a CyberTipline report to build a case against you, the report is, by definition, only hearsay, it’s not evidence that you did anything illegal, and it does not, in and of itself, establish probable cause.

When and Why Was the CyberTipline Created?

NCMEC launched the CyberTipline in 1998 and, as a result of the law’s enactment, providers who meet the statutory requirements are now required to participate.

What is 18 U.S.C. Section 2258A?

This is the U.S. statute that requires providers to refer suspected CSAM to NCMEC. The statute mandates a referral that has:

• “actual knowledge” that the user “has, or is in possession of child pornography” and
• any other information “that is in [the provider’s] possession as of the date of the referral and is as complete as possible.”

Section 2258A(a)(1) requires that a provider, “as soon as reasonably possible after obtaining actual knowledge of any facts or circumstances described in paragraph (2)(A),” submit a report to the National Center for Missing and Exploited Children through the CyberTipline. The statute sets no fixed outside deadline for that report.

Crucially, though, Section 2258A(f) also reads:

• “Nothing in this section shall be construed to require a provider to, (1) monitor any user, subscriber, or customer of that provider; (2) monitor the content of any communication of any person described in paragraph (1); or (3) affirmatively search, screen, or scan for facts or circumstances described in sections (a) and (b).”

What Information is in a CyberTipline Report?

CyberTipline reports can contain a wide variety of information. Many reports include basic identifiers such as:

• Report ID, Account ID, Provider Name, Report Category, Submission Date/Time,
• Recipient Email, Sender Email, Recipient Username, Recipient Account ID, Recipient IP,
• Recipient Phone Number, Recipient Device ID, Recipient Country, Recipient City, Recipient ZIP Code,
• Recipient URL, Recipient Physical Address,
• File Name, Recipient Physical Address,
• Subject Text, Link Text,
• Sent Date/Time, Received Date/Time,

What Information Can be in a CyberTipline Report?

Depending on the type of information and the specific platform involved, a CyberTipline report can also include chat excerpts, uploaded files, file names, and more detailed narratives from the provider explaining why they issued the referral. It can also include, however, basic notes, priority levels, and destination agencies from NCMEC as well.

What is Typically in a CyberTipline Report?

While every report will be unique, reports typically include IP addresses and timestamps, hash values for any image/video content involved, and subscriber information (i.e., names, email addresses, payment information, etc.).

What Information Is Required?

When providers submit reports to NCMEC, they may include the five categories of information listed in Section 2258A(b). However, these are only required to the extent that this information is “reasonably available.” As a result, a significant portion of reports sent to NCMEC do not contain usable jurisdiction information. According to the CyberTipline’s 2025 Industry Report:

“Of the total reports received, approximately 13.2% contained either no jurisdiction information, an invalid jurisdiction, or was other unidentifiable data for which no specific U.S. law enforcement agency could be assigned.”

The 2025 Industry Report also identifies several companies that failed to provide sufficient jurisdiction information including:

• Grindr, LLC
• Zoom Video Communications, Inc.
• Box, Inc.
• X.AI Corp.
• Meta Platforms, Inc.
• Nintendo of America Inc.
• Microsoft Corp.
• Cisco Systems Inc.
• Yahoo! Inc.
• WhatsApp Inc.
• Google LLC

The report explains that the failure to provide sufficient information resulted in “the reports remaining at NCMEC for additional review and follow-up efforts to determine law enforcement’s authority to investigate, often with substantial delays.”

Who writes each part of a CyberTipline report?

We divide the review of CyberTipline report packages into eight key categories of information and analysis. This approach allows us to accurately identify who said what, where and how the information was obtained, the data provider’s role in the investigation, and the potential implications of all information contained within the report package.

1. Provider Submissions

CyberTipline report packages contain a range of information provided by the reporting company. This information is typically transmitted electronically to NCMEC and then shared with the appropriate federal or state law enforcement agency. This information is referred to as “metadata” and often includes:

• Account identifier and/or email address
• Recipient phone number, device ID, country, city, ZIP, physical address
• Recipient URL
• Sent date/time and received date/time

The amount and type of information a provider includes in its submission vary. Many CyberTipline report packages, though, include basic account information and the timestamps of any relevant activity.

2. NCMEC Annotations

Along with the provider’s original submission, a CyberTipline report also contains various notes and other information compiled by NCMEC’s CyberTipline analysts. These annotations are not part of the provider’s original submission and, as our attorneys have determined, they are not evidence. An analyst’s determination about a user’s apparent age, location, or activities may be wrong, but it is often sufficient to trigger law enforcement action.

3. Hashing & Categorization

According to NCMEC, its analysts review an attached file at least three times before generating a hash for that file. When identifying appropriate tags for a file, analysts assess information such as the child’s age range, and content related to bestiality, gore, rape, and sexual violence. The analyst’s determination of the type and quantity of child pornography (including CSAM) found may be wrong, though these determinations will typically go unmodified, and can become crucial to arguing probable cause.

4. Attached Files & Hash Matches

Although attached files and files identified via hash matches may be discussed separately from the report package, they may also be included in the CyberTipline report itself. Like metadata and annotations, though, attached files and hash matches can be used to support the claim that a person is in possession or control of CSAM.

5. Law Enforcement Access

A CyberTipline report package may also contain information about how and when law enforcement has accessed it. These records are separate from the CyberTipline report, attachments, and hash matches. While downloads may not provide direct evidence of guilt or innocent intent, they may provide useful information for defense purposes.

6. Subpoenas & Search Warrants

In many cases, CyberTipline report packages will contain references to subsequent search warrants and subpoenas. While these subpoenas and warrants are not part of the CyberTipline report, they often contain returns and other records that may be very useful for defending against an investigation.

7. Probable Cause

Ultimately, prosecutors will seek to convince a judge that the information contained within a CyberTipline report, including metadata, attachments, annotations, hash matches, and other data, constitutes probable cause. This, in turn, can lead to a warrant, a police raid, a criminal charge, and a sentencing guidelines calculation.

8. Registered Providers

To date, there are more than 2,000 companies registered to file reports through the CyberTipline. Many other providers are expected to file CyberTipline reports as well, and it is critical to know which providers are required to file reports and how they identify users and content.

Are CyberTipline reports generated by an algorithm or by a person?

Where Does a CyberTipline Report Originate?

CyberTipline reports can originate from tips from the public, victims, or users. They can also originate from providers reporting content based on a request from NCMEC for information. Additionally, they can originate from providers who detect content using internal systems. In each of these cases, the reporter must provide their “actual knowledge” of the content’s existence, and then the provider or individual reporter will provide the evidence of this knowledge.

How are Reports from Providers Generated?

As identified above, reports from providers can be generated in three ways: through a hash-match; through a human (moderator or analyst) review; or through a moderation system. As explicitly stated in the CyberTipline’s 2025 Industry Report:

“The CyberTipline does not only accept reports of hash-matched child pornography, but accepts reports from providers who determine, through their own internal reviews and investigative tools, whether or not users have been flagged for suspicious content as well.”

This is true, but also far from the whole story. While reports resulting from a hash-match are one of three sources, they are very far from the only source.

Do CyberTipline Reports Only Contain CSAM Evidence?

Not at all. CyberTipline reports can (and do) also cover:

• Sextortion
• Evidence of chat-based enticement
• Photos/videos of child pornography
• Images of a sexually explicit nature including child sexual abuse, child pornography, child exploitation, and other prohibited content

The 2025 Industry Report elaborates that “the CyberTipline has grown from merely accepting cases of child pornography files into accepting allegations of online enticement and other violations of various federal and state laws, specifically as a result of an increased awareness from reporting entities that the law does not only prohibit possession but also communication with minors for illegal purpose.”

What is a Hash-match?

A hash is a unique digital fingerprint. A hash-match occurs when the digital fingerprint of a specific file (such as a JPEG image or MP4 video) is the same as the digital fingerprint of a file that has been previously flagged.

What is PhotoDNA?

PhotoDNA is a perceptual hashing tool developed by Microsoft. Its purpose is to reduce the chance of “false positives” (i.e., photos and videos flagged that are not, in fact, illegal), and it is the primary tool that the vast majority of CyberTipline reports rely on for content identification. PhotoDNA’s 1-in-50 billion false-positive rate claim dates back to 2019.

If you are facing this situation, Spodek Law Group handles federal criminal defense matters nationwide, from offices in New York and Los Angeles.

What Happens After a CyberTipline Report is Forwarded?

NCMEC has been very clear about its role as a conduit for reports, and it has the ability to forward reports to various law enforcement agencies. As a result, NCMEC generally does not conduct the recipient agency’s investigation itself, although it performs statutorily assigned law-enforcement-support functions.

At the federal level, CyberTipline reports are made available to federal law enforcement and Internet Crimes Against Children (ICAC) task forces for follow-up. The ICAC was established in 1998 through legislation, and the ICAC’s CyberTipline follow-up procedures explicitly state:

“The following information is provided for purposes of educating law enforcement personnel and may not, in themselves, be relied upon in determining an individual’s guilt or establishing probable cause. When assessing the validity of a CyberTipline report and the potential of a cybercrime, agents are encouraged to assess information provided by both the reporting entity and NCMEC based on applicable law and procedures. No law or statute specifically requires any federal law enforcement agency or individual to act within a specific time frame; thus, investigators should focus on doing their investigations properly. For purposes of planning, it may be helpful to remember that in many cases, this process could be years.”

While ICAC investigators often pursue a referral within 3 to 6 months, this will vary widely. It will not be surprising, if your case has just been referred, if it has been several months since your last contact with the ICAC, NCMEC, or the reporting provider.

What Does a CyberTipline-Based Investigation Look Like?

For an investigation resulting from a CyberTipline report, it will proceed as follows:

• Referral: A provider identifies content that it believes constitutes child pornography and sends the report and the content to NCMEC, which then forwards the report to the nearest ICAC task force.
• Preservation: Once the ICAC task force decides the referral needs to be pursued, the investigator will preserve data from the reporting provider (and other providers if applicable).

Under the Stored Communications Act, 18 U.S.C. Section 2703(f), the preservation period starts at 90 days and can be renewed once. In other words, providers must keep whatever data they received a preservation request for for 180 days. If the investigator fails to obtain appropriate legal process within the applicable preservation period, the provider may later delete the data, but the case does not necessarily end.

• Subpoenas: At this stage, the investigator will obtain a subpoena for each of the providers’ business records.
• Warrants: If the investigator determines there is probable cause, he or she will then obtain a search warrant for the providers’ content records.
• Search Warrant (or Writ of Seizure)
• Forensics: A computer forensics analyst will identify all relevant files and other data in the returned records.
• Charging Decision: A federal prosecutor will review the case file and decide whether to file criminal charges against the defendant.
• Sentencing: A federal judge will assess guilt and calculate a sentence under the Federal Sentencing Guidelines.

Does a CyberTipline report prove I used the account?

Do IP Addresses Identify Specific People?

No. An IP address identifies the internet connection used to send a file, not the person who sent the file. This distinguishes an IP address from other types of identification, and it is critical to understand what this means for the purpose of attribution. When providers identify one or more IP addresses as being associated with a suspected user’s account or devices, they are identifying the connection(s) to the internet; not the specific individual who used the connection(s).

Along with this fact is the fact that many people share a single IP address. In what is known as carrier-grade Network Address Translation (CGNAT), Internet Service Providers (ISPs) and mobile carriers use one public IP address for a whole block of subscribers. Consequently, a single IP address can identify, say, 250 different individuals. By itself, this information does not identify any specific person, but it does allow an agent to narrow the suspect pool down to a manageable number.

Do Account Identifiers Identify Specific People?

No. Similarly, while account identifiers identify a particular account, this is far from sufficient. As long as the investigator can obtain the data in a provider’s business records, this remains so for a simple reason: identifying an account is not the same thing as identifying who used the account.

Do Device Identifiers Identify Specific People?

No. Device identifiers identify specific devices, not specific people. This does not mean that device identifiers are useless for investigative purposes; and, in fact, device identifiers are often very important for investigative purposes. However, identify the device is not the same thing as identifying who was in possession or control of the device at the time a specific file was uploaded or shared. In other words, identifying the device does not identify who, if anyone, knew about the file’s contents.

Do Upload Metadatas Identify Specific People?

No. Upload metadatas identify a specific event; not a person. For example, metadata may show that a file was uploaded, but it does not show who uploaded the file, or why they did so. This is why CyberTipline report packages must contain sufficient metadata to facilitate further investigation by law enforcement agents.

How Do VPNs and Carrier-Grade NAT Affect the Investigative Process?

VPNs and carrier-grade NAT both present challenges for ICAC agents, which, at the same time, is good news for individuals who are being targeted. A VPN can make it look as if a person is in another country or city altogether. Conversely, carrier-grade NAT can make it look as if several different people are using the same connection. In many cases, this lack of clear IP-based attribution will require the investigator to look for corroborating evidence to build an attribution case.

As the ICAC’s CyberTipline follow-up procedures establish: “If the resident of the identified IP address is not consistent with the identified residential or business address, additional corroborating evidence is required before the suspect can be identified and attribution can be established.”

Does the Government Need Anything Else Before It Can Charge You?

In almost all cases, the government will need at least one subpoena and usually one warrant before it can charge someone. As the ICAC’s CyberTipline follow-up procedures explain:

“The information in the CyberTipline report should identify only a single suspected user. Once an investigator has reviewed this information and determined that a referral needs to be pursued, the investigator must obtain warrants or subpoenas to prove the user’s identity or control of the account. The investigator should not assume attribution, and, instead, the investigator should focus on establishing attribution through legitimate investigative means.”

How do I get a copy of my CyberTipline report?

How Will I Know If There Is a CyberTipline Report About Me?

In most cases, you won’t know you’ve been reported, unless your account is suddenly terminated. While there are some cases where providers will inform users about their referals, companies generally will not tell you what was reported. For example, the 2025 Industry Report states: “ a user can be the subject of a referral to the CyberTipline without actually receiving a notification of any sort from the reporting entity.” The 2025 Industry Report also refers to how “most companies’ users-end experiences are similar to one another; they do not generally inform the user of the CyberTipline referral... but they will inform the user if content has been removed.” Even then, the notification will rarely say why the content was removed, and will never tell the user which law enforcement agency received the report.

Can I Request a Copy of the CyberTipline Report from NCMEC?

Generally, no. The CyberTipline is not a public record, and NCMEC is not subject to the Freedom of Information Act (FOIA). As the CyberTipline’s Frequently Asked Questions page clarifies:

“Generally, no. Individuals can request reports that have been filed about them by companies to the CyberTipline.... However, there are cases in which requests must be denied to comply with other laws, protect the victim’s identity, or ensure that a potential investigation will not be jeopardized.”

When an individual is denied a report from NCMEC, the person is told this, and is directed to a list of companies that have a policy of releasing report information to individuals.

When and How Will I Be Able to Access the Information in the CyberTipline Report About Me?

Typically, you will first see the information in your CyberTipline report during criminal discovery. However, because the report will often include image and video evidence in the form of CSAM, access will be restricted under 18 U.S.C. § 3509(m).

• “The court shall not order that a copy of child pornography be made available to the defense.... during criminal proceedings, and if a copy is ordered to be made available to the defense, then the copying of the file shall be subject to such conditions as the court considers sufficient to prohibit any further disclosure or transfer of the file....”

Although Section 3509(m) is intended to ensure that CSAM evidence is not copied unnecessarily, it still recognizes the need for the defense to examine the evidence:

• “In a criminal case, the court shall grant reasonable access to a copy of child pornography to the defendant in order to enable the defendant to effectively present a defense.”

In practice, the defense often receives the CSAM evidence in a read-only format or it is governed by a protective order.

Get Advice on Your Situation

If you want someone to look at the specifics of your case, Spodek Law Group handles federal criminal defense nationwide from New York and Los Angeles. The firm has been practicing since 1976 and its motto is simple: we owe loyalty to only you. Call 212-300-5196.