---
kind: "range"
citation: "18 U.S.C. §§ 2258A–2258E"
title: "18"
from: "2258A"
to: "2258E"
count: 5
release: "119-102"
url: "https://uscodex.org/usc/18/2258A..2258E"
---

# §2258A. Reporting requirements of providers

- (a) **Duty To Report.—**
  - (1) **In general.—**
    - (A) **Duty.—** In order to reduce the proliferation of online child sexual exploitation and to prevent the online sexual exploitation of children, a [provider](/usc/18/2258E.md?p=6)—
      - (i) shall, as soon as reasonably possible after obtaining actual knowledge of any facts or circumstances described in [paragraph (2)(A)](#a-2-A), take the actions described in [subparagraph (B)](#a-1-B); and
      - (ii) may, after obtaining actual knowledge of any facts or circumstances described in [paragraph (2)(B)](#a-2-B), take the actions described in [subparagraph (B)](#a-1-B).
    - (B) **Actions described.—** The actions described in this subparagraph are—
      - (i) providing to the CyberTipline of [NCMEC](/usc/18/2258E.md?p=7), or any successor to the CyberTipline operated by [NCMEC](/usc/18/2258E.md?p=7), the mailing address, telephone number, facsimile number, electronic mailing address of, and individual point of contact for, such [provider](/usc/18/2258E.md?p=6); and
      - (ii) making a report of such facts or circumstances to the CyberTipline, or any successor to the CyberTipline operated by [NCMEC](/usc/18/2258E.md?p=7).
  - (2) **Facts or circumstances.—**
    - (A) **Apparent violations.—** The facts or circumstances described in this subparagraph are any facts or circumstances from which there is an apparent violation of section [2251](/usc/18/2251.md), [2251A](/usc/18/2251A.md), [2252](/usc/18/2252.md), [2252A](/usc/18/2252A.md), [2252B](/usc/18/2252B.md), or [2260](/usc/18/2260.md) that involves [child pornography](/usc/18/2256.md?p=8), of [section 1591](/usc/18/1591.md) (if the violation involves a [minor](/usc/18/2256.md?p=1)), or of[^1] 2422(b).
    - (B) **Imminent violations.—** The facts or circumstances described in this subparagraph are any facts or circumstances which indicate a violation of any of the sections described in [subparagraph (A)](#a-2-A) involving [child pornography](/usc/18/2256.md?p=8) may be planned or imminent.
- (b) **Contents of Report.—** In an effort to prevent the future sexual victimization of children, and to the extent the information is within the [custody or control](/usc/18/2256.md?p=7) of a [provider](/usc/18/2258E.md?p=6), the facts and circumstances included in each report under [subsection (a)(1)](#a-1) may, at the sole discretion of the [provider](/usc/18/2258E.md?p=6), include the following information:
  - (1) **Information about the involved individual.—** Information relating to the identity of any individual who appears to have violated or plans to violate a Federal law described in [subsection (a)(2)](#a-2), which may, to the extent reasonably practicable, include the [electronic mail address](/usc/18/2258E.md?p=3), [Internet](/usc/18/2258E.md?p=4) Protocol address, uniform resource locator, payment information (excluding personally identifiable information), or any other identifying information, including self-reported identifying information.
  - (2) **Historical reference.—** Information relating to when and how a customer or subscriber of a [provider](/usc/18/2258E.md?p=6) uploaded, transmitted, or received content relating to the report or when and how content relating to the report was reported to, or discovered by the [provider](/usc/18/2258E.md?p=6), including a date and time stamp and time zone.
  - (3) **Geographic location information.—** Information relating to the geographic location of the involved individual or [website](/usc/18/2258E.md?p=8), which may include the [Internet](/usc/18/2258E.md?p=4) Protocol address or verified address, or, if not reasonably available, at least one form of geographic identifying information, including area code or zip code, provided by the customer or subscriber, or stored or obtained by the [provider](/usc/18/2258E.md?p=6).
  - (4) **Visual depictions of apparent child pornography.—** Any [visual depiction](/usc/18/2256.md?p=5) of apparent [child pornography](/usc/18/2256.md?p=8) or other content relating to the incident such report is regarding.
  - (5) **Complete communication.—** The complete communication containing any [visual depiction](/usc/18/2256.md?p=5) of apparent [child pornography](/usc/18/2256.md?p=8) or other content, including—
    - (A) any data or information regarding the transmission of the communication; and
    - (B) any [visual depictions](/usc/18/2256.md?p=5), data, or other digital files contained in, or attached to, the communication.
- (c) **Forwarding of Report to Law Enforcement.—** Pursuant to its clearinghouse role as a private, nonprofit [organization](/usc/18/2256.md?p=4), and at the conclusion of its review in furtherance of its nonprofit mission, [NCMEC](/usc/18/2258E.md?p=7) shall make available each report made under [subsection (a)(1)](#a-1) and all supplemental data included in the report to one or more of the following law enforcement [agencies](/usc/18/6.md):
  - (1) Any Federal law enforcement [agency](/usc/18/6.md) that is involved in the investigation of child sexual exploitation, kidnapping, or enticement crimes.
  - (2) Any [State](/usc/18/2258E.md?p=1) or local law enforcement [agency](/usc/18/6.md) that is involved in the investigation of child sexual exploitation.
  - (3) A foreign law enforcement [agency](/usc/18/6.md) designated by the Attorney General under [subsection (d)(3)](#d-3) or a foreign law enforcement [agency](/usc/18/6.md) that has an established relationship with the Federal Bureau of Investigation, Immigration and Customs Enforcement, or INTERPOL, and is involved in the investigation of child sexual exploitation, kidnapping, or enticement crimes.
- (d) **Attorney General Responsibilities.—**
  - (1) **In general.—** The Attorney General shall enforce this section.
  - (2) **Designation of federal agencies.—** The Attorney General may designate a Federal law enforcement [agency](/usc/18/6.md) or [agencies](/usc/18/6.md) to which a report shall be forwarded under [subsection (c)(1)](#c-1).
  - (3) **Designation of foreign agencies.—** The Attorney General may—
    - (A) in consultation with the Secretary of State, designate foreign law enforcement [agencies](/usc/18/6.md) to which a report may be forwarded under [subsection (c)(3)](#c-3);
    - (B) establish the conditions under which such a report may be forwarded to such [agencies](/usc/18/6.md); and
    - (C) develop a process for foreign law enforcement [agencies](/usc/18/6.md) to request assistance from Federal law enforcement [agencies](/usc/18/6.md) in obtaining evidence related to a report referred under [subsection (c)(3)](#c-3).
  - (4) **Reporting designated foreign agencies.—** The Attorney General may maintain and make available to the Department of State, [NCMEC](/usc/18/2258E.md?p=7), [providers](/usc/18/2258E.md?p=6), the Committee on the Judiciary of the Senate, and the Committee on the Judiciary of the House of Representatives a list of the foreign law enforcement [agencies](/usc/18/6.md) designated under [paragraph (3)](#d-3).
  - (5) **Notification to providers.—**
    - (A) **In general.—** [NCMEC](/usc/18/2258E.md?p=7) may notify a [provider](/usc/18/2258E.md?p=6) of the information described in [subparagraph (B)](#d-5-B), if—
      - (i) a [provider](/usc/18/2258E.md?p=6) notifies [NCMEC](/usc/18/2258E.md?p=7) that the [provider](/usc/18/2258E.md?p=6) is making a report under this section as the result of a request by a foreign law enforcement [agency](/usc/18/6.md); and
      - (ii) [NCMEC](/usc/18/2258E.md?p=7) forwards the report described in [clause (i)](#d-5-A-i) to—
        - (I) the requesting foreign law enforcement [agency](/usc/18/6.md); or
        - (II) another [agency](/usc/18/6.md) in the same country designated by the Attorney General under [paragraph (3)](#d-3) or that has an established relationship with the Federal Bureau of Investigation, U.S. Immigration and Customs Enforcement, or INTERPOL and is involved in the investigation of child sexual exploitation, kidnapping, or enticement crimes.
    - (B) **Information described.—** The information described in this subparagraph is—
      - (i) the identity of the foreign law enforcement [agency](/usc/18/6.md) to which the report was forwarded; and
      - (ii) the date on which the report was forwarded.
    - (C) **Notification of inability to forward report.—** If a [provider](/usc/18/2258E.md?p=6) notifies [NCMEC](/usc/18/2258E.md?p=7) that the [provider](/usc/18/2258E.md?p=6) is making a report under this section as the result of a request by a foreign law enforcement [agency](/usc/18/6.md) and [NCMEC](/usc/18/2258E.md?p=7) is unable to forward the report as described in [subparagraph (A)(ii)](#d-5-A-ii), [NCMEC](/usc/18/2258E.md?p=7) shall notify the [provider](/usc/18/2258E.md?p=6) that [NCMEC](/usc/18/2258E.md?p=7) was unable to forward the report.
- (e) **Failure To Report.—** A [provider](/usc/18/2258E.md?p=6) that knowingly and willfully fails to make a report required under [subsection (a)(1)](#a-1) shall be fined—
  - (1) in the case of an initial knowing and willful failure to make a report, not more than $850,000 in the case of a [provider](/usc/18/2258E.md?p=6) with not less than 100,000,000 monthly active users or $600,000 in the case of a [provider](/usc/18/2258E.md?p=6) with less than 100,000,000 monthly active users; and
  - (2) in the case of any second or subsequent knowing and willful failure to make a report, not more than $1,000,000 in the case of a [provider](/usc/18/2258E.md?p=6) with not less than 100,000,000 monthly active users or $850,000 in the case of a [provider](/usc/18/2258E.md?p=6) with less than 100,000,000 monthly active users.
- (f) **Protection of Privacy.—** Nothing in this section shall be construed to require a [provider](/usc/18/2258E.md?p=6) to—
  - (1) monitor any user, subscriber, or customer of that [provider](/usc/18/2258E.md?p=6);
  - (2) monitor the content of any communication of any person described in [paragraph (1)](#f-1); or
  - (3) affirmatively search, screen, or scan for facts or circumstances described in sections (a) and (b).
- (g) **Conditions of Disclosure Information Contained Within Report.—**
  - (1) **In general.—** Except as provided in [paragraph (2)](#g-2), a law enforcement [agency](/usc/18/6.md) that receives a report under [subsection (c)](#c) shall not disclose any information contained in that report.
  - (2) **Permitted disclosures by law enforcement.—**
    - (A) **In general.—** A law enforcement [agency](/usc/18/6.md) may disclose information in a report received under [subsection (c)](#c)—
      - (i) to an [attorney for the government](/usc/18/2258E.md?p=1) for use in the performance of the official duties of that attorney;
      - (ii) to such [officers](/usc/18/202.md?p=c) and [employees](/usc/18/202.md?p=c) of that law enforcement [agency](/usc/18/6.md), as may be necessary in the performance of their investigative and recordkeeping functions;
      - (iii) to such other government personnel (including personnel of a [State](/usc/18/2258E.md?p=1) or subdivision of a [State](/usc/18/2258E.md?p=1)) as are determined to be necessary by an [attorney for the government](/usc/18/2258E.md?p=1) to assist the attorney in the performance of the official duties of the attorney in enforcing Federal criminal law;
      - (iv) if the report discloses a violation of [State](/usc/18/2258E.md?p=1) criminal law, to an appropriate official of a [State](/usc/18/2258E.md?p=1) or subdivision of a [State](/usc/18/2258E.md?p=1) for the purpose of enforcing such [State](/usc/18/2258E.md?p=1) law;
      - (v) to a defendant in a criminal case or the attorney for that defendant, subject to the terms and limitations under [section 3509(m)](/usc/18/3509.md?p=m) or a similar [State](/usc/18/2258E.md?p=1) law, to the extent the information relates to a criminal charge pending against that defendant;
      - (vi) subject to [subparagraph (B)](#g-2-B), to a [provider](/usc/18/2258E.md?p=6) if necessary to facilitate response to legal process issued in connection to a criminal investigation, prosecution, or post-conviction remedy relating to that report; and
      - (vii) as ordered by a court upon a showing of good cause and pursuant to any protective orders or other conditions that the court may impose.
    - (B) **Limitation.—** Nothing in [subparagraph (A)(vi)](#g-2-A-vi) authorizes a law enforcement [agency](/usc/18/6.md) to provide [visual depictions](/usc/18/2256.md?p=5) of apparent [child pornography](/usc/18/2256.md?p=8) to a [provider](/usc/18/2258E.md?p=6).
  - (3) **Permitted disclosures by NCMEC.—** [NCMEC](/usc/18/2258E.md?p=7) may disclose by mail, electronic transmission, or other reasonable means, information received in a report under [subsection (a)](#a) only to—
    - (A) any Federal law enforcement [agency](/usc/18/6.md) designated by the Attorney General under [subsection (d)(2)](#d-2) or that is involved in the investigation of child sexual exploitation, kidnapping, or enticement crimes;
    - (B) any [State](/usc/18/2258E.md?p=1), local, or tribal law enforcement [agency](/usc/18/6.md) involved in the investigation of child sexual exploitation, kidnapping, or enticement crimes;
    - (C) any foreign law enforcement [agency](/usc/18/6.md) designated by the Attorney General under [subsection (d)(3)](#d-3) or that has an established relationship with the Federal Bureau of Investigation, Immigration and Customs Enforcement, or INTERPOL, and is involved in the investigation of child sexual exploitation, kidnapping, or enticement crimes;
    - (D) a [provider](/usc/18/2258E.md?p=6) as described in [section 2258C](/usc/18/2258C.md); and
    - (E) respond to legal process, as necessary.
  - (4) **Permitted disclosure by a provider.—** A [provider](/usc/18/2258E.md?p=6) that submits a report under [subsection (a)(1)](#a-1) may disclose by mail, electronic transmission, or other reasonable means, information, including [visual depictions](/usc/18/2256.md?p=5) contained in the report, in a manner consistent with permitted disclosures under [paragraphs (3) through (8)](/usc/18/2702.md?p=b-3..b-8) of section 2702(b) only to a law enforcement [agency](/usc/18/6.md) described in subparagraph [(A)](#g-3-A), [(B)](#g-3-B), or [(C)](#g-3-C) of paragraph (3), to [NCMEC](/usc/18/2258E.md?p=7), or as necessary to respond to legal process.
- (h) **Preservation.—**
  - (1) **In general.—** For the purposes of this section, a completed submission by a [provider](/usc/18/2258E.md?p=6) of a report to the CyberTipline under [subsection (a)(1)](#a-1) shall be treated as a request to preserve the [contents](/usc/18/3127.md?p=1) provided in the report for 1 year after the submission to the CyberTipline.
  - (2) **Preservation of commingled content.—** Pursuant to [paragraph (1)](#h-1), a [provider](/usc/18/2258E.md?p=6) shall preserve any [visual depictions](/usc/18/2256.md?p=5), data, or other digital files that are reasonably accessible and may provide context or additional information about the reported material or person.
  - (3) **Protection of preserved materials.—** A [provider](/usc/18/2258E.md?p=6) preserving materials under this section shall maintain the materials in a secure location and take appropriate steps to limit access by agents or [employees](/usc/18/202.md?p=c) of the service to the materials to that access necessary to comply with the requirements of this subsection.
  - (4) **Authorities and duties not affected.—** Nothing in this section shall be construed as replacing, amending, or otherwise interfering with the authorities and duties under [section 2703](/usc/18/2703.md).
  - (5) **Extension of preservation.—** A [provider](/usc/18/2258E.md?p=6) of a report to the CyberTipline under [subsection (a)(1)](#a-1) may voluntarily preserve the [contents](/usc/18/3127.md?p=1) provided in the report (including any comingled content described in [paragraph (2)](#h-2)) for longer than 1 year after the submission to the CyberTipline for the purpose of reducing the proliferation of online child sexual exploitation or preventing the online sexual exploitation of children.
  - (6) **Method of preservation.—** Not later than 1 year after the date of enactment of this paragraph, a [provider](/usc/18/2258E.md?p=6) of a report to the CyberTipline under [subsection (a)(1)](#a-1) shall preserve materials under this subsection in a manner that is consistent with the most recent version of the Cybersecurity Framework developed by the National Institute of Standards and Technology, or any successor thereto.

# §2258B. Limited liability for the reporting, storage, and handling of certain visual depictions of apparent child pornography to the National Center for Missing & Exploited Children

- (a) **In General.—** Except as provided in [subsection (b)](#b), a civil claim or criminal charge against a [provider](/usc/18/2258E.md?p=6) or domain name registrar, including any director, [officer](/usc/18/202.md?p=c), [employee](/usc/18/202.md?p=c), or agent of such [provider](/usc/18/2258E.md?p=6) or domain name registrar arising from the performance of the reporting or preservation responsibilities of such [provider](/usc/18/2258E.md?p=6) or domain name registrar under this section, [section 2258A](/usc/18/2258A.md), or [section 2258C](/usc/18/2258C.md) may not be brought in any Federal or [State](/usc/18/2258E.md?p=1) court.
- (b) **Intentional, Reckless, or Other Misconduct.—** [Subsection (a)](#a) shall not apply to a claim or charge if the [provider](/usc/18/2258E.md?p=6) or domain name registrar, or a director, [officer](/usc/18/202.md?p=c), [employee](/usc/18/202.md?p=c), or agent of that [provider](/usc/18/2258E.md?p=6) or domain name registrar—
  - (1) engaged in intentional misconduct; or
  - (2) acted, or failed to act—
    - (A) with actual malice;
    - (B) with reckless disregard to a substantial risk of causing physical injury without legal justification; or
    - (C) for a purpose unrelated to the performance of any responsibility or function under sections[^1] 2258A, 2258C, 2702, or 2703.
- (c) **Minimizing Access.—** A [provider](/usc/18/2258E.md?p=6) and domain name registrar shall—
  - (1) minimize the number of [employees](/usc/18/202.md?p=c) that are provided access to any [visual depiction](/usc/18/2256.md?p=5) provided under section [2258A](/usc/18/2258A.md) or [2258C](/usc/18/2258C.md); and
  - (2) ensure that any such [visual depiction](/usc/18/2256.md?p=5) is permanently destroyed, upon a request from a law enforcement [agency](/usc/18/6.md) to destroy the [visual depiction](/usc/18/2256.md?p=5).
- (d) **Limited Liability for NCMEC-Contracted Vendors.—**
  - (1) **In general.—** Except as provided in [paragraph (2)](#d-2), a civil claim or criminal charge may not be brought in any Federal or [State](/usc/18/2258E.md?p=1) court against a vendor contractually retained and designated by [NCMEC](/usc/18/2258E.md?p=7) to support the duties of [NCMEC](/usc/18/2258E.md?p=7) under section 404(b)(1)(K) of the Juvenile Justice and Delinquency Prevention Act of 1974 ([34 U.S.C. 11293(b)(1)(K)](/usc/34/11293.md?p=b-1-K)).
  - (2) **Intentional, reckless, or other misconduct.—** [Paragraph (1)](#d-1) shall not apply to a claim or charge if the vendor—
    - (A) engaged in—
      - (i) intentional misconduct; or
      - (ii) negligent conduct; or
    - (B) acted, or failed to act—
      - (i) with actual malice;
      - (ii) with reckless disregard to a substantial risk of causing injury without legal justification; or
      - (iii) for a purpose unrelated to the performance of any responsibility or function—
        - (I) set forth in [paragraph (1)](#d-1); or
        - (II) pursuant to sections[^1] 2258A, 2258C, 2702, or 2703.
  - (3) **Vendor cybersecurity requirements.—** With respect to any [visual depiction](/usc/18/2256.md?p=5) provided pursuant to the duties of [NCMEC](/usc/18/2258E.md?p=7) under section 404(b)(1)(K) of the Juvenile Justice and Delinquency Prevention Act of 1974 ([34 U.S.C. 11293(b)(1)(K)](/usc/34/11293.md?p=b-1-K)) that is stored or transferred by a vendor contractually retained and designated by [NCMEC](/usc/18/2258E.md?p=7) to support such duties of [NCMEC](/usc/18/2258E.md?p=7), a vendor shall—
    - (A) secure such [visual depiction](/usc/18/2256.md?p=5) in a manner that is consistent with the most recent version of the Cybersecurity Framework developed by the National Institute of Standards and Technology, or any successor thereto;
    - (B) minimize the number of [employees](/usc/18/202.md?p=c) that may be able to obtain access to such [visual depiction](/usc/18/2256.md?p=5);
    - (C) employ end-to-end encryption for data storage and transfer functions, or an equivalent technological standard;
    - (D) undergo an independent annual cybersecurity audit to determine whether such [visual depiction](/usc/18/2256.md?p=5) is secured as required under [subparagraph (A)](#d-3-A); and
    - (E) promptly address all issues identified by an audit described in [subparagraph (D)](#d-3-D).
- (e) **Limited Liability for Reporting Apparent Child Pornography by an Individual Depicted in the Child Pornography as a Minor, or a Representative of Such Individual.—**
  - (1) **In general.—** Except as provided in [paragraph (2)](#e-2), a civil claim or criminal charge may not be brought in any Federal or [State](/usc/18/2258E.md?p=1) court against an individual depicted in [child pornography](/usc/18/2256.md?p=8) as a [minor](/usc/18/2256.md?p=1), or a [representative](#e-4) of such individual, arising from a report to the [NCMEC](/usc/18/2258E.md?p=7) CyberTipline by the individual, or the [representative](#e-4) of such individual, of information that relates to the [child pornography](/usc/18/2256.md?p=8) in which the individual is depicted as a [minor](/usc/18/2256.md?p=1), including a copy of the [child pornography](/usc/18/2256.md?p=8).
  - (2) **Intentional, reckless, or other misconduct.—** [Paragraph (1)](#e-1) shall not apply to a claim or charge if the individual, or the [representative](#e-4) of such individual—
    - (A) engaged in—
      - (i) intentional misconduct;
      - (ii) negligent conduct; or
      - (iii) any activity which constitutes a violation of [section 2251](/usc/18/2251.md); or
    - (B) acted, or failed to act—
      - (i) with actual malice; or
      - (ii) with reckless disregard to a substantial risk of causing injury without legal justification.
  - (3) **Minimizing access.—** With respect to any [child pornography](/usc/18/2256.md?p=8) reported to the [NCMEC](/usc/18/2258E.md?p=7) CyberTipline by an individual depicted in the [child pornography](/usc/18/2256.md?p=8) as a [minor](/usc/18/2256.md?p=1), or a [representative](#e-4) of such individual, [NCMEC](/usc/18/2258E.md?p=7) shall minimize access to the [child pornography](/usc/18/2256.md?p=8) and ensure the appropriate deletion of the [child pornography](/usc/18/2256.md?p=8), as set forth in [section 2258D](/usc/18/2258D.md).
  - (4) **Definition.—** For purposes of this subsection, the term “representative”, with respect to an individual depicted in [child pornography](/usc/18/2256.md?p=8)—
    - (A) means—
      - (i) the parent or legal guardian of the individual, if the individual is under 18 years of age;
      - (ii) the legal guardian or other person appointed by a court to represent the individual;
      - (iii) a legal [representative](#e-4) retained by the individual;
      - (iv) a [representative](#e-4) of the estate of the individual; or
      - (v) a person who is a mandated reporter under [section 226(a)(1)](/usc/18/226.md?p=a-1) of the Victims of Child Abuse Act of 1990 ([34 U.S.C. 20341(a)(1)](/usc/34/20341.md?p=a-1)); and
    - (B) does not include a person who engaged in any activity which constitutes a violation of [section 2251](/usc/18/2251.md).

# §2258C. Use to combat child pornography of technical elements relating to reports made to the CyberTipline

- (a) **Elements.—**
  - (1) **In general.—** [NCMEC](/usc/18/2258E.md?p=7) may provide elements relating to any CyberTipline report to a [provider](/usc/18/2258E.md?p=6) for the sole and exclusive purpose of permitting that [provider](/usc/18/2258E.md?p=6) to stop the online sexual exploitation of children.
  - (2) **Inclusions.—** The elements authorized under [paragraph (1)](#a-1) may include hash values or other unique identifiers associated with a specific [visual depiction](/usc/18/2256.md?p=5), including an [Internet](/usc/18/2258E.md?p=4) location and any other elements provided in a CyberTipline report that can be used to identify, prevent, curtail, or stop the transmission of [child pornography](/usc/18/2256.md?p=8) and prevent the online sexual exploitation of children.
  - (3) **Exclusion.—** The elements authorized under [paragraph (1)](#a-1) may not include the actual [visual depictions](/usc/18/2256.md?p=5) of apparent [child pornography](/usc/18/2256.md?p=8).
- (b) **Use by Providers.—** Any [provider](/usc/18/2258E.md?p=6) that receives elements relating to any CyberTipline report from [NCMEC](/usc/18/2258E.md?p=7) under this section may use such information only for the purposes described in this section, provided that such use shall not relieve the [provider](/usc/18/2258E.md?p=6) from reporting under [section 2258A](/usc/18/2258A.md).
- (c) **Limitations.—** Nothing in subsections[^1] (a) or (b) requires [providers](/usc/18/2258E.md?p=6) receiving elements relating to any CyberTipline report from [NCMEC](/usc/18/2258E.md?p=7) to use the elements to stop the online sexual exploitation of children.
- (d) **Provision of Elements to Law Enforcement.—** [NCMEC](/usc/18/2258E.md?p=7) may make available to Federal, [State](/usc/18/2258E.md?p=1), and local law enforcement, and to foreign law enforcement [agencies](/usc/18/6.md) described in [section 2258A(c)(3)](/usc/18/2258A.md?p=c-3), involved in the investigation of child sexual exploitation crimes elements, including hash values, relating to any apparent [child pornography](/usc/18/2256.md?p=8) [visual depiction](/usc/18/2256.md?p=5) reported to the CyberTipline.
- (e) **Use by Law Enforcement.—** Any foreign, Federal, [State](/usc/18/2258E.md?p=1), or local law enforcement [agency](/usc/18/6.md) that receives elements relating to any apparent [child pornography](/usc/18/2256.md?p=8) [visual depiction](/usc/18/2256.md?p=5) from [NCMEC](/usc/18/2258E.md?p=7) under [subsection (d)](#d) may use such elements only in the performance of the official duties of that [agency](/usc/18/6.md) to investigate child sexual exploitation crimes, and prevent future sexual victimization of children.

# §2258D. Limited liability for NCMEC

- (a) **In General.—** Pursuant to its clearinghouse role as a private, nonprofit [organization](/usc/18/2256.md?p=4) and its mission to help find missing children, reduce online sexual exploitation of children and prevent future victimization, and except as provided in subsections [(b)](#b) and [(c)](#c), a civil claim or criminal charge against [NCMEC](/usc/18/2258E.md?p=7), including any director, [officer](/usc/18/202.md?p=c), [employee](/usc/18/202.md?p=c), or agent of [NCMEC](/usc/18/2258E.md?p=7), arising from the performance of the CyberTipline responsibilities or functions of [NCMEC](/usc/18/2258E.md?p=7), as described in this section, section [2258A](/usc/18/2258A.md) or [2258C](/usc/18/2258C.md) of this title, or section 404 of the Missing Children’s Assistance Act ([34 U.S.C. 11293](/usc/34/11293.md)), or from the efforts of [NCMEC](/usc/18/2258E.md?p=7) to identify child victims may not be brought in any Federal or [State](/usc/18/2258E.md?p=1) court.
- (b) **Intentional, Reckless, or Other Misconduct.—** [Subsection (a)](#a) shall not apply to a claim or charge if [NCMEC](/usc/18/2258E.md?p=7), or a director, [officer](/usc/18/202.md?p=c), [employee](/usc/18/202.md?p=c), or agent of [NCMEC](/usc/18/2258E.md?p=7)—
  - (1) engaged in intentional misconduct; or
  - (2) acted, or failed to act—
    - (A) with actual malice;
    - (B) with reckless disregard to a substantial risk of causing injury without legal justification; or
    - (C) for a purpose unrelated to the performance of any responsibility or function under this section, section [2258A](/usc/18/2258A.md) or [2258C](/usc/18/2258C.md) of this title, or section 404 of the Missing Children’s Assistance Act ([34 U.S.C. 11293](/usc/34/11293.md)).
- (c) **Ordinary Business Activities.—** [Subsection (a)](#a) shall not apply to an act or omission relating to an ordinary business activity, including general administration or operations, the use of motor vehicles, or personnel management.
- (d) **Minimizing Access.—** [NCMEC](/usc/18/2258E.md?p=7) shall—
  - (1) minimize the number of [employees](/usc/18/202.md?p=c) that are provided access to any [visual depiction](/usc/18/2256.md?p=5) provided under [section 2258A](/usc/18/2258A.md); and
  - (2) ensure that any such [visual depiction](/usc/18/2256.md?p=5) is permanently destroyed upon notification from a law enforcement [agency](/usc/18/6.md).

# §2258E. Definitions


In [sections 2258A through 2258E](/usc/18/2258A..2258E.md)—

- (1) the terms “attorney for the government” and “State” have the meanings given those terms in [rule 1](/usc/18a/crim-1.md) of the Federal Rules of Criminal Procedure;
- (2) the term “electronic communication service” has the meaning given that term in [section 2510](/usc/18/2510.md);
- (3) the term “electronic mail address” has the meaning given that term in [section 3](/usc/18/3.md) of the CAN–SPAM Act of 2003 ([15 U.S.C. 7702](/usc/15/7702.md));
- (4) the term “Internet” has the meaning given that term in section 1101 of the Internet Tax Freedom Act ([47 U.S.C. 151](/usc/47/151.md) note);
- (5) the term “remote computing service” has the meaning given that term in [section 2711](/usc/18/2711.md);
- (6) the term “provider” means an [electronic communication service](#2) provider or [remote computing service](#5);
- (7) the term “NCMEC” means the National Center for Missing & Exploited Children; and
- (8) the term “website” means any collection of material placed in a [computer](/usc/18/2256.md?p=6) server-based file archive so that it is publicly accessible, over the [Internet](#4), using hypertext transfer protocol or any successor protocol.