---
kind: "section"
citation: "18 U.S.C. § 2258B"
title: "18"
title_heading: "Crimes and Criminal Procedure"
number: "2258B"
heading: "Limited liability for the reporting, storage, and handling of certain visual depictions of apparent child pornography to the National Center for Missing & Exploited Children"
release: "119-102"
date: "2026-07-12"
url: "https://uscodex.org/usc/18/2258B"
units:
  - "Part I — Crimes"
  - "Chapter 110 — Sexual Exploitation and Other Abuse of Children"
---

# §2258B. Limited liability for the reporting, storage, and handling of certain visual depictions of apparent child pornography to the National Center for Missing & Exploited Children

- (a) **In General.—** Except as provided in [subsection (b)](#b), a civil claim or criminal charge against a provider or domain name registrar, including any director, [officer](/usc/18/202.md?p=c), [employee](/usc/18/202.md?p=c), or agent of such provider or domain name registrar arising from the performance of the reporting or preservation responsibilities of such provider or domain name registrar under this section, [section 2258A](/usc/18/2258A.md), or [section 2258C](/usc/18/2258C.md) may not be brought in any Federal or [State](/usc/18/31.md?p=a-9) court.
- (b) **Intentional, Reckless, or Other Misconduct.—** [Subsection (a)](#a) shall not apply to a claim or charge if the provider or domain name registrar, or a director, [officer](/usc/18/202.md?p=c), [employee](/usc/18/202.md?p=c), or agent of that provider or domain name registrar—
  - (1) engaged in intentional misconduct; or
  - (2) acted, or failed to act—
    - (A) with actual malice;
    - (B) with reckless disregard to a substantial risk of causing physical injury without legal justification; or
    - (C) for a purpose unrelated to the performance of any responsibility or function under sections[^1] 2258A, 2258C, 2702, or 2703.
- (c) **Minimizing Access.—** A provider and domain name registrar shall—
  - (1) minimize the number of [employees](/usc/18/202.md?p=c) that are provided access to any [visual depiction](/usc/18/2256.md?p=5) provided under section [2258A](/usc/18/2258A.md) or [2258C](/usc/18/2258C.md); and
  - (2) ensure that any such [visual depiction](/usc/18/2256.md?p=5) is permanently destroyed, upon a request from a law enforcement agency to destroy the [visual depiction](/usc/18/2256.md?p=5).
- (d) **Limited Liability for NCMEC-Contracted Vendors.—**
  - (1) **In general.—** Except as provided in [paragraph (2)](#d-2), a civil claim or criminal charge may not be brought in any Federal or [State](/usc/18/31.md?p=a-9) court against a vendor contractually retained and designated by NCMEC to support the duties of NCMEC under section 404(b)(1)(K) of the Juvenile Justice and Delinquency Prevention Act of 1974 ([34 U.S.C. 11293(b)(1)(K)](/usc/34/11293.md?p=b-1-K)).
  - (2) **Intentional, reckless, or other misconduct.—** [Paragraph (1)](#d-1) shall not apply to a claim or charge if the vendor—
    - (A) engaged in—
      - (i) intentional misconduct; or
      - (ii) negligent conduct; or
    - (B) acted, or failed to act—
      - (i) with actual malice;
      - (ii) with reckless disregard to a substantial risk of causing injury without legal justification; or
      - (iii) for a purpose unrelated to the performance of any responsibility or function—
        - (I) set forth in [paragraph (1)](#d-1); or
        - (II) pursuant to sections[^1] 2258A, 2258C, 2702, or 2703.
  - (3) **Vendor cybersecurity requirements.—** With respect to any [visual depiction](/usc/18/2256.md?p=5) provided pursuant to the duties of NCMEC under section 404(b)(1)(K) of the Juvenile Justice and Delinquency Prevention Act of 1974 ([34 U.S.C. 11293(b)(1)(K)](/usc/34/11293.md?p=b-1-K)) that is stored or transferred by a vendor contractually retained and designated by NCMEC to support such duties of NCMEC, a vendor shall—
    - (A) secure such [visual depiction](/usc/18/2256.md?p=5) in a manner that is consistent with the most recent version of the Cybersecurity Framework developed by the National Institute of Standards and Technology, or any successor thereto;
    - (B) minimize the number of [employees](/usc/18/202.md?p=c) that may be able to obtain access to such [visual depiction](/usc/18/2256.md?p=5);
    - (C) employ end-to-end encryption for data storage and transfer functions, or an equivalent technological standard;
    - (D) undergo an independent annual cybersecurity audit to determine whether such [visual depiction](/usc/18/2256.md?p=5) is secured as required under [subparagraph (A)](#d-3-A); and
    - (E) promptly address all issues identified by an audit described in [subparagraph (D)](#d-3-D).
- (e) **Limited Liability for Reporting Apparent Child Pornography by an Individual Depicted in the Child Pornography as a Minor, or a Representative of Such Individual.—**
  - (1) **In general.—** Except as provided in [paragraph (2)](#e-2), a civil claim or criminal charge may not be brought in any Federal or [State](/usc/18/31.md?p=a-9) court against an individual depicted in [child pornography](/usc/18/2256.md?p=8) as a [minor](/usc/18/2256.md?p=1), or a representative of such individual, arising from a report to the NCMEC CyberTipline by the individual, or the representative of such individual, of information that relates to the [child pornography](/usc/18/2256.md?p=8) in which the individual is depicted as a [minor](/usc/18/2256.md?p=1), including a copy of the [child pornography](/usc/18/2256.md?p=8).
  - (2) **Intentional, reckless, or other misconduct.—** [Paragraph (1)](#e-1) shall not apply to a claim or charge if the individual, or the representative of such individual—
    - (A) engaged in—
      - (i) intentional misconduct;
      - (ii) negligent conduct; or
      - (iii) any activity which constitutes a violation of [section 2251](/usc/18/2251.md); or
    - (B) acted, or failed to act—
      - (i) with actual malice; or
      - (ii) with reckless disregard to a substantial risk of causing injury without legal justification.
  - (3) **Minimizing access.—** With respect to any [child pornography](/usc/18/2256.md?p=8) reported to the NCMEC CyberTipline by an individual depicted in the [child pornography](/usc/18/2256.md?p=8) as a [minor](/usc/18/2256.md?p=1), or a representative of such individual, NCMEC shall minimize access to the [child pornography](/usc/18/2256.md?p=8) and ensure the appropriate deletion of the [child pornography](/usc/18/2256.md?p=8), as set forth in section 2258D.
  - (4) **Definition.—** For purposes of this subsection, the term “representative”, with respect to an individual depicted in [child pornography](/usc/18/2256.md?p=8)—
    - (A) means—
      - (i) the parent or legal guardian of the individual, if the individual is under 18 years of age;
      - (ii) the legal guardian or other [person](/usc/18/229F.md?p=5) appointed by a court to represent the individual;
      - (iii) a legal representative retained by the individual;
      - (iv) a representative of the estate of the individual; or
      - (v) a [person](/usc/18/229F.md?p=5) who is a mandated reporter under [section 226(a)(1)](/usc/18/226.md?p=a-1) of the Victims of Child Abuse Act of 1990 ([34 U.S.C. 20341(a)(1)](/usc/34/20341.md?p=a-1)); and
    - (B) does not include a [person](/usc/18/229F.md?p=5) who engaged in any activity which constitutes a violation of section 2251.

## Footnotes

[^1]: So in original. Probably should be “section”.

## Source credit

(Added Pub. L. 110–401, title V, § 501(a), Oct. 13, 2008, 122 Stat. 4248; amended Pub. L. 115–395, § 3, Dec. 21, 2018, 132 Stat. 5292; Pub. L. 118–59, § 2(a), May 7, 2024, 138 Stat. 1014.)

## Notes

### Editorial Notes

### Amendments

2024—Pub. L. 118–59, § 2(a)(1), substituted “the reporting, storage, and handling of certain visual depictions of apparent child pornography to the National Center for Missing & Exploited Children” for “providers or domain name registrars” in section catchline.

Subsec. (b). Pub. L. 118–59, § 2(a)(2)(A), inserted “or charge” after “a claim” in introductory provisions.

Subsec. (b)(2)(C). Pub. L. 118–59, § 2(a)(2)(B), struck out “this section,” after “or function under”.

Subsecs. (d), (e). Pub. L. 118–59, § 2(a)(3), added subsecs. (d) and (e).

2018—Pub. L. 115–395, § 3(1), substituted “providers, or domain name registrars” for “electronic communication service providers, remote computing service providers, or domain name registrar” in section catchline.

Subsec. (a). Pub. L. 115–395, § 3(2), substituted “a provider” for “an electronic communication service provider, a remote computing service provider,” and substituted “such provider” for “such electronic communication service provider, remote computing service provider,” in two places.

Subsec. (b). Pub. L. 115–395, § 3(3), substituted “provider” for “electronic communication service provider, remote computing service provider,” in two places in introductory provisions.

Subsec. (c). Pub. L. 115–395, § 3(4), substituted “A provider” for “An electronic communication service provider, a remote computing service provider,” in introductory provisions and “visual depiction” for “image” wherever appearing in pars. (1) and (2).

### Statutory Notes and Related Subsidiaries

### Applicability

Pub. L. 118–59, § 2(b), May 7, 2024, 138 Stat. 1016, provided that: “The amendments made by subsection (a) [amending this section] shall apply with respect to a civil claim or criminal charge that is filed on or after the date of enactment of this Act [May 7, 2024].”