A small clarification. v2 adds a new reporting requirement for large online service providers, mandating a description of efforts to allow for independent verification of their child safety measures and data. The bill's core provisions remain unchanged.
STOP CSAM Act of 2025
- Sponsor
- Sen. Hawley, Josh [R-MO]
- Committees
- Judiciary Committee (primary)
- Last action
- Jun 26, 2025
Bottom line
This bill aims to enhance victim support and hold tech companies more accountable for online child sexual exploitation by expanding legal definitions, mandating reporting, and creating new avenues for civil and criminal liability, with significant implications for platform operations and Section 230.
What it actually does
The STOP CSAM Act of 2025 significantly expands legal protections and remedies for child victims of sexual exploitation. It broadens definitions of abuse and exploitation in federal court, mandates restitution for more offenses, and authorizes funding for victim support. Crucially, it imposes new reporting and transparency obligations on tech companies, creates new criminal and civil liabilities for platforms that host child pornography or facilitate exploitation, and modifies Section 230 immunity for these specific offenses, while also introducing defenses related to encryption.
Proponents argue
Supporters argue the bill is a critical step to combat the pervasive issue of online child sexual exploitation by closing legal loopholes and compelling tech companies to take more responsibility. They contend that current laws and Section 230 immunity have allowed platforms to avoid accountability, and that stronger reporting requirements, civil remedies, and direct liability are necessary to protect children and support victims. The bill's provisions for victim support and restitution are also highlighted as essential.
Opponents contend
Critics, particularly from the tech industry and civil liberties groups, express concerns that certain provisions, especially those related to new liabilities and the modification of Section 230, could inadvertently harm free speech, stifle innovation, or force companies to implement surveillance measures that compromise user privacy and security, particularly regarding end-to-end encryption. They also raise concerns about the potential for over-reporting or misidentification, and the practical challenges of compliance for smaller platforms.
The bill is dense with legal amendments and new provisions, requiring a significant time investment to understand its full scope and implications, especially for those unfamiliar with Title 18 or Section 230.
Sec. 2(a)(1) amending 18 U.S.C. 3509(a)
Expansion of Definitions for Child Exploitation and Abuse
This provision broadens the legal definitions of "exploitation" to explicitly include child pornography, child sex trafficking, and obscene visual depictions of a child. It also expands "psychological abuse" to cover patterns of degrading acts, isolation, and coercive tactics. These changes ensure a wider range of harmful acts against children fall under federal protection.
Supporters argue
Supporters argue these expanded definitions are crucial for modernizing child protection laws to address the evolving nature of online exploitation and ensure comprehensive legal recourse for victims.
Critics contend
No specific opposition is typically raised against strengthening definitions of child exploitation.
Tradeoffs
Broadening definitions can ensure more comprehensive protection but also requires careful application to avoid unintended overreach.
Sec. 2(a)(3)(C) amending 18 U.S.C. 3509(d)(3)
Presumption of Detriment for Public Disclosure of Protected Information
This provision creates a legal presumption that public disclosure of a "covered person's protected information" (including personally identifiable information, medical, and educational records) would be detrimental to the victim. Courts must deny requests for public disclosure unless the requesting party demonstrates a compelling public interest that substantially outweighs the harm to the victim, and no alternative exists.
Sec. 3(3)(A) amending 18 U.S.C. 2259(a) and Sec. 3(6) adding 18 U.S.C. 3664(q)
Mandatory Restitution and Fiduciary Appointment for Child Victims
This provision makes restitution mandatory for offenses involving identifiable minors in visual depictions (1466A) and other child exploitation crimes. It also allows courts to appoint a trustee or fiduciary to manage restitution payments for child victims (under 18), incapacitated victims, or foreign citizens, ensuring funds are administered in their best interest.
Sec. 4(a)(1)(A) amending 18 U.S.C. 2258A(a) and (b)
Enhanced CyberTipline Reporting Requirements for Tech Providers
This provision mandates that online service providers report "apparent child pornography" or "facts or circumstances indicating an apparent, planned, or imminent violation" of child exploitation laws to the NCMEC CyberTipline within 60 days of obtaining actual knowledge. Reports must include specific user identification data, terms of service, copies of publicly available content, and flags for AI-generated content.
Sec. 4(a)(1)(C) amending 18 U.S.C. 2258A(e) and Sec. 4(a)(6) adding 18 U.S.C. 2260B
Penalties for Reporting Failures and Direct Liability for Hosting Child Pornography
This section establishes significant criminal and civil penalties for providers who knowingly fail to report child exploitation to the CyberTipline or fail to preserve material as required. It also creates a new criminal offense (18 U.S.C. 2260B) for interactive computer service providers who intentionally host/store child pornography or knowingly promote/facilitate exploitation, with fines up to $5 million for severe cases.
Sec. 4(a)(1)(G) adding 18 U.S.C. 2258A(i)
Annual Transparency Reports from Tech Companies
Large tech providers (over 1 million monthly users and $50 million revenue) must submit annual reports to the Attorney General and FTC detailing their CyberTipline data, other abuse reporting mechanisms, child safety policies, "culture of safety" measures (tools, efficacy, independent verification efforts), "safety by design" processes for new products, and information on prevalence/trends of child exploitation on their services. These reports will be published with necessary redactions.
Sec. 5(c)(1) adding 18 U.S.C. 2255A(e) and (a)
New Civil Action Against Platforms and Limitation on Section 230 Immunity
This provision creates a new civil right of action (18 U.S.C. 2255A) allowing victims to sue interactive computer service providers and app stores for intentional, knowing, or reckless promotion/aiding/abetting of child exploitation, or for hosting/storing child pornography. Crucially, it explicitly states that Section 230 of the Communications Act of 1934 (which generally protects platforms from liability for user-generated content) shall not limit claims brought under this new section.
Sec. 5(c)(1) adding 18 U.S.C. 2255A(g) and (h)
Encryption Protections and Defenses for Platforms
This provision clarifies that utilizing end-to-end encryption or not possessing decryption information cannot be an independent basis for liability under the new civil action. However, evidence of these actions can be admissible to prove intent or rebut claims. It also establishes defenses for platforms accused of knowing/reckless hosting of child pornography if they removed content within 48 hours (or 2 business days for small platforms), made good faith efforts, or if removal was technologically impossible without compromising encryption.
This provision explicitly states that nothing in the reporting requirements shall be construed to require a provider to "affirmatively search, screen, or scan" for facts/circumstances of exploitation, optional report information, or apparent child pornography.
Section 4(a)(1)(D) amending 18 U.S.C. 2258A(f)(3)
Why it matters:This is standard legislative practice to clarify the scope of new obligations and prevent misinterpretation, particularly for a sensitive area like content moderation. It aims to address concerns about platforms being forced into proactive, universal surveillance.
Case for: Proponents argue this protects user privacy by preventing a mandate for constant, intrusive scanning of all user content, which could have broad implications for free speech and security. It focuses on responding to "actual knowledge" rather than requiring constant surveillance.
Case against: Critics might argue that this exemption undermines the bill's goal of combating online exploitation, as it allows platforms to remain willfully ignorant of harmful content until it is reported, rather than proactively identifying it.
Estimated impact: Significantly limits the proactive obligations of tech companies, potentially reducing the volume of self-generated reports of exploitation, but also protecting user privacy.
Defines "publicly available" as a visual depiction that "can be viewed by or is accessible to all users of the service, regardless of the steps, if any, a user must take to create an account or to gain access to the service."
Section 4(a)(4)(D) adding 18 U.S.C. 2258E(9)
Why it matters:This is standard legislative practice for defining terms used throughout a chapter. However, its specific wording has significant implications for what content is considered "publicly available" for reporting purposes.
Case for: Proponents argue this broad definition ensures that content accessible to a wide audience, even behind a login, is subject to reporting requirements, preventing platforms from claiming content isn't "public" if it's merely behind a basic account wall.
Case against: Some platforms might argue this definition is too broad, potentially encompassing content that is not truly "public" in the common sense, and could lead to over-reporting or misclassification of content.
Estimated impact: Expands the scope of content considered "publicly available" for reporting, potentially increasing the volume of reports related to content behind basic logins.
Requires large tech providers, in their annual reports, to describe "efforts undertaken by the provider, to the extent appropriate, to allow for independent verification of the information provided pursuant to this subparagraph and of the efficacy of the measures, tools, and technologies" related to child safety.
Section 4(a)(1)(G) adding 18 U.S.C. 2258A(i)(1)(D)(vii)
Why it matters:This specific requirement for independent verification is a subtle but powerful mechanism for accountability, potentially pushing platforms towards greater transparency and external auditing of their safety claims. Its placement might reflect a compromise or a detail added to strengthen oversight without making it a headline provision.
Case for: Supporters argue this is crucial for ensuring the accuracy and reliability of the self-reported safety data from tech companies, allowing for external scrutiny and building public trust.
Case against: Tech companies might view this as an additional burden and a potential intrusion into proprietary safety tools and data, raising concerns about intellectual property and competitive disadvantage. The "to the extent appropriate" language offers some flexibility.
Estimated impact: Could lead to increased external auditing and research into platform safety measures, enhancing accountability and potentially driving more effective safety innovations.