S. 474 

One Hundred Eighteenth Congress 

of the 

United States of America 

AT THE SECOND SESSION 

Begun and held at the City of Washington on Wednesday, 

the third day of January, two thousand and twenty four 

An Act 

To amend title 18, United States Code, to strengthen reporting to the CyberTipline 

related to online sexual exploitation of children, to modernize liabilities for such 

reports, to preserve the contents of such reports for 1 year, and for other purposes. 

Be it enacted by the Senate and House of Representatives of 

the United States of America in Congress assembled, 

SECTION 1. SHORT TITLE. 

This Act may be cited as the ‘‘Revising Existing Procedures 

On Reporting via Technology Act’’ or the ‘‘REPORT Act’’. 

SEC. 2. LIMITED LIABILITY MODERNIZATION. 

(a) AMENDMENTS.—Section 2258B of title 18, United States 

Code, is amended— 

(1) in the section heading, by striking ‘‘providers or 

domain name registrars’’ and inserting ‘‘the reporting, 

storage, and handling of certain visual depictions of 

apparent child pornography to the National Center for 

Missing & Exploited Children’’; 

(2) in subsection (b)— 

(A) in the matter preceding paragraph (1), by inserting 

‘‘or charge’’ after ‘‘a claim’’; and 

(B) in paragraph (2)(C), by striking ‘‘this section,’’; 

and 

(3) by adding at the end the following: 

‘‘(d) LIMITED LIABILITY FOR NCMEC-CONTRACTED VENDORS.— ‘‘(1) IN GENERAL.—Except as provided in paragraph (2), 

a civil claim or criminal charge may not be brought in any 

Federal or State court against a vendor contractually retained 

and designated by NCMEC to support the duties of NCMEC 

under section 404(b)(1)(K) of the Juvenile Justice and Delinquency Prevention Act of 1974 (34 U.S.C. 11293(b)(1)(K)). 

‘‘(2) INTENTIONAL, RECKLESS, OR OTHER MISCONDUCT.— 

Paragraph (1) shall not apply to a claim or charge if the 

vendor— 

‘‘(A) engaged in— 

‘‘(i) intentional misconduct; or 

‘‘(ii) negligent conduct; or 

‘‘(B) acted, or failed to act— 

‘‘(i) with actual malice; 

‘‘(ii) with reckless disregard to a substantial risk 

of causing injury without legal justification; or 

‘‘(iii) for a purpose unrelated to the performance 

of any responsibility or function— 

‘‘(I) set forth in paragraph (1); or 
S. 474—2 

‘‘(II) pursuant to sections 2258A, 2258C, 2702, 

or 2703. 

‘‘(3) VENDOR CYBERSECURITY REQUIREMENTS.—With respect 

to any visual depiction provided pursuant to the duties of 

NCMEC under section 404(b)(1)(K) of the Juvenile Justice and 

Delinquency Prevention Act of 1974 (34 U.S.C. 11293(b)(1)(K)) 

that is stored or transferred by a vendor contractually retained 

and designated by NCMEC to support such duties of NCMEC, 

a vendor shall— 

‘‘(A) secure such visual depiction in a manner that 

is consistent with the most recent version of the Cybersecurity Framework developed by the National Institute of 

Standards and Technology, or any successor thereto; 

‘‘(B) minimize the number of employees that may be 

able to obtain access to such visual depiction; 

‘‘(C) employ end-to-end encryption for data storage and 

transfer functions, or an equivalent technological standard; 

‘‘(D) undergo an independent annual cybersecurity 

audit to determine whether such visual depiction is secured 

as required under subparagraph (A); and 

‘‘(E) promptly address all issues identified by an audit 

described in subparagraph (D). 

‘‘(e) LIMITED LIABILITY FOR REPORTING APPARENT CHILD

PORNOGRAPHY BY AN INDIVIDUAL DEPICTED IN THE CHILD PORNOGRAPHY AS A MINOR, OR A REPRESENTATIVE OF SUCH INDIVIDUAL.— 

‘‘(1) IN GENERAL.—Except as provided in paragraph (2), 

a civil claim or criminal charge may not be brought in any 

Federal or State court against an individual depicted in child 

pornography as a minor, or a representative of such individual, 

arising from a report to the NCMEC CyberTipline by the individual, or the representative of such individual, of information 

that relates to the child pornography in which the individual 

is depicted as a minor, including a copy of the child pornography. 

‘‘(2) INTENTIONAL, RECKLESS, OR OTHER MISCONDUCT.— 

Paragraph (1) shall not apply to a claim or charge if the 

individual, or the representative of such individual— 

‘‘(A) engaged in— 

‘‘(i) intentional misconduct; 

‘‘(ii) negligent conduct; or 

‘‘(iii) any activity which constitutes a violation of 

section 2251; or 

‘‘(B) acted, or failed to act— 

‘‘(i) with actual malice; or 

‘‘(ii) with reckless disregard to a substantial risk 

of causing injury without legal justification. 

‘‘(3) MINIMIZING ACCESS.—With respect to any child pornography reported to the NCMEC CyberTipline by an individual 

depicted in the child pornography as a minor, or a representative of such individual, NCMEC shall minimize access to the 

child pornography and ensure the appropriate deletion of the 

child pornography, as set forth in section 2258D. 

‘‘(4) DEFINITION.—For purposes of this subsection, the term 

‘representative’, with respect to an individual depicted in child 

pornography— 

‘‘(A) means— 
S. 474—3 

‘‘(i) the parent or legal guardian of the individual, 

if the individual is under 18 years of age; 

‘‘(ii) the legal guardian or other person appointed 

by a court to represent the individual; 

‘‘(iii) a legal representative retained by the individual; 

‘‘(iv) a representative of the estate of the individual; or 

‘‘(v) a person who is a mandated reporter under 

section 226(a)(1) of the Victims of Child Abuse Act 

of 1990 (34 U.S.C. 20341(a)(1)); and 

‘‘(B) does not include a person who engaged in any 

activity which constitutes a violation of section 2251.’’. 

(b) APPLICABILITY.—The amendments made by subsection (a) 

shall apply with respect to a civil claim or criminal charge that 

is filed on or after the date of enactment of this Act. 

(c) TABLE OF SECTIONS AMENDMENT.—The table of sections 

for chapter 110 of title 18, United States Code, is amended by 

striking the item relating to section 2258B and inserting the following: 

‘‘2258B. Limited liability for the reporting, storage, and handling of certain visual 

depictions of apparent child pornography to the National Center for 

Missing & Exploited Children.’’. 

SEC. 3. PRESERVATION OF REPORTS TO CYBERTIPLINE RELATED TO 

ONLINE SEXUAL EXPLOITATION OF CHILDREN. 

Section 2258A(h) of title 18, United States Code, is amended— 

(1) in paragraph (1), by striking ‘‘90 days’’ and inserting 

‘‘1 year’’; and 

(2) by adding at the end the following: 

‘‘(5) EXTENSION OF PRESERVATION.—A provider of a report 

to the CyberTipline under subsection (a)(1) may voluntarily 

preserve the contents provided in the report (including any 

comingled content described in paragraph (2)) for longer than 

1 year after the submission to the CyberTipline for the purpose 

of reducing the proliferation of online child sexual exploitation 

or preventing the online sexual exploitation of children. 

‘‘(6) METHOD OF PRESERVATION.—Not later than 1 year 

after the date of enactment of this paragraph, a provider of 

a report to the CyberTipline under subsection (a)(1) shall preserve materials under this subsection in a manner that is 

consistent with the most recent version of the Cybersecurity 

Framework developed by the National Institute of Standards 

and Technology, or any successor thereto.’’. 

SEC. 4. STRENGTHENING OF DUTY TO REPORT APPARENT VIOLATIONS 

TO CYBERTIPLINE RELATED TO ONLINE EXPLOITATION OF 

CHILDREN. 

(a) AMENDMENTS.—Section 2258A of title 18, United States 

Code, is amended— 

(1) in subsection (a)(2)(A), by inserting ‘‘, of section 1591 

(if the violation involves a minor), or of 2422(b)’’ after ‘‘child 

pornography’’; and 

(2) in subsection (e)— 

(A) in paragraph (1), by striking ‘‘$150,000’’ and 

inserting ‘‘$850,000 in the case of a provider with not 

less than 100,000,000 monthly active users or $600,000 
S. 474—4 

in the case of a provider with less than 100,000,000 

monthly active users’’; and 

(B) in paragraph (2), by striking ‘‘$300,000’’ and 

inserting ‘‘$1,000,000 in the case of a provider with not 

less than 100,000,000 monthly active users or $850,000 

in the case of a provider with less than 100,000,000 

monthly active users’’. 

(b) GUIDELINES.—Not later than 180 days after the date of 

enactment of this Act, the National Center for Missing & Exploited 

Children may issue guidelines, as appropriate, to providers required 

or permitted to take actions described in section 2258A(a)(1)(B) 

of title 18, United States Code, on the relevant identifiers for 

content that may indicate sex trafficking of children, as described 

in section 1591 of that title, or enticement, as described in section 

2422(b) of that title. 

Speaker of the House of Representatives. 

Vice President of the United States and

President of the Senate.