Who is protected
Children affected by online sexual exploitation, including apparent child sex trafficking, enticement, and child sexual abuse material.
Report suspected online child sexual exploitation
Members of the public can submit information to NCMEC’s CyberTipline. If a child is in immediate danger, contact 911 or local law enforcement first.
What this law does
The REPORT Act amended federal law governing reports by electronic communication service providers to NCMEC’s CyberTipline. It expanded the reporting duty beyond apparent child sexual abuse material to include apparent child sex trafficking and online enticement of children.
The law extends the required preservation period for reported material from 90 days to one year and requires preservation practices consistent with the NIST Cybersecurity Framework. It also modernizes limited-liability protections for qualifying reports and for certain vendors supporting NCMEC.
Congress substantially increased the monetary penalties that may apply when a covered provider knowingly and willfully fails to make a required report.
Key dates
| Date | Milestone |
|---|---|
| February 16, 2023 | S.474 is introduced in the Senate. |
| December 14, 2023 | Senate passes the bill with an amendment by unanimous consent. |
| April 29, 2024 | House passes the bill by voice vote. |
| May 7, 2024 | The Act is signed into law as Public Law 118-59. |
In brief
Who must report
Covered electronic communication and remote computing service providers that obtain actual knowledge of facts or circumstances requiring a CyberTipline report.
What changed
Broader reportable offenses, one-year evidence preservation, cybersecurity requirements, updated liability protections, and substantially higher penalties.
Current federal law: The REPORT Act expands what online service providers must report to the National Center for Missing & Exploited Children, strengthens penalties for reporting failures, and requires reported material to be preserved for one year.
Penalties for a provider’s reporting failure
For a first knowing and willful failure to report, the Act authorizes fines of up to $850,000 for providers with at least 100 million monthly active users and up to $600,000 for smaller providers. For later violations, the respective maximums rise to $1,000,000 and $850,000.