The CyberTipline duty: what a classifieds operator has to report, and what changed in 2024

The listing a moderator can't just delete

A moderator reviewing the queue opens a listing where something is off: a face that looks younger than the stated age, a phone number that has cycled through ads in three different cities in the same week, an account posting for what looks like several different people at once. The instinct, and the one every moderation workflow is built around, is to act fast: pull the listing, suspend the account, move to the next item in the queue. For almost every category of bad listing, that instinct is correct and the job is done.

This category is different, and the difference is not obvious until someone looks it up. US federal law does not treat this as a content decision the site gets to make on its own. It treats it as the trigger for a specific, mandatory report to a specific federal-designated recipient, with its own preservation duty attached to whatever is being reported. Banning the account and deleting the listing, done reflexively and without more, can accidentally destroy the very thing the law requires the site to keep.

None of this is about the ordinary moderation problem of fake photos or scam listings, which is a business risk an operator manages with judgment and a ban button, covered in what actually stops a fake listing from going live. This is a single, narrow legal duty, created by a specific statute, that exists whether or not the operator has ever heard of it. The point of this piece is to make sure that the first time it comes up is not also the first time anyone at the company reads the law.

It is also a different question from the criminal exposure FOSTA-SESTA created for trafficking-related content: that law decides whether the platform itself can be sued or prosecuted over what a listing says. This duty decides only whether a report reached the right federal address, and it applies no matter how that separate liability question would come out.

The law in question is 18 U.S.C. § 2258A, and a 2024 amendment called the REPORT Act changed enough about it that guidance written before that year is now out of date on the numbers that matter most: what has to be reported, how long the material has to be kept, and what a failure to report can cost.

What the statute actually requires

Section 2258A applies to a "provider" of an electronic communication service or a remote computing service to the public, terms borrowed from older wiretap and stored-communications law. Neither definition mentions company size, revenue, or industry. A service that gives users accounts, lets them upload photos, or lets them message each other is the kind of service those definitions were written to describe, and nothing in the statute carves out a small marketplace just because it is small. Whether every classifieds site meets that definition in every particular has not been tested in court against a business like this one, so treat the question as open rather than settled, and get counsel to look at the specific setup rather than assuming either way.

What triggers the duty is narrow: actual knowledge. The statute states plainly that nothing in it requires a provider to monitor any user, monitor the content of any communication, or affirmatively search, screen, or scan for the facts that would trigger a report. There is no obligation to go looking. The obligation starts the moment someone at the company actually knows, and from that moment the law says the report has to reach the CyberTipline of the National Center for Missing and Exploited Children (NCMEC) "as soon as reasonably possible."

Before 2024, the categories that triggered this duty were narrower than most operators would guess: material that appeared to depict child sexual abuse. Suspected child sex trafficking and suspected online enticement of a minor were not mandatory reporting categories at all, even though both can surface in exactly the kind of account behavior a classifieds site's moderation team is positioned to notice first: a handler running multiple people's ads, a minor being coached into posing as an adult, patterns that look coordinated rather than individual.

That gap is what the REPORT Act closed, and it is the reason a policy written before May 2024 is no longer describing the current law.

What changed with the REPORT Act

President Biden signed the REPORT Act on May 7, 2024. It amended § 2258A on four points that matter directly to how an operator builds a process, not just what the process is called.

First, it added suspected child sex trafficking and suspected online enticement of a minor to the categories a provider must report, alongside apparent child sexual abuse material. This is the change that pulls in more than photographs: a pattern in how listings are being posted and managed can now be a reportable circumstance on its own, separate from whether any individual photo is problematic.

Second, it extended how long a provider has to preserve the material tied to a report, from 90 days to one year. A site that reports something and then deletes the underlying account data a month later, on the theory that the account is banned and the matter is closed, is no longer inside the preservation window the law requires.

Third, it added a security requirement for whatever is being preserved: a provider holding material connected to a CyberTipline report has to secure it in a manner consistent with the current NIST Cybersecurity Framework, with a compliance deadline set at one year after enactment, meaning roughly May 2025. This sits next to the same question an operator already has to answer for the identification documents a verification step collects and has to store securely: preserved report material needs the same kind of deliberate, access-controlled storage, not a folder anyone on staff can open.

Fourth, and the change most likely to get an operator's attention, it raised the fine for a knowing and willful failure to report by a wide margin.

What the penalty is, and what it isn't

Before the REPORT Act, a knowing and willful failure to report carried a civil fine of up to $150,000 for a first violation and up to $300,000 for a repeat one. The new structure ties the ceiling to the provider's size: an initial knowing and willful failure can now be fined up to $600,000 for a provider with fewer than 100 million monthly active users, or up to $850,000 for one at or above that figure. A second or subsequent failure rises to $850,000 or $1,000,000 on the same split. A small classifieds site sits in the lower tier on both counts, and that lower tier alone is still four times the old maximum.

Two things temper how this should be read. It is a civil fine, not a prison sentence attached to this provision, and it only attaches to a failure that is knowing and willful, meaning the company knew and chose not to report, not a case where a report should arguably have been filed and wasn't due to an honest gap in the process. A negligent miss is not what this penalty is built to punish.

The other thing worth knowing, because it changes how urgently to read the number, is that public reporting has not identified a case where the Department of Justice has actually imposed this specific fine against a provider. That absence is not a reason to treat the duty as decorative. Enforcement patterns for reporting statutes like this one tend to shift the moment a case becomes visible enough to make an example of, and a company with no process at all is the one most likely to become that example, because a knowing-and-willful finding is far easier to support against a company that was told about the law and did nothing than against one that had a real process and made a defensible judgment call inside it.

The more immediate risk, in practice, is not the fine. It is what happens to the account and its content in the hours after someone notices something is wrong, before anyone has thought about the reporting duty at all.

The process to have before the first real case

The fix is not a monitoring tool. The statute is explicit that none is required, and building one raises its own privacy and cost problems that this duty does not ask for. The fix is a short, written procedure that exists before the day it is needed, because the day it is needed is the worst possible day to be improvising one.

Name one person, or one clearly defined role, who receives an escalation like this, rather than leaving it to whoever happens to be moderating that day. That person needs the authority to act without waiting for a meeting, because "as soon as reasonably possible" is the legal standard, not "once we discuss it internally."

Write down what the team should not do the moment something looks wrong: do not try to independently verify the person's age through further contact, do not confront the advertiser, do not tip anyone off that the account is under review, and do not delete the account or its content before the report is filed and the material is preserved. Each of those instincts feels protective in the moment and each one can undercut the report or destroy what the law says has to be kept.

Know in advance how a report actually gets filed: NCMEC's CyberTipline accepts reports through a web form built for this purpose, and larger platforms use a reporting API for the same submission. A small operator does not need the API. It needs the person named above to already know the web form exists and what information it asks for, instead of discovering it mid-incident.

Decide, in writing, where preserved material will live for the required year and who can access it, matching the same access-controlled approach the site already owes its identity-verification data. Keep a short log of what was reported and when, not for NCMEC, but so the company can show, if it is ever asked, that its process ran the way it was written to run.

None of this requires new software or a large budget. It requires one written page, one named person, and a decision, made now rather than in the middle of an incident, that a report gets filed and the material gets kept, before anyone touches the delete button.