republic-os/legal/us/code/title-18/chapter-110/section-2258b.md

type, title, description, jurisdiction, corpus, kind, title_number, title_name, chapter_number, chapter_name, section, citation, status, release_point, release_date, source, source_url, source_identifier, source_file, source_hash, raw_snapshot_hash, text_hash, retrieved_at, confidence, tags

type	title	description	jurisdiction	corpus	kind	title_number	title_name	chapter_number	chapter_name	section	citation	status	release_point	release_date	source	source_url	source_identifier	source_file	source_hash	raw_snapshot_hash	text_hash	retrieved_at	confidence	tags
LegalText	18 U.S.C. § 2258B	Limited liability for the reporting, storage, and handling of certain visual depictions of apparent child pornography to the National Center for Missing & Exploited Children	us	united_states_code	code_section	18	CRIMES AND CRIMINAL PROCEDURE	110	SEXUAL EXPLOITATION AND OTHER ABUSE OF CHILDREN	2258B	18 U.S.C. § 2258B	current	119-100	2026-06-26	official	https://uscode.house.gov/download/releasepoints/us/pl/119/100/xml_usc18@119-100.zip	/us/usc/t18/s2258B	data/legal/raw/us/code/title-18/usc18.xml	cec4e3ffebd73764d189d49fd8122d8abb63ad7b77774e610f36206ce4309c37	1a1bbbbdb59e376ada4eb7ad1056fd68d396679ee7ab59f0561af15006122708	860f6a1914db0d81d4f1bc65aaca5d89b0031e25278015503a95bdadc9fd1ea1	2026-07-04	official	legal us-code

18 U.S.C. § 2258B - Limited liability for the reporting, storage, and handling of certain visual depictions of apparent child pornography to the National Center for Missing & Exploited Children

Text

(a) In General.— Except as provided in subsection (b), a civil claim or criminal charge against a provider or domain name registrar, including any director, officer, employee, or agent of such provider or domain name registrar arising from the performance of the reporting or preservation responsibilities of such provider or domain name registrar under this section, section 2258A, or section 2258C may not be brought in any Federal or State court.

(b) Intentional, Reckless, or Other Misconduct.— Subsection (a) shall not apply to a claim or charge if the provider or domain name registrar, or a director, officer, employee, or agent of that provider or domain name registrar—

(1) engaged in intentional misconduct; or

(2) acted, or failed to act—

(A) with actual malice;

(B) with reckless disregard to a substantial risk of causing physical injury without legal justification; or

(C) for a purpose unrelated to the performance of any responsibility or function under sections 11 So in original. Probably should be “section”. 2258A, 2258C, 2702, or 2703.

(c) Minimizing Access.— A provider and domain name registrar shall—

(1) minimize the number of employees that are provided access to any visual depiction provided under section 2258A or 2258C; and

(2) ensure that any such visual depiction is permanently destroyed, upon a request from a law enforcement agency to destroy the visual depiction.

(d) Limited Liability for NCMEC-Contracted Vendors.— (1) In general.— Except as provided in paragraph (2), a civil claim or criminal charge may not be brought in any Federal or State court against a vendor contractually retained and designated by NCMEC to support the duties of NCMEC under section 404(b)(1)(K) of the Juvenile Justice and Delinquency Prevention Act of 1974 (34 U.S.C. 11293(b)(1)(K)).

(2) Intentional, reckless, or other misconduct.— Paragraph (1) shall not apply to a claim or charge if the vendor—

(A) engaged in—

(i) intentional misconduct; or

(ii) negligent conduct; or

(B) acted, or failed to act—

(i) with actual malice;

(ii) with reckless disregard to a substantial risk of causing injury without legal justification; or

(iii) for a purpose unrelated to the performance of any responsibility or function—

(I) set forth in paragraph (1); or

(II) pursuant to sections 1 2258A, 2258C, 2702, or 2703.

(3) Vendor cybersecurity requirements.— With respect to any visual depiction provided pursuant to the duties of NCMEC under section 404(b)(1)(K) of the Juvenile Justice and Delinquency Prevention Act of 1974 (34 U.S.C. 11293(b)(1)(K)) that is stored or transferred by a vendor contractually retained and designated by NCMEC to support such duties of NCMEC, a vendor shall—

(A) secure such visual depiction in a manner that is consistent with the most recent version of the Cybersecurity Framework developed by the National Institute of Standards and Technology, or any successor thereto;

(B) minimize the number of employees that may be able to obtain access to such visual depiction;

(C) employ end-to-end encryption for data storage and transfer functions, or an equivalent technological standard;

(D) undergo an independent annual cybersecurity audit to determine whether such visual depiction is secured as required under subparagraph (A); and

(E) promptly address all issues identified by an audit described in subparagraph (D).

(e) Limited Liability for Reporting Apparent Child Pornography by an Individual Depicted in the Child Pornography as a Minor, or a Representative of Such Individual.— (1) In general.— Except as provided in paragraph (2), a civil claim or criminal charge may not be brought in any Federal or State court against an individual depicted in child pornography as a minor, or a representative of such individual, arising from a report to the NCMEC CyberTipline by the individual, or the representative of such individual, of information that relates to the child pornography in which the individual is depicted as a minor, including a copy of the child pornography.

(2) Intentional, reckless, or other misconduct.— Paragraph (1) shall not apply to a claim or charge if the individual, or the representative of such individual—

(A) engaged in—

(i) intentional misconduct;

(ii) negligent conduct; or

(iii) any activity which constitutes a violation of section 2251; or

(B) acted, or failed to act—

(i) with actual malice; or

(ii) with reckless disregard to a substantial risk of causing injury without legal justification.

(3) Minimizing access.— With respect to any child pornography reported to the NCMEC CyberTipline by an individual depicted in the child pornography as a minor, or a representative of such individual, NCMEC shall minimize access to the child pornography and ensure the appropriate deletion of the child pornography, as set forth in section 2258D.

(4) Definition.— For purposes of this subsection, the term “representative”, with respect to an individual depicted in child pornography—

(A) means—

(i) the parent or legal guardian of the individual, if the individual is under 18 years of age;

(ii) the legal guardian or other person appointed by a court to represent the individual;

(iii) a legal representative retained by the individual;

(iv) a representative of the estate of the individual; or

(v) a person who is a mandated reporter under section 226(a)(1) of the Victims of Child Abuse Act of 1990 (34 U.S.C. 20341(a)(1)); and

(B) does not include a person who engaged in any activity which constitutes a violation of section 2251.

(Added Pub. L. 110–401, title V, § 501(a), Oct. 13, 2008, 122 Stat. 4248; amended Pub. L. 115–395, § 3, Dec. 21, 2018, 132 Stat. 5292; Pub. L. 118–59, § 2(a), May 7, 2024, 138 Stat. 1014.)

Notes

Editorial Notes

Amendments2024—Pub. L. 118–59, § 2(a)(1), substituted “the reporting, storage, and handling of certain visual depictions of apparent child pornography to the National Center for Missing & Exploited Children” for “providers or domain name registrars” in section catchline. Subsec. (b). Pub. L. 118–59, § 2(a)(2)(A), inserted “or charge” after “a claim” in introductory provisions. Subsec. (b)(2)(C). Pub. L. 118–59, § 2(a)(2)(B), struck out “this section,” after “or function under”. Subsecs. (d), (e). Pub. L. 118–59, § 2(a)(3), added subsecs. (d) and (e). 2018—Pub. L. 115–395, § 3(1), substituted “providers, or domain name registrars” for “electronic communication service providers, remote computing service providers, or domain name registrar” in section catchline. Subsec. (a). Pub. L. 115–395, § 3(2), substituted “a provider” for “an electronic communication service provider, a remote computing service provider,” and substituted “such provider” for “such electronic communication service provider, remote computing service provider,” in two places. Subsec. (b). Pub. L. 115–395, § 3(3), substituted “provider” for “electronic communication service provider, remote computing service provider,” in two places in introductory provisions. Subsec. (c). Pub. L. 115–395, § 3(4), substituted “A provider” for “An electronic communication service provider, a remote computing service provider,” in introductory provisions and “visual depiction” for “image” wherever appearing in pars. (1) and (2).

Statutory Notes and Related Subsidiaries

ApplicabilityPub. L. 118–59, § 2(b), May 7, 2024, 138 Stat. 1016, provided that: “The amendments made by subsection (a) [amending this section] shall apply with respect to a civil claim or criminal charge that is filed on or after the date of enactment of this Act [May 7, 2024].”