[118th Congress Public Law 59]
[From the U.S. Government Publishing Office]



[[Page 1013]]

                      REVISING EXISTING PROCEDURES
                     ON REPORTING VIA TECHNOLOGY ACT

[[Page 138 STAT. 1014]]

Public Law 118-59
118th Congress

                                 An Act


 
 To amend title 18, United States Code, to strengthen reporting to the 
   CyberTipline related to online sexual exploitation of children, to 
modernize liabilities for such reports, to preserve the contents of such 
 reports for 1 year, and for other purposes. <<NOTE: May 7, 2024 -  [S. 
                                 474]>> 

    Be it enacted by the Senate and House of Representatives of the 
United States of America in Congress assembled, <<NOTE: Revising 
Existing Procedures On Reporting via Technology Act.>> 
SECTION <<NOTE: 18 USC 1 note.>>  1. SHORT TITLE.

    This Act may be cited as the ``Revising Existing Procedures On 
Reporting via Technology Act'' or the ``REPORT Act''.
SEC. 2. LIMITED LIABILITY MODERNIZATION.

    (a) Amendments.--Section 2258B of title 18, United States Code, is 
amended--
            (1) in the section heading, by striking ``providers or 
        domain name registrars'' and inserting ``the reporting, storage, 
        and handling of certain visual depictions of apparent child 
        pornography to the National Center for Missing & Exploited 
        Children'';
            (2) in subsection (b)--
                    (A) in the matter preceding paragraph (1), by 
                inserting ``or charge'' after ``a claim''; and
                    (B) in paragraph (2)(C), by striking ``this 
                section,''; and
            (3) by adding at the end the following:

    ``(d) Limited Liability for NCMEC-Contracted Vendors.--
            ``(1) In general.--Except as provided in paragraph (2), a 
        civil claim or criminal charge may not be brought in any Federal 
        or State court against a vendor contractually retained and 
        designated by NCMEC to support the duties of NCMEC under section 
        404(b)(1)(K) of the Juvenile Justice and Delinquency Prevention 
        Act of 1974 (34 U.S.C. 11293(b)(1)(K)).
            ``(2) Intentional, reckless, or other misconduct.--Paragraph 
        (1) shall not apply to a claim or charge if the vendor--
                    ``(A) engaged in--
                          ``(i) intentional misconduct; or
                          ``(ii) negligent conduct; or
                    ``(B) acted, or failed to act--
                          ``(i) with actual malice;
                          ``(ii) with reckless disregard to a 
                      substantial risk of causing injury without legal 
                      justification; or
                          ``(iii) for a purpose unrelated to the 
                      performance of any responsibility or function--
                                    ``(I) set forth in paragraph (1); or

[[Page 138 STAT. 1015]]

                                    ``(II) pursuant to sections 2258A, 
                                2258C, 2702, or 2703.
            ``(3) Vendor cybersecurity requirements.--With respect to 
        any visual depiction provided pursuant to the duties of NCMEC 
        under section 404(b)(1)(K) of the Juvenile Justice and 
        Delinquency Prevention Act of 1974 (34 U.S.C. 11293(b)(1)(K)) 
        that is stored or transferred by a vendor contractually retained 
        and designated by NCMEC to support such duties of NCMEC, a 
        vendor shall--
                    ``(A) secure such visual depiction in a manner that 
                is consistent with the most recent version of the 
                Cybersecurity Framework developed by the National 
                Institute of Standards and Technology, or any successor 
                thereto;
                    ``(B) minimize the number of employees that may be 
                able to obtain access to such visual depiction;
                    ``(C) employ end-to-end encryption for data storage 
                and transfer functions, or an equivalent technological 
                standard;
                    ``(D) undergo an independent annual cybersecurity 
                audit to determine whether such visual depiction is 
                secured as required under subparagraph (A); and
                    ``(E) promptly address all issues identified by an 
                audit described in subparagraph (D).

    ``(e) Limited Liability for Reporting Apparent Child Pornography by 
an Individual Depicted in the Child Pornography as a Minor, or a 
Representative of Such Individual.--
            ``(1) In general.--Except as provided in paragraph (2), a 
        civil claim or criminal charge may not be brought in any Federal 
        or State court against an individual depicted in child 
        pornography as a minor, or a representative of such individual, 
        arising from a report to the NCMEC CyberTipline by the 
        individual, or the representative of such individual, of 
        information that relates to the child pornography in which the 
        individual is depicted as a minor, including a copy of the child 
        pornography.
            ``(2) Intentional, reckless, or other misconduct.--Paragraph 
        (1) shall not apply to a claim or charge if the individual, or 
        the representative of such individual--
                    ``(A) engaged in--
                          ``(i) intentional misconduct;
                          ``(ii) negligent conduct; or
                          ``(iii) any activity which constitutes a 
                      violation of section 2251; or
                    ``(B) acted, or failed to act--
                          ``(i) with actual malice; or
                          ``(ii) with reckless disregard to a 
                      substantial risk of causing injury without legal 
                      justification.
            ``(3) Minimizing access.--With respect to any child 
        pornography reported to the NCMEC CyberTipline by an individual 
        depicted in the child pornography as a minor, or a 
        representative of such individual, NCMEC shall minimize access 
        to the child pornography and ensure the appropriate deletion of 
        the child pornography, as set forth in section 2258D.
            ``(4) Definition.--For purposes of this subsection, the term 
        `representative', with respect to an individual depicted in 
        child pornography--
                    ``(A) means--

[[Page 138 STAT. 1016]]

                          ``(i) the parent or legal guardian of the 
                      individual, if the individual is under 18 years of 
                      age;
                          ``(ii) the legal guardian or other person 
                      appointed by a court to represent the individual;
                          ``(iii) a legal representative retained by the 
                      individual;
                          ``(iv) a representative of the estate of the 
                      individual; or
                          ``(v) a person who is a mandated reporter 
                      under section 226(a)(1) of the Victims of Child 
                      Abuse Act of 1990 (34 U.S.C. 20341(a)(1)); and
                    ``(B) does not include a person who engaged in any 
                activity which constitutes a violation of section 
                2251.''.

    (b) <<NOTE: 18 USC 2258B note.>>  Applicability.--The amendments 
made by subsection (a) shall apply with respect to a civil claim or 
criminal charge that is filed on or after the date of enactment of this 
Act.

    (c) Table of Sections Amendment.--The table of sections for chapter 
110 of title 18, United States Code, <<NOTE: 18 USC prec. 2251.>>  is 
amended by striking the item relating to section 2258B and inserting the 
following:

``2258B. Limited liability for the reporting, storage, and handling of 
           certain visual depictions of apparent child pornography to 
           the National Center for Missing & Exploited Children.''.

SEC. 3. PRESERVATION OF REPORTS TO CYBERTIPLINE RELATED TO ONLINE 
                    SEXUAL EXPLOITATION OF CHILDREN.

    Section 2258A(h) of title 18, United States Code, is amended--
            (1) in paragraph (1), by striking ``90 days'' and inserting 
        ``1 year''; and
            (2) by adding at the end the following:
            ``(5) <<NOTE: Time period.>>  Extension of preservation.--A 
        provider of a report to the CyberTipline under subsection (a)(1) 
        may voluntarily preserve the contents provided in the report 
        (including any comingled content described in paragraph (2)) for 
        longer than 1 year after the submission to the CyberTipline for 
        the purpose of reducing the proliferation of online child sexual 
        exploitation or preventing the online sexual exploitation of 
        children.
            ``(6) Method of preservation. <<NOTE: Deadline.>> --Not 
        later than 1 year after the date of enactment of this paragraph, 
        a provider of a report to the CyberTipline under subsection 
        (a)(1) shall preserve materials under this subsection in a 
        manner that is consistent with the most recent version of the 
        Cybersecurity Framework developed by the National Institute of 
        Standards and Technology, or any successor thereto.''.
SEC. 4. STRENGTHENING OF DUTY TO REPORT APPARENT VIOLATIONS TO 
                    CYBERTIPLINE RELATED TO ONLINE EXPLOITATION OF 
                    CHILDREN.

    (a) Amendments.--Section 2258A of title 18, United States Code, is 
amended--
            (1) in subsection (a)(2)(A), by inserting ``, of section 
        1591 (if the violation involves a minor), or of 2422(b)'' after 
        ``child pornography''; and
            (2) in subsection (e)--
                    (A) in paragraph (1), by striking ``$150,000'' and 
                inserting ``$850,000 in the case of a provider with not 
                less than 100,000,000 monthly active users or $600,000

[[Page 138 STAT. 1017]]

                in the case of a provider with less than 100,000,000 
                monthly active users''; and
                    (B) in paragraph (2), by striking ``$300,000'' and 
                inserting ``$1,000,000 in the case of a provider with 
                not less than 100,000,000 monthly active users or 
                $850,000 in the case of a provider with less than 
                100,000,000 monthly active users''.

    (b) <<NOTE: Deadline. 18 USC 2258A note.>>  Guidelines.--Not later 
than 180 days after the date of enactment of this Act, the National 
Center for Missing & Exploited Children may issue guidelines, as 
appropriate, to providers required or permitted to take actions 
described in section 2258A(a)(1)(B) of title 18, United States Code, on 
the relevant identifiers for content that may indicate sex trafficking 
of children, as described in section 1591 of that title, or enticement, 
as described in section 2422(b) of that title.

    Approved May 7, 2024.

LEGISLATIVE HISTORY--S. 474:
---------------------------------------------------------------------------

CONGRESSIONAL RECORD:
                                                        Vol. 169 (2023):
                                    Dec. 14, considered and passed 
                                        Senate.
                                                        Vol. 170 (2024):
                                    Apr. 29, considered and passed 
                                        House.

                                  <all>