STOP CSAM Act of 2025

If you run a website, app, or messaging platform, this bill puts you on the hook for how you handle child sexual abuse material (CSAM). Providers would be required to report any known CSAM to the national CyberTipline within 60 days — and large platforms (those with over 1 million monthly users and $50 million in annual revenue) would also have to file detailed annual transparency reports on what they're doing to protect kids. Criminal fines for failing to report range from $600,000 to $1 million per violation depending on platform size, and civil penalties can be tripled if someone is harmed. The bill also creates a new law making it a federal crime for any interactive computer service to intentionally host CSAM or knowingly help facilitate child exploitation, with fines up to $5 million. Survivors gain a powerful new tool: the right to sue platforms and app stores directly for hosting or promoting exploitative material, with $300,000 in minimum damages per case and no statute of limitations — and the bill explicitly says Section 230 immunity cannot be used to block these lawsuits. The bill states that using end-to-end encryption is not by itself grounds for liability, but it does allow encryption choices to be introduced as evidence of intent or motive in court, which civil liberties groups have flagged as a potential pressure point that could discourage platforms from offering strong encryption. Providers are not required to proactively scan users' messages or files, though the broad definition of covered platforms — borrowed from Section 230 — could sweep in smaller websites and open-source projects alongside the tech giants the bill is clearly aimed at.

• Overrides Section 230 and allows encryption choices to be used as evidence of intent, which civil liberties groups say could discourage platforms from offering strong encryption to any user.