S-3023 — Safe Cloud Storage Act

YourVoice.Now Summary

Corporate BenefitsCivil LibertiesCriminal Justice & Due ProcessTransparency & Accountability

Cloud firms paid to store child abuse evidence for police could not be sued, unless they were careless.

Corporate Benefits

Lawsuit protection for hired cloud firms — covers contracted storage work only

A cloud company hired to store this evidence could not be sued or charged for that work. Today, a firm that holds such files can face legal risk for just having them.

Cloud firms' shield from lawsuits — careless or intentional harm is excluded

The shield would not hold if the firm was careless, or meant to do harm. So a person hurt by a mishandled file could still take the firm to court.

Civil Liberties

Encryption required for child abuse evidence — both stored and sent

The firm would have to lock the files with strong encryption. That covers files being stored and files being sent.

Limits on viewing stored abuse images — vendor logs each staff viewer

As few workers as possible could open these files, and the firm would log each one. They could look only if the agency agrees, and only to do tech or forensic work.

U.S.-only storage for child abuse evidence — agencies may approve exceptions

The files would have to sit on servers in the United States. The hiring agency could send them abroad if a case needs it, with no court review.

Scope covers intimate images of minors — including AI-made fakes

The rules would cover fake images made by AI, so long as they show a real, named child. Those files would get the same security rules — and the same legal shield for the firm.

Criminal Justice & Due Process

Required keeping time for this evidence — through the sentence and appeals

Agencies would follow the FBI's rules for handling case data. Where no keeping rule applies, they would hold this material at least through the sentence and any later review, with no end date set.

Evidence protection if a contract ends — vendor must preserve until transfer

If an agency stopped paying or quit the deal, the firm would have 30 days to tell federal or state prosecutors. It would guard the files until another agency stepped in.

Transparency & Accountability

Justice Department notice of these contracts — due within 30 days

The firm would have to write to the Justice Department within 30 days of signing. The letter would not be public, but it would show who holds this material.

Yearly outside security audit of vendors — problems must be fixed promptly

An outside auditor would test the firm's security once a year. The firm would fix what the audit finds, but no one else has to see the results.

More about this bill

You would likely notice no change in your own cloud storage or daily life. The change would cover only images and videos that police already hold as evidence in child abuse cases. That includes fake images made by AI, if they show a real child who can be identified. A police agency or prosecutor could hire an outside cloud company to store that evidence. A hired company could not be sued or charged just for holding the material. That protection would fall away if the company was careless or acted outside its contract. In exchange, the company would have to encrypt the files. The files would also have to stay on U.S. servers. Only a small, listed group of workers could open them. An outside auditor would check the company's security every year. Police would still have to keep the evidence as long as the case and the sentence last.

Congressional Summary

Safe Cloud Storage Act This bill limits the civil and criminal liability of vendors that contract with law enforcement agencies to provide digital storage services (e.g., remote or cloud-based storage) for storing, maintaining, and processing child sexual abuse material (CSAM) in investigations of online child sexual exploitation. Under current law, the National Center for Missing & Exploited Children (NCMEC) receives reports of online child sexual exploitation via its CyberTipline, evaluates and prioritizes the reports, and refers the reports to law enforcement agencies to investigate. Currently, federal law limits the liability of vendors that contract directly with the NCMEC to store and transfer CSAM. However, federal law does not limit the liability of vendors that contract with law enforcement agencies to assist in investigations. This bill establishes liability protections for vendors that contract with federal, state, and local law enforcement agencies to store, maintain, and process CSAM in investigations of online child sexual exploitation. Specifically, the bill prohibits a civil claim or criminal charge in federal or state court against such a vendor, so long as the vendor has not engaged in intentional misconduct or negligent conduct, acted with malice or reckless disregard, or acted for a purpose unrelated to its contractual duties. The bill requires vendors to comply with cybersecurity requirements for CSAM that is stored, maintained, or processed. The bill also requires vendors to comply with storage requirements for CSAM that is retained as evidence.

Legislative Subjects

Civil actions and liabilityComputer security and identity theftComputers and information technologyDomestic violence and child abuseEvidence and witnessesLaw enforcement administration and fundingPornographyPublic contracts and procurementSex offenses

Details

Congress: 119th
Chamber: Senate
Status: summarized
Action: Passed Senate
Action Date: 2026-05-20
Date Added: 2026-09-19
Source: Congress.gov →

Like reading a bill in plain English?

We're building an app that does this for every bill in Congress and lets you tell your reps how you want them to vote. We're a small team getting ready to launch, and we're trying to show investors that real people want this. Be one of them. Help us get it built. Leave your email and we'll tell you the moment the app is ready.