Dropbox restated four half-years of child-safety enforcement figures at once in January 2024 — the worst period had been overstated 6.4×

Dropbox publishes, on its help-centre page "AUP Enforcement," a half-year report on its enforcement against child sexual abuse and exploitation material (CSAM): how many CyberTip reports it submitted to the National Center for Missing and Exploited Children (NCMEC), how many distinct accounts it actioned or disabled, and how many individual pieces of content it actioned. Its safety page says these biannual reports "include the number of submissions we make to NCMEC, the number of accounts and pieces of content we action, and the number of appeals we receive." The reports define the term: "Actioned means we've enforced our policies by disabling access to the account and/or the piece of content."

On each of four half-year entries on that page, the content-actioned figure carries an asterisk and an italic footnote with the same wording: "On January 31, 2024, we updated the number of individual pieces of content actioned for violating our policies against child sexual abuse and exploitation material. Initially, the report stated N individual pieces of content had been actioned. The correct number is M. Other metrics in this report remain unchanged." The four restatements, in Dropbox's own numbers, are: July–December 2022, 975,499 reduced to 151,787 (an overstatement of 6.4×); January–June 2022, 382,261 reduced to 222,647 (1.7×); July–December 2021, 425,847 reduced to 261,769 (1.6×); and January–June 2021, 438,175 reduced to 339,716 (1.3×). Only the July–December 2022 period was anything like six-fold; the other three were between 1.3× and 1.7×. Across the four periods combined, the first-published figures summed to 2,221,782 and the corrected figures sum to 975,919 — a difference of 1,245,863 pieces of content, so the original total was about 2.3× the corrected one. (The sums and ratios are this archive's arithmetic on the figures printed in Dropbox's footnotes.)

The footnote says the other metrics "remain unchanged," and this archive checked what that covers. The CyberTip report counts printed on the page for the four periods are 24,131 (January–June 2021), 24,115 (July–December 2021), 26,730 (January–June 2022) and 19,214 (July–December 2022), and the distinct-account counts are 23,000, 22,799, 25,336 and 17,829. Those were not restated. NCMEC publishes its own per-company tally of CyberTipline reports, and its tables list Dropbox at 48,371 reports for 2021 and 45,992 for 2022. Dropbox's two half-years sum to 48,246 for 2021 and 45,944 for 2022 — within about 0.26% and 0.10% of NCMEC's figures. On the figures this archive could compare, then, the error was in the count of individual files actioned, not in the number of reports Dropbox made to NCMEC; the report counts line up with the recipient's own books.

Timing and disclosure are matters of record on the page itself. The restatement is dated 31 January 2024: 13 months after the most recent affected period (July–December 2022) ended, and about 31 months after the earliest (January–June 2021) ended. It was made as an italic footnote on each affected entry. This archive found no blog post, press release or changelog announcing the correction; it found only the footnotes on the transparency page itself. That is a statement about what the archive searched and found, not a claim about everything Dropbox may have said elsewhere. This archive has not established what caused the original error, which Dropbox's footnotes do not explain.

What the restatement does not show matters as much. It says nothing about whether any report Dropbox made to NCMEC was accurate, and it does not suggest that Dropbox made false reports. It says nothing about whether any account that was disabled was disabled wrongly; the account counts were not changed. Dropbox's own pages say it reports apparent CSAM to NCMEC "in accordance with applicable law." This entry records a correction to one published metric, not a finding of wrongdoing by Dropbox or of innocence on the part of anyone whose account was disabled.

Dropbox's SEC filings are a separate place this archive looked for this programme, and it is not there. A text search of Dropbox's FY2025 Form 10-K and its Q1 and Q2 2026 Form 10-Qs, as captured from EDGAR on 4 October 2026, found no occurrence of "NCMEC," "CSAM," "child sexual," "CyberTip" or "Missing and Exploited" in any of the three. The filings do list "child protection" among the laws Dropbox must comply with, and the same risk-factor paragraph appears in all three: "We are subject to compliance with various laws, including those covering copyright, indecent content, child protection, consumer protection, age verification, and similar matters. There have been instances where improper or illegal content has been stored on our platform without our knowledge. As a service provider operating at scale, we do not comprehensively monitor our platform to evaluate the legality of content stored on it." The two sets of statements are not necessarily inconsistent: Dropbox's help pages describe reporting apparent CSAM to NCMEC, with its own half-year figures summing to about 48,000 reports in 2021 and about 46,000 in 2022, and detecting a hash-matching known material and running a classifier for novel material is not the same thing as comprehensively monitoring everything stored on a platform. The point for this entry is narrower. The enforcement programme, its report volumes and the January 2024 restatement of its published figures do not appear anywhere in the three filings this archive searched; those filings treat content legality as a general compliance risk and state that monitoring is not comprehensive. This archive does not assert that the filings misstate anything, that any disclosure was required, or that any of this is material, and it draws no conclusion of wrongdoing.