The CSAM enforcement funnel: 5,113 to 54,045 to 33,043 reports, and what Dropbox does not publish about it

Dropbox reports apparent child sexual abuse material (CSAM) to the National Center for Missing & Exploited Children (NCMEC) as US law requires, and disables the accounts involved. This entry sets out the numbers that are public, the numbers that are not, and what the published figures can and cannot show. It is a critique of transparency and process; it is not a criticism of the legitimacy of child-safety enforcement. How the detection works is covered in the mechanism entry (photodna-csam-scanning-private-files).

Volume. NCMEC publishes a per-company table of CyberTipline reports each year. Dropbox's counts in those tables are 5,113 (2019), 20,928 (2020), 48,371 (2021), 45,992 (2022), 54,045 (2023, the peak), 48,342 (2024) and 33,043 (2025). Between 2019 and the 2023 peak that is a rise of roughly tenfold (54,045 divided by 5,113 is about 10.6, a ratio derived by this archive from the two published figures). From the 2023 peak to 2025 it is a fall of about 39% (derived the same way). No source this archive found explains the decline, and this archive does not guess at a cause. See also the restatement entry (2024-csam-enforcement-figures-restated).

The funnel. For five half-year periods Dropbox's transparency page publishes both enforcement counts and appeals. Listed as CyberTip reports, distinct accounts disabled, appeals received, share of appeals reinstated: July to December 2025 — 14,810, 14,076, 1,280, 1.72%. January to June 2025 — 18,243, 17,523, 1,619, 2.7%. July to December 2024 — 21,418, 20,932, 1,607, 2.8%. January to June 2024 — 26,894, 26,244, 2,099, 3.6%. July to December 2023 — 33,963, 31,474, 2,256, 2.6%. Across July 2023 to December 2025, appeals ranged from 1,280 to 2,256 per half-year and the reinstatement rate from 1.72% to 3.6%.

How many appeal at all. Dividing the appeals received in a half-year by the accounts disabled in the same half-year gives roughly 7% to 9% (for example, 1,280 appeals against 14,076 accounts disabled in July to December 2025 is about 9.1%; 2,256 against 31,474 in July to December 2023 is about 7.2%). This is derived by this archive from the two published figures, not a number Dropbox states, and it is approximate because Dropbox does not say that every appeal concerns an account disabled in the same half-year. On that arithmetic, the great majority of disabled accounts do not appeal at all, and the 1.72% to 3.6% reinstatement rates describe only the minority who do.

The key caveat. Dropbox's safety page says: “[A]ll content that is reported to NCMEC has been reviewed by our team.” The very next sentence says: “This includes automated reporting processes that are based on content that our team has previously reviewed and confirmed to be reportable CSAM.” Read together, and neutrally, this means a human confirmed the material at some earlier point. It does not necessarily mean that a human looked at the files in a particular account before the report on that account was filed.

Detection method, as Dropbox describes it. The safety page says: “In addition to hash-matching technology, we also deploy a classifier to detect unhashed CSAM, such as novel or newly created content.”

What one court record shows. A 2022 federal district court order in Maine (No. 2:21-cr-133), which denied motions to suppress, records that Dropbox submitted a report to NCMEC in December 2018 and says: “A Dropbox employee viewed each of the files included in the report to NCMEC.” That is a court's finding about one report, submitted in 2018, in one case; it does not show current practice or establish what happens across all reports.

What Dropbox does not publish. In the transparency and safety pages this archive reviewed, Dropbox does not state how long a review takes, what the criteria are on appeal, how many disablings are automated, whether any external or independent party reviews its enforcement, or any accuracy or error rate. The safety page refers to “the highest standards of accuracy” but gives no figure.

What the numbers cannot show. A 1.72% reinstatement rate cannot by itself tell anyone whether detection is highly accurate or the appeal process is weak, and nothing public that this archive found distinguishes those two explanations. Nothing in this entry suggests that any particular report or disabling was wrong.

NCMEC's own vocabulary, for context. NCMEC defines an informational report as “one in which the tech company provides insufficient information or where the imagery is considered viral and has been reported many times.” For 2025 it states that it referred more than 18.8 million reports to law enforcement and designated more than 4.5 million reports as informational. That split is industry-wide and is not broken out per company, so it says nothing about Dropbox's own reports.

Independent industry context. The Stanford Internet Observatory report “The Strengths and Weaknesses of the Online Child Safety Ecosystem” (Grossman et al., Stanford Internet Observatory, 22 April 2024) is research about the CyberTipline reporting system as a whole. It is not about Dropbox, and this archive has no equivalent finding specific to Dropbox. On the process of reporting images, the report says that “the occurrence of false positives—instances where non-CSAM images are mistakenly reported as CSAM—is inevitable.” Of perceptual hashing algorithms such as PhotoDNA in general, it says: “While highly accurate, such algorithms can occasionally generate false positives, claiming there is a match when in fact the two images are unique.” Those are statements about the ecosystem, not about any company's reports, and they are not evidence that any Dropbox report or disabling was wrong. The point this archive can defend is narrower: no source this archive found publishes a per-company accuracy or error rate, and the one outcome measure Dropbox does publish, a 1.72% to 3.6% reinstatement rate among the minority of disabled accounts that appeal, cannot distinguish a low error rate from an appeal process that seldom succeeds. Users and the public therefore cannot tell from published figures how accurate the process is.

Balance. A US federal criminal complaint in the Southern District of Ohio (docket 2:26-mj-00568, listed as entered 27 August 2026) is shown by CourtListener's listing as referring to a CyberTipline report from Dropbox, Inc. on 15 July 2026; this archive did not capture the complaint itself. A complaint is an allegation, not a finding; this archive takes no position on the case.