Does Dropbox scan my files?

Yes. Dropbox's own Terms of Service say so in one sentence: "To provide these and other features, Dropbox accesses, stores, and scans Your Stuff." The Terms attach that sentence to features such as search, previews and OCR, and do not say what the scanning looks for. For child sexual abuse material (CSAM), Dropbox's safety page describes hash-matching plus a classifier, and its transparency page counts 14,810 reports to NCMEC in the second half of 2025. For viruses and malware, and for copyright, the pages this archive captured do not describe a file-scanning programme: the words "malware" and "virus" do not appear in the Terms, and the DMCA policy describes acting on claims that are reported to Dropbox.

In its Terms of Service (Terms effective 7 January 2025; Dropbox has announced replacement terms from 1 January 2027, which this archive has not captured), Dropbox writes: "Our Services also provide you with features like commenting, sharing, searching, image thumbnails, document previews, optical character recognition (OCR), easy sorting and organization, and personalization to help reduce busywork. To provide these and other features, Dropbox accesses, stores, and scans Your Stuff. You give us permission to do those things, and this permission extends to our affiliates and trusted third parties we work with." So at the Terms level, the answer to "does Dropbox scan my photos or documents" is yes, in connection with features. The sentence does not say what a scan looks for, what is kept from it, or which "trusted third parties" it reaches. The rest of this page separates the specific kinds of inspection that Dropbox's other captured pages do and do not describe.

Child sexual abuse material is the one category where Dropbox publishes a detection method. Its safety page says: "Dropbox uses industry-standard image and video hash-matching technology to proactively detect known CSAM. This includes leveraging PhotoDNA and Google’s YouTube CSAI Match," along with hash lists from the National Center for Missing and Exploited Children (NCMEC) and the Internet Watch Foundation (IWF). It adds: "We’ve also developed an internal set of hashes made up of material that our reviewers have previously confirmed is CSAM." On where the matching is applied: "We apply this hash-matching technology to content where it most often appears, including when it is added to Dropbox or is shared. For content that may be on the platform already, we may also investigate when we have an indication that a user is interacting with known CSAM." And for material no hash list contains yet: "In addition to hash-matching technology, we also deploy a classifier to detect unhashed CSAM, such as novel or newly created content." The hash-matching it describes is for images and video.

What happens on a match is stated on Dropbox's AUP enforcement transparency page: "When we become aware of instances of apparent CSAM, we disable the account and make a report to the National Center for Missing and Exploited Children (NCMEC), in accordance with applicable law." For July to December 2025 the same page reports 14,810 CyberTip reports to NCMEC and 14,076 distinct accounts disabled and, on the appeals side, 1,280 appeals with a 1.72% reinstatement rate. That rate cannot by itself show whether detection is accurate or the appeal process is weak. The page's own description of its tools is short: "Dropbox uses a variety of tools, including industry-standard automated detection technology, and human review to find potentially violating content and action it as appropriate." This archive's /content-enforcement tracker lays these figures out beside NCMEC's own per-company totals for 2019 to 2025.

How Dropbox describes review of those reports is worth reading closely. The safety page says: "Our highly trained and dedicated safety team reviews flagged content. As part of our commitment to maintain the highest standards of accuracy in our reports, all content that is reported to NCMEC has been reviewed by our team. This includes automated reporting processes that are based on content that our team has previously reviewed and confirmed to be reportable CSAM." The second of those sentences is what "reviewed by our team" is stated to cover: it includes automated reporting that rests on content the team reviewed earlier. The captured pages give no count of how many reports follow each route and no accuracy or error-rate figure; "the highest standards of accuracy" is a stated commitment, not a published measurement.

Viruses and malware are an absence finding. In this archive's captured copy of Dropbox's Terms of Service, and in its captured Privacy Policy, the words "malware" and "virus" do not appear. The Acceptable Use Policy uses "virus" once, as conduct users must not engage in ("for example by sending a virus"), which is a rule about what users send, not a statement that Dropbox scans stored files for viruses. Two general sentences in the captured pages bear on this without naming malware. The Terms say: "Dropbox may review your conduct and content for compliance with these Terms and our Acceptable Use Policy." The Privacy Policy says: "We deploy automated technologies to detect abusive behavior and content that may harm our Services, you, or other users." Neither sentence names a detection method or says which files or content types are examined. Several help-centre addresses the archive tried (including help.dropbox.com/en_US/security/malware-virus-scanning) returned not-found pages, and the archive found no captured Dropbox page claiming it scans files for malware. A different help-centre page, "How to protect yourself from phishing and viruses" (help.dropbox.com/security/phishing-virus-protection), describes no proactive scanning either: it tells users to "Use anti-virus or other security tools to protect your devices", and says that if abuse is reported to [email protected], "if we find a violation of the Dropbox Acceptable Use Policy (such as phishing, malware, or spam), we’ll take immediate action" — action on what it finds or is told about, not a described scan of everything stored. Read this as what Dropbox’s published pages do and do not claim, not as proof that no malware checking happens.

Copyright is different: the DMCA policy describes acting on reports. Dropbox's DMCA Policy says: "Dropbox will respond expeditiously to claims of copyright infringement committed using the Dropbox service and/or the Dropbox website (the “Site”) if such claims are reported to Dropbox’s Designated Copyright Agent identified in the sample notice below." The Acceptable Use Policy separately lists content that "infringes the intellectual property rights of others" among the content users may not store, publish or share. The second absence finding: the words "hash" and "fingerprint" do not appear in the captured DMCA policy, so this archive found no first-party statement there that Dropbox proactively matches files for copyright. This archive's separate entry on a 2014 episode (/issues/2014-dmca-hash-matching-private-files) records press reports, and a Dropbox explanation, that when a file was shared by public link its hash was compared against hashes of files that had previously been the subject of takedown notices, and that this applied to shared files rather than private folders. That is a 2014 account; the current DMCA policy does not describe it.

AI is a separate question. For whether Dropbox uses your files to train AI models, see /questions/does-dropbox-use-my-files-to-train-ai; the "scans Your Stuff" sentence above is not the answer to that question.

What Dropbox does not publish about detection in general: the Acceptable Use Policy lists prohibited content, including child sexually exploitative material, extreme acts of violence or terrorist activity, and content that infringes intellectual property, and it reserves the right to act on violations. The Terms and Privacy Policy sentences quoted above on reviewing content and deploying automated technologies name no method, and the captured pages give no split between automated and manual detection and no accuracy figure. For what happens after an account is disabled, see /questions/why-is-my-dropbox-account-disabled. For the wider picture on CSAM enforcement, see /issues/csam-hash-matching-content-scanning-surveillance-vector and the /content-enforcement tracker.