Semester Project / Fall 2026

Apple’s CSAM Detection Technology

Protecting children while protecting privacy

Erika Hernandez INFA 702 · Data Privacy Professor Quentin Covert

Use arrow keys, space, or scroll

Presentation Map

The investigation

01

Context

CSAM and Apple’s proposal

02

Technology

NeuralHash and safety vouchers

03

Privacy analysis

Harms and principles

04

Legal context

Federal, state, and international law

05

The debate

Arguments for and against

06

Outcome

Delay, abandonment, and replacement

07

Findings

Recommendations and lessons

08

Conclusion

The lasting privacy question

Introduction

What is CSAM?

Child Sexual Abuse Material includes photos, videos, livestreams, and AI-generated images that show or represent the sexual abuse or exploitation of a child.

The term CSAM is used instead of “child pornography” because children cannot legally consent. This material is evidence of abuse, not ordinary adult content.

Source: RAINN, 2026

August 2021

What did Apple propose?

Apple announced a system designed to detect collections of known CSAM connected to iCloud Photos while limiting access to other users’ photos.

Known materialThe system compared images against hashes supplied by child-safety organizations.

Account thresholdApple could review matched images only after an account exceeded a match threshold.

Confirmed reportsApple could disable confirmed accounts and report them to NCMEC.

Sources: Apple, 2021; Clayton, 2021

System Design

How would the technology work?

Fingerprint

NeuralHash creates a digital fingerprint before a photo uploads to iCloud Photos.

Compare

The fingerprint is compared with an unreadable database of known CSAM hashes.

Voucher

An encrypted safety voucher uploads with the image.

Threshold

Apple cannot review matches until the account passes a match threshold.

Review

Apple manually reviews results and reports confirmed matches to NCMEC.

Sources: Apple, 2021; Clayton, 2021

Potential Benefits

Why Apple believed the system could help

DETECTION

Known collections

Identify accounts storing collections of previously identified CSAM in iCloud Photos.

VICTIM IMPACT

Reduce repeated harm

Limit the continued storage and distribution of material that repeatedly harms victims.

REPORTING

Confirmed cases

Report confirmed accounts to the National Center for Missing and Exploited Children.

PRIVACY

Limit access

Protect nonmatching photos by limiting what Apple could learn about them.

ACCURACY

Multiple matches

Require an account threshold instead of reporting a single match.

OVERSIGHT

Human review

Require manual confirmation before reporting an account.

Sources: Apple, 2021; Clayton, 2021; RAINN, 2026

Solove’s Taxonomy

Privacy harms: collection and processing

SurveillanceThe system would scan images on a person’s device before uploading them to iCloud Photos.

IdentificationA matched image could eventually connect to a specific Apple account and individual.

Secondary useTechnology created for known CSAM could potentially expand to other prohibited content.

InsecurityAttackers or other parties could attempt to manipulate or misuse the scanning system or hash database.

Sources: Apple, 2021; Electronic Frontier Foundation, 2021; Solove, 2006

Solove’s Taxonomy

Privacy harms: dissemination and invasion

DisclosureApple could share information connected to confirmed matches with NCMEC.

ExclusionUsers would have limited knowledge of or control over how the system made its decisions.

IntrusionScanning private photos on a personal device could feel like an invasion of private space.

DistortionA false match could incorrectly make an innocent user appear to possess illegal material.

Sources: Apple, 2021; Electronic Frontier Foundation, 2021; Solove, 2006

OECD Privacy Principles

Principles that could reduce the risks

Collection limitationProcess only the minimum information needed to detect known CSAM.

Data qualityMaintain an accurate, regularly updated hash database to reduce false matches.

Purpose and use limitationLimit the system to known CSAM and prevent expansion to political speech or other content.

Security safeguardsProtect hashes, safety vouchers, and review information from access or manipulation.

Openness and participationExplain the process and provide a clear way to challenge an incorrect match.

AccountabilityDocument decisions, conduct audits, and allow independent oversight.

Sources: Apple, 2021; OECD, 2013

Legal Context

Applicable laws

18 U.S.C. § 2258ARequires online providers to report apparent CSAM after obtaining actual knowledge, but does not require proactive scanning.

Stored Communications ActRegulates government access to stored communications and account records held by providers.

CCPA / CPRAProvides California residents rights involving the collection, use, retention, and disclosure of personal information.

GDPRWould require a lawful basis, transparency, data minimization, security, and privacy-risk assessment in Europe.

Fourth AmendmentIts application would depend on whether Apple acted independently or at the government’s direction.

Sources: 18 U.S.C. §§ 2258A and 2703; CCPA/CPRA; GDPR, 2016

The Debate

Arguments for and against Apple’s proposal

Could identify accounts containing collections of known CSAM.
Could reduce continued storage and distribution.
Used digital hashes instead of routine employee review.
Required multiple matches before review.
Included human confirmation before reporting.
Could help prevent victims from being repeatedly harmed.

Created a scanning system on personal devices.
Could expand to search for other content.
Could face pressure for surveillance or censorship.
False matches could trigger investigations.
Gave users limited control or knowledge.
Could weaken trust in Apple’s privacy promises.

Sources: Apple, 2021; Clayton, 2021; Electronic Frontier Foundation, 2021

Proposal Timeline

What happened to Apple’s proposal?

August 2021

Announced

Apple introduced its plan to detect known CSAM connected to iCloud Photos.

September 2021

Delayed

Apple delayed the release after criticism from privacy advocates, security researchers, and civil-rights organizations.

December 2022

Abandoned

Apple confirmed that it had abandoned the proposed iCloud Photos detection system and focused on Communication Safety instead.

Sources: Apple, 2026; Newman, 2022

The Central Privacy Question

Safety and privacy must coexist

Can companies protect children without creating technology that could weaken everyone’s privacy?

Sources: Apple, 2021; Electronic Frontier Foundation, 2021

Research Findings

Recommendations and findings

The goal mattered

Apple sought to protect children and limit the spread of known CSAM.

The design created new risks

Scanning personal devices raised privacy, security, and trust concerns.

Expansion remained possible

A system created for one purpose could later search for other content.

Public criticism shaped development

Apple’s decision shows that privacy concerns can influence technology design.

Continue Communication SafetyUse warnings that support users without automatically reporting them.

Require safeguardsInclude transparency, independent testing, data minimization, and appeals.

Include outside expertiseInvolve child-safety experts, privacy professionals, security researchers, and users before release.

Protect both goalsChild protection should not require technology that weakens everyone’s privacy.

Sources: Apple, 2026; Newman, 2022

Conclusion

Good intentions do not remove future risks

Apple’s proposal attempted to protect children and identify known illegal material, but it also raised concerns about device scanning, false matches, government pressure, and expansion to other content.

Technology can be designed with good intentions, but companies must also consider how that technology could be used in the future.

Sources: Apple, 2026; Newman, 2022

Presentation Complete