Sex Offender Online Identifier Reporting Requirements

Federal sex offender online identifier reporting requirements cover every email address, social media username, screen name, messaging handle, and phone number a registrant uses for internet or phone-based communication, and any change must be reported in person to the registration jurisdiction within three business days. The Keeping the Internet Devoid of Sexual Predators Act of 2008 added internet identifiers to the Sex Offender Registration and Notification Act (SORNA), and the Attorney General was given authority to define what has to be disclosed.¹ Federal regulations have since broadened the category to “remote communication identifiers,” which pulls phone numbers used for texting and app-based messaging in alongside traditional online usernames.²

What Counts as a Reportable Identifier

The statute defines “internet identifiers” as email addresses and other designations a person uses to identify themselves or route communication online.¹ The language is deliberately broad. In practice, it reaches social media usernames on platforms like Facebook, Instagram, and X; screen names on messaging apps and gaming networks; handles on forums and message boards; and any email address used for personal or professional purposes.

Under 28 CFR § 72.6(b), registrants must also provide all “remote communication identifiers,” meaning any designation used for self-identification or routing in internet or phone-based communication, which the regulation specifies includes telephone numbers.² A cell number used for texting or an app-based messenger is reportable on the same footing as a Twitter handle.

Public and private accounts are both covered. A username visible on an open comment section triggers the same obligation as an account used for encrypted messaging or a closed group. If an account allows any form of communication with another person, it falls within the requirement. Shopping or cloud-storage accounts can also qualify when they include a messaging or social feature.

Work, School, and Professional Accounts

The federal regulations do not carve out an exception for employer-issued email. If you use a work email for internet communication, it qualifies as a remote communication identifier and has to be disclosed.³ School-issued email addresses and university portal logins work the same way when those credentials let you send or receive messages.

Professional networking accounts, including LinkedIn, are not named in the regulations, but they fit the definition of a designation used for self-identification in internet communication. The safer approach is to report any account that lets you send or receive messages, regardless of whether you consider it personal.

Because federal SORNA and state registration rules sometimes diverge, keep records of what your local registration office instructs you to submit and what they decline to accept. If a state agency tells you they don’t collect a certain identifier, document the interaction. That paper trail can matter if a federal prosecution later alleges a failure to report something the state office refused to process.

The Three-Business-Day Deadline

SORNA requires registrants to appear in person within three business days of any change to their name, residence, employment, or student status.⁴ For online identifiers, the regulations impose the same three-business-day deadline: any change to your remote communication identifier information must be reported to your registration jurisdiction within three business days, by whatever method the jurisdiction allows.²

The clock starts whenever you create a new email address, change a social media handle, open an account on a new platform, or close an account previously on file. The rule covers “any change,” which reaches deactivations even though the regulatory text doesn’t use the word “deletion.”

This is where most compliance problems start. Registrants who stay current on their periodic verification visits sometimes forget that signing up for a throwaway email or a new app midway through the cycle starts a separate three-day clock. A running log of every new account, username change, and account closure, with the date each one happened, is the most reliable protection.

Periodic In-Person Verification

Separate from the three-day update rule, registrants must appear in person at set intervals to verify that all registry information is still accurate. The frequency depends on tier classification:⁵⁶

Tier I: once per year for 15 years.
Tier II: every six months for 25 years.
Tier III: every three months for life.

At each visit you confirm that every identifier on file is still current. If a change was already reported within three business days, you’re simply confirming the update. If something slipped, the verification visit is the chance to correct it.

Preparing to Disclose and Submitting Updates

Before your appointment, log into every account you use and write down the exact username or email address, including special characters, numbers, and capitalization. Spelling matters. An identifier recorded as “jdoe_99” when the actual handle is “jDoe_99” creates a discrepancy that can surface in an audit.

Gather linked information too: the recovery email tied to each account, phone numbers used for two-factor authentication, and the date you created or last accessed each account. Some jurisdictions want creation dates; others focus only on whether the account is active. If you’ve closed an account since your last reporting period, note the date it was closed, because deleted accounts still have to be addressed so the registry reflects that the identifier is no longer in use.

Official disclosure forms are usually available at the local sheriff’s office or the state police department handling your registration, and some jurisdictions post them online for download. Most forms have separate fields for each identifier type, so listing every account individually in advance saves time at the window.

Most jurisdictions require in-person submission for both initial registration and updates. Some now offer secure online portals that generate an electronic timestamp. Whether you file in person or online, ask for a signed confirmation or printed receipt. That document is your proof that you met the three-business-day deadline, and it is the best defense if a dispute later arises about whether you reported a change on time. Keep a personal copy of everything you submit.

What the Public Can and Can’t See

Reported internet identifiers are shielded from public registry websites. The statute directs the Attorney General to exempt internet identifier information from the publicly accessible portions of sex offender registries.¹ The SMART Office identifies internet identifiers as one of five categories jurisdictions are prohibited from posting on public registry sites, alongside the victim’s identity, the registrant’s Social Security number, arrests that did not result in conviction, and passport or immigration document numbers.⁷

A member of the public searching the registry will not see your email addresses, social media usernames, or phone numbers. The restriction applies only to the public-facing registry. Law enforcement agencies can share reported identifiers with other agencies, schools, public housing authorities, and social service organizations, and the records are subject to the federal Privacy Act, which limits how government agencies use and disclose personally identifiable information.¹ In practice, assume any identifier you report is visible to law enforcement officers investigating online activity.

Federal SORNA does not require you to turn over account passwords. A small number of states require password disclosure under their own statutes, which operate on top of the federal baseline rather than as part of it.

Penalties for Failing to Report

Knowingly failing to register or update a registration under SORNA is a federal crime. The maximum penalty is 10 years in federal prison, a fine, or both, with no mandatory minimum for a straightforward failure to register.⁸ If the person also commits a violent crime while failing to register, the mandatory minimum rises to five years and the maximum to 30 years, served consecutively with any other sentence.

The federal statute applies when the person is required to register under SORNA and either has a federal or military conviction or has traveled in interstate or foreign commerce. State-level penalties for failing to update vary and often carry felony charges as well. Missing the three-business-day window for an online identifier is treated the same as failing to report a change of address. The fact that the change involved only a username, rather than a physical move, does not reduce the legal exposure.

Related Rules That Are Not the Same Thing

Two neighboring rules get confused with the identifier reporting requirement, and the distinction matters.

First, computer monitoring. Registrants on federal supervised release can be ordered to install monitoring software on all approved devices and to report every device, internet service provider, and social media account to a probation officer.⁹ These conditions are set by the sentencing court and apply only during supervised release. SORNA registration applies to all registrants regardless of supervision status.

Second, platform access. In Packingham v. North Carolina, the U.S. Supreme Court ruled in 2017 that state laws categorically banning sex offenders from social media violate the First Amendment, which prevents states from criminalizing the mere act of holding a social media account. Private companies, which are not bound by the First Amendment, set their own policies. Meta removes Facebook and Instagram accounts belonging to people convicted of sex offenses. LinkedIn and Snapchat don’t impose outright bans but reserve the right to terminate accounts for predatory behavior or terms-of-service violations. The reporting obligation is unaffected by any of this: if you create an account you are not technically permitted to hold, you still must report the identifier, and if a platform removes an account on file, that deletion starts a new three-business-day clock.

1
Office of the Law Revision Counsel. 34 U.S.C. 20916 – Direction to the Attorney General
2
eCFR. 28 CFR Part 72 – Sex Offender Registration and Notification
3
Federal Register. Registration Requirements Under the Sex Offender Registration and Notification Act
4
Office of the Law Revision Counsel. 34 U.S.C. 20913 – Registry Requirements for Sex Offenders
5
SMART Office. SORNA In Person Registration Requirements
6
Office of the Law Revision Counsel. 34 U.S.C. 20915 – Duration of Registration Requirement
7
SMART Office. Frequently Asked Questions
8
Office of the Law Revision Counsel. 18 U.S.C. 2250 – Failure to Register
9
United States Courts. Chapter 3 – Cybercrime-Related Conditions of Probation and Supervised Release