Twitter CSAM: Lawsuits, Thorn Exit, and Regulatory Action

Child sexual abuse material on Twitter, now X, has been the subject of a Supreme Court-adjacent civil lawsuit, deep cuts to the company’s safety staff under Elon Musk, repeated findings by researchers that exploitative content circulates on the platform in volume, and enforcement action by Congress, Australia, the European Union, and a county prosecutor in Pennsylvania. The legal picture is mixed: courts have largely shielded the company from civil liability under Section 230, while regulators abroad have begun imposing fines.

The Doe Lawsuit and What It Decided

The central U.S. case began in 2021, when two plaintiffs identified as John Doe #1 and John Doe #2 sued Twitter in the Northern District of California. They alleged that at 13 they had been manipulated into producing sexually explicit videos of themselves, which were later posted on the platform. The complaint said the material gathered more than 167,000 views and 2,223 retweets, and that Twitter refused to remove it despite requests from the victims and law enforcement. The content was taken down nine days after reporting, following intervention by a Department of Homeland Security agent.¹

The suit brought 13 claims, including violations of the Trafficking Victims Protection Reauthorization Act, negligence, and invasion of privacy. In August 2021, U.S. Magistrate Judge Joseph Spero denied Twitter’s motion to dismiss the sex trafficking claim, finding it plausible that Twitter had monetized the content through advertising and had engaged in a tacit agreement with perpetrators by failing to act on multiple reports. The court dismissed other claims, including negligence and invasion of privacy, on Section 230 grounds.²

On appeal, the Ninth Circuit went the other way. On May 3, 2023, it affirmed dismissal of the plaintiffs’ claim under 18 U.S.C. § 2252A, the federal statute addressing receipt and distribution of CSAM. The appellate court held that Section 230’s criminal-law carve-out applies only to criminal prosecutions, not to civil actions grounded in those statutes, and treated Twitter’s refusal to remove the material as a protected editorial decision about third-party content.³ The Ninth Circuit denied rehearing on June 9, 2023.⁴

The plaintiffs petitioned the Supreme Court. Filed February 6, 2026, under the name Doe v. X Corp. (No. 25-949), the petition was denied on May 18, 2026, leaving the Ninth Circuit’s immunity ruling in place.⁵ For civil plaintiffs, the decision confirmed that Section 230 remains a durable shield against suits based on a platform’s handling of CSAM.

Safety Team Cuts After Musk’s Acquisition

When Musk closed his purchase of Twitter in October 2022, he said publicly that removing child exploitation content was “Priority #1.”⁶ The staffing picture that followed was starkly different.

Data submitted to Australia’s eSafety Commissioner showed that between October 2022 and May 2023, trust and safety engineers fell from 279 to 55, an 80 percent decrease. Full-time content moderators dropped from 107 to 51. The broader trust and safety team shrank from 4,062 to 2,849 employees.⁷ Bloomberg separately reported a 50 percent cut to the child safety team specifically.⁸ One report described the child safety enforcement team for the Asia Pacific region as consisting of a single person.⁹

On December 12, 2022, Twitter disbanded its Trust and Safety Council, an external advisory body that had included 12 groups working on child sexual exploitation. The company declined to send a representative to the National Center for Missing & Exploited Children’s annual social media roundtable that month,⁶ and has not established a replacement advisory body.⁷ Former trust and safety lead Yoel Roth said the team stopped relying on established policies, with decisions instead being made unilaterally by Musk.⁹

As of September 2024, X had begun posting safety-related job openings and announced plans for a Trust and Safety center in Austin, Texas, intended to house 100 full-time content moderators.¹⁰

What Researchers Are Finding on the Platform Now

An NBC News investigation updated in June 2025 documented hundreds of posts per hour advertising CSAM on X, with some automated accounts posting several times per minute. The accounts used pornography-related hashtags as aggregation points and the Communities feature to reach groups with tens of thousands of members, directing buyers to Telegram or Discord. The Canadian Centre for Child Protection identified accounts posting images of victims as young as seven and thumbnail previews depicting the sexual assault of children as young as four. Of 23 hashtags NBC analyzed, only two were blocked. C3P’s Lloyd Richardson described X’s response as “woefully insufficient.”¹¹

An August 2025 report from Alliance4Europe documented a coordinated network of at least 150 accounts sharing CSAM over four days in July 2025. Researchers said the operation began around May 2025 and used apparently automated new accounts to amplify content through comments and reposts, with external sales pages tied in one case to a Bitcoin wallet that collected $660 across 23 transactions. The operation “continued largely undisturbed” despite removal efforts.¹²

NCMEC data shows that X was among a group of platforms, alongside Google, Discord, Microsoft, and Synchronoss, that collectively submitted 20 percent fewer CyberTipline reports in 2024 than in 2023.¹³

Thorn Ended Its Partnership Over Unpaid Invoices

In May 2024, X publicly touted a partnership with Thorn, the nonprofit that builds specialized CSAM detection technology, to test a text-based detection tool. By June 2025, Thorn had terminated the contract, citing X’s consistent failure to pay invoices. Thorn’s head of communications, Cassie Coccaro, said the decision came after “months and months of outreach, flexibility, and trying to make it work.” Account manager Pailes Halai said the nonprofit could not continue absorbing the costs. Thorn representatives said it remained unclear whether X had ever fully implemented the tools tested during the partnership. X said it was developing its own internal technology, including “additional CSAM hash matching efforts.”¹¹

Congressional Scrutiny and New Federal Law

The Senate Judiciary Committee has conducted sustained oversight. In December 2022, Chair Dick Durbin wrote to Musk about the gap between his public statements and the staffing cuts; no written response was received. Durbin followed up in January 2023 by asking Attorney General Merrick Garland to open a Justice Department investigation into child sexual exploitation on the platform.¹⁴

After X’s leadership declined to cooperate voluntarily, the committee issued subpoenas. CEO Linda Yaccarino testified on January 31, 2024, alongside the heads of Meta, TikTok, Snap, and Discord. The committee noted that Yaccarino had accepted service only after U.S. Marshals were dispatched.¹⁵ At the hearing, Yaccarino endorsed the STOP CSAM Act and the Kids Online Safety Act, becoming the first major tech executive to do so.¹⁶

The oversight work has produced legislation. President Biden signed the REPORT Act on May 8, 2024. It requires platforms to report child sex trafficking and enticement of minors to NCMEC’s CyberTipline, extends the data preservation period from 90 days to one year, and raises penalties for knowingly failing to report, with maximums of $850,000 for initial violations and $1 million for subsequent violations by platforms with more than 100 million monthly active users.¹⁷ The STOP CSAM Act was re-introduced in June 2025 as S. 1829; it would create criminal and civil liability for platforms that intentionally, knowingly, or recklessly host or facilitate CSAM, with a new exception to Section 230 immunity. The Electronic Frontier Foundation has argued the bill’s definitions of “promoting” and “facilitating” could penalize platforms that offer end-to-end encryption.¹⁸ The Senate passed the Project Safe Childhood Act in October 2023.¹⁴

Regulatory Action Abroad

Australia

In February 2023, Australia’s eSafety Commissioner issued a transparency notice requiring Twitter to disclose how it handles CSAM. X failed to respond. The Commissioner initiated civil action in December 2023, and X refused to pay an initial AUD $610,500 penalty.⁷ On July 31, 2025, the Full Federal Court rejected X Corp.’s appeal, ruling that a corporate restructuring did not exempt the company from compliance obligations under the Online Safety Act.¹⁹ On May 21, 2026, the Federal Court imposed a penalty of AUD 650,000 for X’s failure to adequately respond to the reporting notice.²⁰

European Union

The European Commission opened formal proceedings against X under the Digital Services Act in December 2023.²¹ On December 5, 2025, the Commission issued its first DSA non-compliance decision, fining X €120 million for breaches related to the “blue checkmark” verification system, advertising transparency, and researcher data access.²² In January 2026, the Commission opened an additional investigation into X’s AI chatbot, Grok, examining whether X properly assessed and mitigated systemic risks, including the dissemination of illegal content such as manipulated sexually explicit images and potential child sexual abuse material. Other DSA investigations into X remain ongoing.

The Bucks County Lawsuit

In June 2026, the Bucks County, Pennsylvania, District Attorney’s Office became the first district attorney in the country to sue X Corp. in federal court, filing an amended complaint in the Northern District of California. The suit, which also names Roblox, Discord, and Meta, alleges that X lacks effective reporting structures and child safety precautions. The complaint cites internal X Corp. assessments from 2022 concluding that the platform could not accurately detect child sexual exploitation at scale. It also targets Grok, citing a late-2025 estimate that the chatbot generated nonconsensual sexual images, including images of children, at a rate of roughly one per minute over a 24-hour period. At least one individual in Bucks County has been charged with using Grok to create AI-generated child pornography.²³

1
vLex. Doe v. Twitter, Inc., 555 F. Supp. 3d 889
2
Courthouse News Service. Judge Rules Twitter Can Be Sued for Failing to Take Down Child Porn Videos
3
U.S. Supreme Court. Application for Extension of Time, Doe v. Twitter, Inc.
4
Law360. John Doe #1, et al v. Twitter, Inc.
5
SCOTUSblog. Doe v. X Corp.
6
NBC News. Elon Musk Says He Can Stop Child Exploitation on Twitter
7
Forbes. Elon Musk Fired 80 Per Cent of Twitter X Engineers Working on Trust and Safety
8
U.S. Senate. Durbin Pushes Elon Musk on Twitter’s Efforts to Eradicate Online Child Sexual Exploitation
9
Tech Policy Press. What’s Going on With Twitter’s Trust and Safety Policy
10
TechCrunch. X Is Hiring Staff for Security and Safety After Two Years of Layoffs
11
NBC News. X Accounts Peddle Child Abuse as Thorn Cuts Ties
12
Euronews. Researchers Warn of Coordinated Network to Amplify Child Sexual Abuse Content on X
13
NCMEC. CyberTipline Data
14
U.S. Senate Judiciary Committee. Protecting Children Online
15
U.S. Senate Judiciary Committee. Recap: Senate Judiciary Committee Presses Big Tech CEOs
16
The Guardian. TikTok, Meta, X Congress Hearing on Child Sexual Exploitation
17
U.S. Senate. Sen. Ossoff’s Bipartisan Bill to Protect Children From Online Exploitation Signed Into Law
18
Electronic Frontier Foundation. Oppose STOP CSAM
19
eSafety Commissioner. Full Federal Court Rejects X Corp Appeal
20
Digital Policy Alert. Federal Court Ruling on X Corp v eSafety Commissioner
21
European Parliamentary Research Service. Enforcing the Digital Services Act: State of Play
22
eucrim. Overview of Latest Developments Under the Digital Services Act
23
Crimewatch. Bucks County DA Expands Federal Lawsuit Against Social Media Giants