PA Superior Court: Google and Facebook Are Not Government Agents When They Scan User Accounts and Report Internet Contraband to NCMEC

Criminal Defense Lawyer Zak T. Goldstein, Esquire

The Pennsylvania Superior Court has decided the case of Commonwealth v. Thomas, 2026 PA Super 209, holding that Google and Facebook do not act as agents of the government when they scan their users’ accounts for child sexual abuse material and report what they find to the National Center for Missing and Exploited Children (NCMEC). The defendant argued that federal law, which requires the companies to report this material and fines them if they do not, makes them instruments of law enforcement, so their warrantless searches of his accounts violated the Fourth Amendment and Article I, Section 8 of the Pennsylvania Constitution. The Court rejected the argument in a published opinion. But the holding rests on a thin record, and the Court left the harder questions open.

The Facts of Thomas

In May 2023, Facebook and Google sent three CyberTipline reports to NCMEC stating that files had been uploaded through Facebook Messenger and to Google Photos. NCMEC forwarded the reports to the Pennsylvania State Police. A State Police corporal viewed the images, subpoenaed Verizon and Google for the subscriber behind the IP address, and obtained a search warrant for the defendant’s home in Fayette County. Police found child sexual abuse material on two of his phones. The defendant moved to suppress, arguing that Google, Facebook, and NCMEC were all acting as agents of law enforcement when they searched his accounts. The trial court denied the motion, a jury convicted him of twenty counts of possession, one count of dissemination, and one count of criminal use of a communication facility, and the court sentenced him to six to twelve years in prison.

The Superior Court’s Decision

The Fourth Amendment and Article I, Section 8 restrain the government, not private parties. Under United States v. Jacobsen, 466 U.S. 109 (1984), and Commonwealth v. Shaffer, 209 A.3d 957 (Pa. 2019), the police may use what a private party finds and turns over so long as they do not exceed the scope of the private search. The doctrine does not apply if the private party was really acting as an agent or instrument of the government, and the answer to that question depends on the degree of the government’s participation in the private party’s activities.

The defendant’s argument rested on 18 U.S.C. § 2258A, which requires providers to report apparent child sexual abuse material to NCMEC and fines them up to $1,000,000 for knowingly failing to do so. The Court held that the statute does not make Google and Facebook government agents because subsection (f) of the same statute says that nothing in it requires a provider to monitor its users or affirmatively search, screen, or scan for the material. Congress required the companies to report what they know and left the decision whether to look entirely to them. The Court then made a critical point: nothing in the record showed that Google and Facebook searched the defendant’s accounts at the government’s urging or through any manipulation or coercion. The Court cited decisions from five federal circuits reaching the same result and followed them.

The Court treated NCMEC differently. It acknowledged that Congress funds NCMEC, requires providers to report to NCMEC rather than to the police, requires NCMEC to forward every report to law enforcement, authorizes NCMEC to receive and distribute material that would be a crime for anyone else to possess, and immunizes NCMEC for doing so. It noted that the Second Circuit in United States v. Guard, 152 F.4th 375 (2d Cir. 2025), and the Tenth Circuit in United States v. Ackerman, 831 F.3d 1292 (10th Cir. 2016), have held that NCMEC is a government agent. The Court did not decide the question because the defendant never argued that NCMEC or the police looked at anything Google and Facebook had not already looked at. Without a scope argument, NCMEC’s status did not matter.

The defendant did win a new trial on the dissemination count, because the Commonwealth proved that charge entirely through the CyberTipline report, which it introduced as a business record through the corporal, and the Court held that an investigating officer who merely receives and relies on NCMEC reports is not a qualified witness who can authenticate them.

The Takeaway

The state actor argument is still open. The Court did not hold that Google and Facebook can never be government agents. It held that this defendant did not prove they were on a record that failed to provide any evidence as to why the companies scan their users’ accounts, how those systems came to exist, or what role law enforcement and NCMEC play in them. The Court said in so many words that the record did not support a finding that the government urged, manipulated, or coerced the searches. That may be an opportunity to build a better record in a future case. A defendant could subpoena the providers and develop testimony about the government’s participation in the design and operation of these scanning programs, where the hash databases the providers match against come from, and what the providers get in return presents a different case. The agency test turns on the degree of government participation, and no one in Thomas presented any evidence of participation to the trial court, so there was nothing to support the appeal.

The second open question is what happens when the police look at files that no human at the company ever opened. In Thomas, the Facebook report itself said that NCMEC never viewed the files, and nothing in the opinion says anyone at Facebook viewed them either. A computer flagged them, and the first person to actually open them may have been the trooper. The private search doctrine lets the police look at what a private party already looked at. It does not necessarily let the police look at something a private party's software only flagged. The defendant never made that argument, so the Court did not address it. It has to be raised in the suppression motion and supported with evidence at the hearing because the Superior Court will not consider it for the first time on appeal.

Facing Criminal Charges? We Can Help.

Goldstein Mehta LLC Criminal Defense

If you are facing criminal charges or under investigation by the police, we can help. We have successfully defended thousands of clients in jury trials, bench trials, preliminary hearings, and appeals in state and federal court. We have won cases involving the most serious charges, including first-degree murder, and we have obtained new trials and sentencing relief for our clients through direct appeals and PCRA petitions. We offer a free criminal defense strategy session to anyone who is facing charges or who may be under investigation. Call 267-225-2545 to speak with an experienced and understanding defense attorney today.