Most child sexual abuse material cases in Pennsylvania no longer start with a police investigation. They start with a tech company. Google, Facebook, and other online providers run systems that scan the files their users store and send. When those systems flag an image, the company reports it to the National Center for Missing and Exploited Children, known as NCMEC, through its CyberTipline. NCMEC forwards the report to law enforcement, and the police take it from there.
Defense lawyers have been asking the same question about that process for years. Federal law requires these companies to report what they find, and NCMEC is funded by Congress and required to pass every report to the police. If the government has built the pipeline, is the company that searched your files really a private party? Or is it acting for the government, which would need a warrant to do the same thing?
In Commonwealth v. Thomas, 2026 PA Super 209 (Pa. Super. filed Sept. 21, 2026) (Stabile, J., joined by Lazarus, P.J., and Neuman, J.), the Superior Court answered the question for Google and Facebook: they are private actors. It declined to answer it for NCMEC. And in a separate part of the opinion, it reversed one of the defendant’s convictions because the CyberTipline report itself came in through the wrong witness.
The Private Search Rule
The Fourth Amendment and Article I, Section 8 of the Pennsylvania Constitution protect against unreasonable searches by the government. They do not apply to private people. If a private party opens your package or looks through your files and hands what it finds to the police, the police may generally use it without a warrant. The leading case is United States v. Jacobsen, 466 U.S. 109 (1984), where Federal Express employees opened a damaged package, found white powder, and called the Drug Enforcement Administration. The Supreme Court held that the agents who then looked inside did not conduct a search, because the company had already done so on its own.
The rule has two exceptions. It does not apply if the private party was acting as an agent or instrument of the government when it searched. And it does not apply if the police go beyond what the private party already looked at and discover something new. Whether a private party was acting as the government’s agent depends on how much the government participated, judged by all the circumstances. Cooperating with police is not enough. Neither is the fact that police use what the private party found. Commonwealth v. Price, 672 A.2d 280 (Pa. 1996).
The court noted that Pennsylvania follows federal law on this question, citing Commonwealth v. Shaffer, 209 A.3d 957 (Pa. 2019), so it treated the state and federal constitutional claims as one.
What Happened in Thomas
In May 2023, Facebook and Google sent NCMEC several CyberTipline reports. The Facebook report described eleven files sent through Messenger to another user. The Google reports described files stored in Google Photos, fifty in one report and two in another. According to the reports, NCMEC staff viewed four of the files in one Google report and none of the files in the others.
Pennsylvania State Police Corporal Nathan Brown received the reports, viewed the images, and sent an administrative subpoena to Verizon to identify who was using the IP address listed in the reports. That led him to Clinton Thomas’s home in Fayette County. He got a warrant, seized several phones, and found images on two of them.
Thomas moved to suppress everything. His theory was that Google, Facebook, and NCMEC were all acting as government agents, so their review of his files was a warrantless government search. Everything that followed, including the warrant and the phones, was what the law calls “fruit of the poisonous tree,” meaning evidence that police obtained only because of an earlier illegal search. The trial court denied the motion, and a jury convicted him of twenty counts of possession, one count of dissemination, and one count of criminal use of a communication facility.
Why Google and Facebook Are Private Actors
Thomas relied on the federal reporting statute, 18 U.S.C. § 2258A. It requires a provider that obtains actual knowledge of apparent child sexual abuse material to report it to the CyberTipline, and it sets fines of up to $850,000 for a first knowing and willful failure to report and up to $1,000,000 for later failures. A company that faces penalties for not reporting, Thomas argued, is acting under government compulsion.
The court’s answer came from another subsection of the same statute. Section 2258A(f) says that nothing in the statute requires a provider to monitor its users, monitor the content of their communications, or affirmatively search, screen, or scan for this material. The duty the statute creates is a duty to report what the company already knows. It is not a duty to look.
That distinction decided the issue. The court reasoned that the decision whether and how to search belongs to the companies. They built their own detection systems to police their own platforms, and nothing in the record showed that the government created those systems or urged the companies to search Thomas’s files. The court joined a line of federal appeals courts that have reached the same conclusion about providers, including United States v. Meals, 21 F.4th 903 (5th Cir. 2021), United States v. Miller, 982 F.3d 412 (6th Cir. 2020), United States v. Ringland, 966 F.3d 731 (8th Cir. 2020), and United States v. Rosenow, 50 F.4th 715 (9th Cir. 2022).
The court also distinguished the case Thomas relied on most, Commonwealth v. Baez, 2021 WL 5626366 (Pa. Super. filed Dec. 1, 2021) (unpublished). In Baez, an officer asked the defendant’s friend whether she wanted to check his backpack “for her own protection” before driving off with it, knowing he had a prior gun conviction. She found a gun. The officer had set the search in motion. In Thomas, the searches came from the companies’ own policies, with no prompting from police.
The Question the Court Left Open: NCMEC
NCMEC was a harder question, and the court’s discussion shows why. NCMEC began as a private nonprofit, but Congress now requires the Justice Department’s Office of Juvenile Justice and Delinquency Prevention to give it an annual grant to run the CyberTipline. Providers must report to NCMEC rather than to police. NCMEC must forward those reports to law enforcement. It is authorized by statute to receive and send child sexual abuse material, which would be a crime for anyone else, and it has statutory immunity for performing those functions. The court described this as Congress giving NCMEC “significant law enforcement responsibility.”
The court then declined to decide whether NCMEC is a government agent. It did not need to. Even if NCMEC were a government agent, the private search rule would still allow it and the police to use what Google and Facebook had found, so long as neither went beyond the scope of the companies’ searches. Thomas never argued that they did. In a footnote, the court noted that two federal courts of appeals have held NCMEC is a government agent: United States v. Ackerman, 831 F.3d 1292 (10th Cir. 2016), written by then-Judge Neil Gorsuch, and United States v. Guard, 152 F.4th 375 (2d Cir. 2025).
The CyberTipline Report Was Hearsay
The last part of the opinion is likely to matter at trial more than any of the rest. The Commonwealth introduced a sixteen-page State Police report containing the Facebook CyberTipline report through Corporal Brown under the business records exception to the hearsay rule, Pa.R.E. 803(6). That exception requires a custodian or other qualified witness to testify about how the record was made and kept.
Corporal Brown had received twenty to thirty thousand of these reports and relied on them daily. The court held that was not enough. He did not work for NCMEC, had no firsthand knowledge of how it keeps its records, and knew nothing about Facebook’s. The exhibit also held several layers of hearsay: a police report containing an NCMEC report containing Facebook’s report. Each layer needed its own foundation, through a qualified witness or a certification under Pa.R.E. 902(11) or (13).
The error was harmless for the possession counts and the communication-facility count, because those rested on images found on Thomas’s phones. It was not harmless for dissemination. Corporal Brown admitted at trial that the CyberTipline report was the only evidence Thomas had sent anything to anyone. The court reversed that conviction, ordered a new trial on it, and sent the case back for resentencing on the counts it affirmed. Thomas did not get a discharge on that count because a sufficiency review counts all evidence the jury actually received, including evidence that should have been kept out.
What Thomas Means for Cyber-Tip Cases
For defense lawyers, the government-agent argument against the providers is now foreclosed in Pennsylvania. The argument that remains is the one Thomas did not make: scope. The private search rule protects the government only to the extent it stays within what the private party actually saw. The Ninth Circuit held in United States v. Wilson, 13 F.4th 961 (9th Cir. 2021), that when Google flagged images by automated matching and no Google employee viewed them, an agent who opened the images went beyond the private search. Thomas says the providers use systems that find and flag this material, but the opinion does not say whether anyone at Google or Facebook looked at the flagged files before Corporal Brown did. That is the fact to develop at the suppression hearing, file by file: who at the provider viewed each image, what NCMEC opened, and what police opened before they had a warrant.
The hearsay holding gives the defense a separate objection at trial. If the Commonwealth wants a CyberTipline report in as substantive evidence, it needs a qualified witness or a proper certification for each layer. An investigating officer who uses these reports every day is not that witness. And where the report is the only evidence of a charge, as it was for dissemination here, the objection decides the count.
For anyone who uses cloud storage or messaging apps, the practical point is that the major providers scan what is stored and sent on their platforms, and Pennsylvania courts treat that scanning as a private search. A report from the provider can reach the police without a warrant, and the police can use it to get one.