Trust and Safety Glossary · User-Generated Platforms

15 U.S.C. 6851: the federal civil action, since 1 October 2022, against a person who discloses an intimate visual depiction without consent, with liquidated damages of $150,000 and pseudonymous suits (Intimate Image Abuse).
18 U.S.C. § 2258A: the US statute requiring providers to report apparent child sexual exploitation to NCMEC's CyberTipline as soon as reasonably possible after obtaining actual knowledge, with no duty to scan (Child Safety: Detection & Reporting).
512(c) safe harbor: the DMCA safe harbor for content stored at users' direction, conditional on no knowledge (or expeditious removal), no direct financial benefit where the platform can control the infringement, removal on valid notice and a registered designated agent (The Law of Hosting User Content).
512(f): the DMCA provision making anyone who knowingly materially misrepresents that material is infringing liable for the resulting damages, costs and fees (Copyright at Scale).
512(h) subpoena: a subpoena a copyright owner gets from a federal court clerk, without a judge's review, ordering a platform to identify an alleged infringer (Copyright at Scale).
Abuse contact: the published address for abuse reports: the abuse@ role mailbox from RFC 2142, a login-free web form, and the abuse entries in registration and IP registry records (Abuse Desks for Hosts & Registrars).
Abuse desk: the team and channels through which a host, CDN or registrar receives reports about its customers from people who usually aren't its customers (Abuse Desks for Hosts & Registrars).
Abuse mitigation: one recorded action against one resource, with its layer, target, collateral, reversibility, evidence, customer notice and the deadline given (Abuse Desks for Hosts & Registrars).
Access software provider: in Section 230, software that can filter, screen, allow, disallow, pick, choose, analyze, digest, organize or reorganize content (The Law of Hosting User Content).
Account Creation (OAT-019): OWASP's automated-threat name for bulk account creation, and sometimes profile population, through a site's sign-up process (Spam, Bots & Inauthentic Behavior).
Account farm: an operation that registers accounts in bulk, ages them and builds standing so they can later be used or sold for spam, scams or manipulation (Spam, Bots & Inauthentic Behavior).
Account link: recorded evidence that two accounts share an operator (device, payment instrument, phone, network, behavior), with strength and status; evidence, never a merge (Spam, Bots & Inauthentic Behavior).
Actionable evidence: evidence sufficient for a registrar to make a reasonable determination that a name is used for DNS Abuse, which obliges it to promptly take appropriate mitigation (Abuse Desks for Hosts & Registrars).
Active role: the DSA limit (Recital 18) under which a provider that goes beyond merely technical and automatic processing, gaining knowledge of or control over information, loses the hosting exemption for it (The Law of Hosting User Content).
Actual knowledge: the trigger most hosting regimes share: once a platform knows of specific illegal or infringing material it must act, and the earliest provable receipt of a notice is when that knowledge starts (The Law of Hosting User Content).
Age restriction (content): a gate that hides content from users under 18 and signed-out viewers, used instead of removal when context is enough (Terrorism, Violent Extremism & Graphic Content).
Article 17: the EU DSM Directive rule that makes content-sharing services directly liable for unauthorised uploads unless they show best efforts to license, to prevent availability of identified works, and to act on notices and prevent re-uploads (Copyright at Scale).
Audible Magic: an automated content identification vendor whose audio recognition Twitch uses on VODs (Copyright at Scale).
Authentic intimate visual depiction: a real intimate image of an identifiable adult; publishing one is a federal offense under the TAKE IT DOWN Act when the privacy, public-concern and harm conditions are met (Intimate Image Abuse).
Back-scan: running each new batch of victim-submitted hashes against media already stored, because the image may have been posted before it was hashed (Intimate Image Abuse).
Bellwether: a first trial chosen from a large set of coordinated cases; K.G.M. was the first social media addiction bellwether to reach a jury verdict, in March 2026 (The Law of Hosting User Content).
Best efforts: the Article 17 standard a content-sharing service must show to escape liability: efforts to obtain authorization, to keep identified works unavailable under high industry standards, and to prevent re-uploads (Copyright at Scale).
Blocklist (abuse reputation): a reputation list such as Spamhaus or SURBL that lists IPs, domains or URLs seen in abuse; on shared hosting one listing can block mail for every customer on the IP (Abuse Desks for Hosts & Registrars).
Blur by default: showing possibly graphic media as a blurred placeholder the viewer chooses to reveal, as Discord does for teens and UK users (Terrorism, Violent Extremism & Graphic Content).
Bot disclosure law (California): Business and Professions Code 17940 to 17943 (SB 1001, operative 1 July 2019), making it unlawful to use a bot to mislead a person about its artificial identity to sell goods or services or influence a vote; the duty falls on the bot's operator, not the platform (Spam, Bots & Inauthentic Behavior).
Bot label: a platform-controlled marker that an account is automated, set by the operator or the platform and rendered by every client, tied to the human responsible (Spam, Bots & Inauthentic Behavior).
BPO (business process outsourcing): the outsourcing firms that do most human review at the largest platforms, such as TaskUs and Teleperformance; the platform still owns the policy, the decision and the record (Moderation at Scale).
Bridging: ranking that credits a note only for helpfulness that viewpoint doesn't explain, by regularizing intercepts more heavily than viewpoint factors so diverse raters must agree (Spam, Bots & Inauthentic Behavior).
Bundling: NCMEC's feature letting large platforms combine related reports of one widespread incident, such as a viral meme, into a batched report that still names every user (Child Safety: Detection & Reporting).
Celebrity-bait ad: an ad that uses a public figure's face, name or AI-generated likeness to endorse a scam, usually a crypto or trading platform; Meta matches faces in suspect ads against enrolled public figures' profile pictures and deletes the facial data after the comparison (Crypto Investment Scams & Impersonation).
Christchurch Call: the commitments by governments and online service providers against terrorist and violent extremist content online, launched in May 2019 and now carried by the Christchurch Call Foundation (Terrorism, Violent Extremism & Graphic Content).
CIB (coordinated inauthentic behavior): particularly sophisticated inauthentic behavior where false identities are central to the operation; enforced against the network, whatever it posted (Spam, Bots & Inauthentic Behavior).
CIP (Content Incident Protocol): the IRF's first form, modeled on the response to Christchurch; retired in 2025 with the other old response types (Terrorism, Violent Extremism & Graphic Content).
Claim dispute: an uploader's challenge to a fingerprinting claim (rights, an exception or misidentification), with a response window for the claimant that releases the claim if it lapses (Copyright at Scale).
Classifier band: the thresholds for one model, category and action: above the upper one the system acts, between them a person reviews, below the lower one nothing happens; versioned data with an owner (Moderation at Scale).
clientHold and serverHold: domain statuses that stop a name resolving, set by the registrar (clientHold) or the registry (serverHold); effective, and costly to every subdomain and mailbox on the name (Abuse Desks for Hosts & Registrars).
Community Notes: crowd-written context attached to posts, shown only when people who usually disagree both rate a note helpful; launched on Twitter as Birdwatch and adopted by Meta and YouTube (Spam, Bots & Inauthentic Behavior).
Compromised site: a real customer's site that was hacked, often an outdated CMS with a phishing kit dropped in; answered by blocking the paths, notifying the owner and setting a deadline (Abuse Desks for Hosts & Registrars).
Content ID claim: a YouTube claim created when an upload matches a reference, with the owner's chosen action (block, monetize or track) per territory; it normally doesn't strike, unlike a removal request (Copyright at Scale).
Content Safety API: Google's classifier for previously unseen abuse imagery that returns a priority, not a verdict; partners must review before acting (Child Safety: Detection & Reporting).
Conversation-stage model: a model that scores where a conversation sits in a scam sequence (contact, rapport, migration, pitch, deposit, withdrawal block, recovery) rather than whether one message is bad, acted on per sender and network (Crypto Investment Scams & Impersonation).
Copyright strike: a penalty recorded against an uploader for a valid copyright removal, withdrawn by a valid counter-notice or retraction, counted toward termination (often three in a window) (Copyright at Scale).
Counter-notice: a user's statement under penalty of perjury that material was removed by mistake or misidentification; on a valid one the platform restores the material 10 to 14 business days later unless the claimant sues (Copyright at Scale).
Covered platform: under the TAKE IT DOWN Act, a public website or app that primarily provides a forum for user-generated content or regularly hosts non-consensual intimate depictions; nonprofits included, broadband and email excluded (Intimate Image Abuse).
Cox v. Sony: the Supreme Court's 25 March 2026 holding that a provider is contributorily liable for copyright infringement only if it induced it or offered a service tailored to it; knowledge alone isn't enough (The Law of Hosting User Content).
Crisis response protocol: a shared protocol for governments and companies to respond together to livestreamed terrorist content after an attack; GIFCT notifies the Christchurch Call and EU protocols on activation (Terrorism, Violent Extremism & Graphic Content).
Cryptographic hash: a fingerprint such as MD5, SHA-1 or SHA-256 that matches only identical files; any change to the file changes it completely (Child Safety: Detection & Reporting).
CSA image-generator: under the UK Crime and Policing Act 2026, a program, information or service made or adapted for creating child sexual abuse images; making, possessing or supplying one is an offence (prospective as of October 2026) (Child Safety: Detection & Reporting).
CSA Regulation: the EU's proposed long-term framework against child sexual abuse online, in trilogue since December 2025 with detection still unresolved; no final text as of October 2026 (Child Safety: Detection & Reporting).
CSAI Match: YouTube's video fingerprinting service for known abuse video, free to qualifying partners, who review matches before acting (Child Safety: Detection & Reporting).
CSAM (child sexual abuse material): imagery of the sexual abuse of minors; every platform that accepts uploads, messages or streams from strangers will receive it, and US providers must report it on knowledge (Child Safety: Detection & Reporting).
CSAM Scanning Tool: Cloudflare's free edge scanning that compares cached content against child-safety lists, blocks matches and emails the customer, leaving the reporting duty with the site owner (Abuse Desks for Hosts & Registrars).
CSEA reporting duty (UK): the duty since 7 April 2026 for regulated user-to-user services to report detected, unreported child sexual exploitation and abuse content to the National Crime Agency, with three priority levels and clocks (Child Safety: Detection & Reporting).
CyberTipline: NCMEC's reporting system for child sexual exploitation; providers report through its API, which mirrors the elements § 2258A lists (Child Safety: Detection & Reporting).
CyberTipline preservation: the one-year duty to keep the reported contents and related data after a completed report, kept as a legal hold that every deletion and purge path respects (Child Safety: Detection & Reporting).
DEFIANCE Act: S. 1837, which would add a federal civil action over intimate digital forgeries; passed the Senate in January 2026 and, as of October 2026, was held at the desk in the House (Intimate Image Abuse).
Design defect claim: the theory in the social media addiction cases that features such as infinite scroll, autoplay, recommendations and notifications were negligently designed to be addictive, which puts product decisions into evidence (The Law of Hosting User Content).
Designated agent: the person, position, department or service a platform registers with the US Copyright Office and publishes to receive DMCA notices; the designation expires after three years unless amended or resubmitted (Copyright at Scale).
Digital asset investment scam: FinCEN's term (since 2026) for the relationship investment scam commonly called pig butchering: trust built over weeks, a move to encrypted messaging, a fake trading platform, fabricated profits and fees demanded to withdraw (Crypto Investment Scams & Impersonation).
Digital Footprint Incident: an IRF activation type since 2025 for perpetrators or accomplices with a significant online presence who didn't produce media as part of the attack (Terrorism, Violent Extremism & Graphic Content).
Digital forgery: an intimate depiction of an identifiable person created or altered with software or AI that a reasonable person would find indistinguishable from an authentic one (Intimate Image Abuse).
Distributor liability: liability that attaches once a host is on notice; Zeran v. America Online (1997) held it is a form of publisher liability that Section 230(c)(1) bars (The Law of Hosting User Content).
DJ Program: Twitch's 2024 licensing program with the major labels and Merlin for DJ streams, with licensing costs split between Twitch and DJs (Copyright at Scale).
DMCA notice: a written notice of claimed infringement to the designated agent with the six elements of 512(c)(3)(A): signature, the work, the material and its location, contact, a good-faith statement and an accuracy statement under penalty of perjury (Copyright at Scale).
DNS Abuse: in ICANN's contracts, malware, botnets, phishing, pharming, and spam only when used to deliver one of those (Abuse Desks for Hosts & Registrars).
EDSA context: YouTube's educational, documentary, scientific or artistic exception for violent or graphic content, which requires the context to be in the video itself (Terrorism, Violent Extremism & Graphic Content).
ENFORCE Act: a US bill to make penalties for AI-generated CSAM consistent with authentic CSAM; passed the Senate in December 2025 and, as of October 2026, is not law (Child Safety: Detection & Reporting).
Error budget: the false-positive rate a platform accepts for automated action in a category, measured from daily samples of automated decisions; exceeding it narrows the band or returns the category to human review (Moderation at Scale).
EU derogation: the temporary EU exception to ePrivacy confidentiality that lets messaging services voluntarily detect and report CSAM under conditions; Regulation 2021/1232 lapsed on 3 April 2026 and Regulation 2026/1881 revived it, excluding end-to-end encrypted content (Child Safety: Detection & Reporting).
Evidence access log: an append-only record of every view, export and hold change on child-safety evidence, by named staff with a reason (Child Safety: Detection & Reporting).
Exposed to terrorist content: an authority's decision under the TCO Regulation, for example after two or more final removal orders in 12 months, that obliges the provider to take specific measures of its choice and report on them (Terrorism, Violent Extremism & Graphic Content).
Exposure cap: a per-reviewer daily limit on seconds of exposure to the most severe categories, enforced by the router and kept as data (Moderation at Scale).
Financial services verification: an ad platform's check that an advertiser of financial products holds the license each targeted country requires (FCA in the UK, SEBI in India, FinCEN and state licenses for US crypto), enforced country by country (Crypto Investment Scams & Impersonation).
Fingerprinting: matching every upload against reference files supplied by rights holders, so copyright enforcement happens at upload time with an action the rights holder chose in advance (Copyright at Scale).
Foreign interference: coordinated inauthentic behavior run by operators outside the country they target (Spam, Bots & Inauthentic Behavior).
FOSTA: the 2018 amendment that added Section 230(e)(5), leaving civil sex-trafficking claims under 18 U.S.C. § 1595 and certain state prosecutions outside the immunity, while good-faith moderation keeps (c)(2)(A) protection (The Law of Hosting User Content).
Fraudulent advertising duty: the UK Online Safety Act duty (sections 38 and 39, in force since January 10, 2024) on Category 1 services and Category 2A search services to prevent users encountering fraudulent ads, minimise how long they're present and take them down swiftly (Crypto Investment Scams & Impersonation).
Fraudulent legal request: a forged court order, impersonated regulator or fake law enforcement request made to get speech removed or data disclosed; verified through a channel the platform found itself, and counted separately (The Law of Hosting User Content).
GIFCT: the Global Internet Forum to Counter Terrorism, an independent industry organization that runs the shared hash database and the Incident Response Framework (Terrorism, Violent Extremism & Graphic Content).
GIFCT labels: the entity, behavioral and incident labels on each shared hash, which let a member set policy per label rather than per list (Terrorism, Violent Extremism & Graphic Content).
Good Samaritan clause (DSA Article 7): the EU rule that voluntary own-initiative investigations and measures against illegal content, done in good faith and diligently, don't cost a provider its liability exemptions (The Law of Hosting User Content).
Grooming: an adult building contact with a child toward sexual abuse; detected through behavior and text and answered by restricting contact, preserving the conversation and reporting enticement (Child Safety: Detection & Reporting).
Guarantee marketplace: a network of chat groups, mostly on Telegram, selling scam services (account creation and verification, targeting, phishing, laundering) with an escrow "guarantee"; FinCEN notes they reconstitute after takedowns by opening new groups (Crypto Investment Scams & Impersonation).
Hash list: a list of hashes (or URLs) of material already judged, from one source under one access agreement; every match records the list and its version (Child Safety: Detection & Reporting).
Hosted resource: a site, domain, IP address, server, bucket or DNS zone a provider can act on, recorded with who held it over time so a timestamped report resolves to the right customer (Abuse Desks for Hosts & Registrars).
Hosting exemption (DSA Article 6): the EU rule that a host isn't liable for information it stores at a user's request unless it has actual knowledge (or, for damages, awareness of apparent illegality) and fails to remove it expeditiously (The Law of Hosting User Content).
HSDB (hash-sharing database): GIFCT's shared store of hashes of known terrorist and violent extremist content, contributed and queried by members; a match prompts no automatic action on another member's platform (Terrorism, Violent Extremism & Graphic Content).
Hybrid enforcement: an action where a reviewer decides an item violates policy and automated systems extend that decision to matching items, as Pinterest reports it; counted as automated, it overstates what machines decided alone (Moderation at Scale).
ICP (information content provider): in Section 230, anyone responsible in whole or in part for creating or developing information; a platform is exposed for what it created or developed itself (The Law of Hosting User Content).
Identical-copy sweep: the job that turns one removal request into removal of every exact copy across stores, a review lane for near matches, and the hashes added to the platform's own list (Intimate Image Abuse).
Image Intercept: the IWF's lightweight hash-matching tool for small platforms, blocking a listed image before it is uploaded, stored or shared (Child Safety: Detection & Reporting).
Image-based abuse scheme: Australia's Online Safety Act 2021 regime under which eSafety can require a service, poster or host to remove an intimate image within 24 hours (Intimate Image Abuse).
Inauthentic behavior: in Meta's definition, deception performed by a network of inauthentic assets (Spam, Bots & Inauthentic Behavior).
Inauthentic cluster: a network of accounts, communities, domains and content investigated and decided as one case, with evidence per member and any attribution recorded with its confidence (Spam, Bots & Inauthentic Behavior).
Incident Advisory: an IRF activation type since 2025 for an extremely unclear information environment or an event that isn't obviously time-bound (Terrorism, Violent Extremism & Graphic Content).
Incident mode: a platform's own response to one event: the incident's hashes loaded, tighter bands for them, a live queue, suppressed recommendations, and a recorded close (Terrorism, Violent Extremism & Graphic Content).
Incidental and flagrant use: a rights contract's split between background or in-game music and radio, rebroadcast or pre-release use, each with its own action rather than one strike per notice (Copyright at Scale).
Inducement: actively encouraging infringement through specific acts; after Cox v. Sony it is, with a service tailored to infringement, the route to contributory copyright liability (The Law of Hosting User Content).
Informational report: a CyberTipline report NCMEC doesn't refer, because the information is insufficient or the imagery is viral and widely reported (Child Safety: Detection & Reporting).
INHOPE: the international network of child sexual abuse hotlines (58 members in 53 countries by its own count) that passes reports across borders through its ICCAM tool (Child Safety: Detection & Reporting).
Interactive blurring: review tooling where media starts blurred and the reviewer reveals only what the decision needs; shown to reduce emotional impact without losing accuracy or speed (Moderation at Scale).
Interactive computer service: in Section 230, any information service, system or access software provider that enables computer access by multiple users to a computer server; the services the immunity protects (The Law of Hosting User Content).
IRF (Incident Response Framework): GIFCT's protocol for attacks with an online dimension: alert members, share situational awareness and, for some activation types, open hash sharing for perpetrator content (Terrorism, Violent Extremism & Graphic Content).
IWF (Internet Watch Foundation): the UK's hotline for online child sexual abuse imagery, a member-funded charity that runs lists, reporting portals and Report Remove and works with Ofcom (Child Safety: Detection & Reporting).
IWF Hash List: the Internet Watch Foundation's licensed list of CSAM hashes, each item assessed by at least two people, with category metadata; about 3.2 million hashes at the end of 2025 (Child Safety: Detection & Reporting).
IWF URL List: the IWF's licensed list of webpages with confirmed CSAM, updated twice a day, which members refresh at least every 24 hours (Child Safety: Detection & Reporting).
JCCP (Judicial Council Coordination Proceeding): the California coordinated proceeding of social media addiction cases in Los Angeles Superior Court, where the first jury verdict against Meta and YouTube was returned on 25 March 2026 (The Law of Hosting User Content).
Known identical copies: the copies a covered platform must make reasonable efforts to find and remove within the same 48 hours; exact hash matches, with near matches reviewed (Intimate Image Abuse).
Lantern: the Tech Coalition's cross-platform signal-sharing program for child sexual exploitation (41 companies as of October 2026), where each participant reviews incoming hashes, URLs and incident signals before acting (Child Safety: Detection & Reporting).
Legal clock: the deadline a regime attaches to knowledge, such as one hour for an EU terrorist content order, 48 hours for a TAKE IT DOWN Act request, or 10 to 14 business days for a DMCA restore; computed once from a versioned rule and stored on the notice (The Law of Hosting User Content).
Legal notice: any notice or order that carries a legal clock, whatever law it comes under (DMCA takedowns and counters, TAKE IT DOWN Act requests, DSA notices, TCO orders, court and regulator orders), kept as one legal_notices row with its named items (The Law of Hosting User Content).
M3AAWG hosting practices: the M3AAWG and Internet Infrastructure Coalition Anti-Abuse Best Common Practices for Hosting and Cloud Service Providers (2015), the written baseline for abuse handling and priority (Abuse Desks for Hosts & Registrars).
Malicious registration: a domain or account created by the criminal for the attack, often in bulk; answered by suspending it outright and looking for related registrations (Abuse Desks for Hosts & Registrars).
MDL 3047: the federal multidistrict litigation over social media addiction in the Northern District of California; as of October 2026 it has no bellwether verdict (The Law of Hosting User Content).
Mitigation layers: the levels at which an infrastructure provider can act (content, site, account, domain, DNS, network), each wider one stopping more abuse and hurting more bystanders (Abuse Desks for Hosts & Registrars).
Music Reporting Process: Twitch's process, separate from the DMCA, that lets participating rights holders report music in streams and VODs under activity-specific penalty ladders (Copyright at Scale).
Narrow and scaled allowances: Meta's two forms of newsworthiness allowance: narrow covers one item, scaled covers a phrase or broader class and should expire and be reviewed (Terrorism, Violent Extremism & Graphic Content).
NCMEC: the National Center for Missing & Exploited Children, the US clearinghouse that runs the CyberTipline, hash lists and Take It Down (Child Safety: Detection & Reporting).
NCMEC NGO hash list: NCMEC's list of more than five million hash values of confirmed, triple-vetted CSAM, available to interested technology companies (Child Safety: Detection & Reporting).
Needs review label: Bluesky's temporary label applied automatically to accounts that look like large-scale spam, limiting impact while moderators decide (Spam, Bots & Inauthentic Behavior).
Newsworthiness allowance: a documented exception that keeps up content the rules would remove because the public interest outweighs the risk of harm; granted by a policy role, not a first-line reviewer (Terrorism, Violent Extremism & Graphic Content).
No general monitoring (DSA Article 8): the EU rule that providers can't be given a general obligation to monitor what they transmit or store, or to actively seek facts indicating illegal activity (The Law of Hosting User Content).
No-view actioning: removing content, quarantining the asset and restricting the account on an exact match to a vetted list without anyone opening the file (Child Safety: Detection & Reporting).
Non-Photographic Imagery URL List: the IWF list of pages with computer-generated, drawn or animated child sexual abuse imagery (Child Safety: Detection & Reporting).
Note intercept: a Community Notes note's score: the helpfulness left after the model's viewpoint factors explain what they can; at least 0.40 counted as helpful in the published algorithm (Spam, Bots & Inauthentic Behavior).
Notice and stay down: the Article 17 duty that after a valid notice the same work shouldn't come back, implemented by making the notified work a fingerprint reference (Copyright at Scale).
Nudify app: an app or site that generates intimate images from any photo of a real person; platforms and prosecutors act against its ads, links and operators (Intimate Image Abuse).
Null route: dropping all traffic to an IP address at the network layer; it stops a live attack and takes down every site on a shared IP (Abuse Desks for Hosts & Registrars).
OCSSP (online content-sharing service provider): under Article 17 of the DSM Directive, a service whose main purpose includes storing and giving access to a large amount of user-uploaded protected works that it organises and promotes for profit (Copyright at Scale).
PAT (Private Access Token): a Privacy Pass token issued after the device vendor attests a real device, letting a site skip a challenge while learning only that a valid token was presented (Spam, Bots & Inauthentic Behavior).
PDQ and TMK+PDQF: Meta's open-source perceptual hashes for photos (PDQ) and video (TMK+PDQF), released in 2019 so hash-sharing systems can interoperate (Child Safety: Detection & Reporting).
PERCI: Europol's platform for processing EU removal orders and referrals, launched in July 2023 (Terrorism, Violent Extremism & Graphic Content).
Perpetrator Content Incident: an IRF activation type since 2025 for online, perpetrator-produced content directly related to a terrorist or violent extremist event (Terrorism, Violent Extremism & Graphic Content).
Pex: a music and video identification vendor acquired by Vobile in April 2025 (Copyright at Scale).
PhotoDNA: Microsoft's image hashing for matching known illegal images, offered free to qualified organizations and as a cloud service (Child Safety: Detection & Reporting).
Pig butchering: the common name for relationship investment scams, from fattening a pig before slaughter; INTERPOL urged dropping it in 2024 because it shames victims, and FinCEN now says digital asset investment scam (Crypto Investment Scams & Impersonation).
Prevalence: the estimated share of views of violating content among all views, measured by sampling views and labeling them; the only number that captures what moderation missed (Moderation at Scale).
Proof of work: a challenge that makes the client spend CPU time per request, trivial for one sign-up and expensive for a hundred thousand; it separates cheap from expensive, not people from machines (Spam, Bots & Inauthentic Behavior).
RDAP: the Registration Data Access Protocol, the definitive source for generic top-level domain registration data since 28 January 2025, with an abuse entity role naming who handles abuse (Abuse Desks for Hosts & Registrars).
Recovery scam: a second scam aimed at people who already lost money, offering to recover it for a fee through fake law firms, fake fund recovery services or impersonated officials (Crypto Investment Scams & Impersonation).
Red-flag knowledge: awareness of facts or circumstances from which infringement is apparent; under the DMCA it ends the 512(c) safe harbor like actual knowledge unless the platform removes the material expeditiously (The Law of Hosting User Content).
Reduced distribution: keeping an item visible on direct link or profile while excluding it from recommendations, search suggestions and trending (Terrorism, Violent Extremism & Graphic Content).
Referral (CyberTipline): a report NCMEC sends to a specific law enforcement agency because the company gave enough information (user details, imagery, a possible location) (Child Safety: Detection & Reporting).
Referral (terrorist content): content an authority or Europol flags for a provider's voluntary assessment against its own terms, with no legal clock (Terrorism, Violent Extremism & Graphic Content).
Removal order: an order from a competent EU authority under the TCO Regulation to remove or disable terrorist content in all Member States within one hour of receipt (Terrorism, Violent Extremism & Graphic Content).
Repeat infringer policy: the reasonably implemented policy, required for every DMCA safe harbor, of terminating repeat infringers in appropriate circumstances; usually strikes with expiry (Copyright at Scale).
REPORT Act: the 2024 law that added sex trafficking of minors and enticement to the reporting duty, extended preservation from 90 days to one year, and raised fines (Child Safety: Detection & Reporting).
Report Remove: the IWF's service letting young people in the UK report their own images for removal (Child Safety: Detection & Reporting).
Rights reference (reference file): a rights holder's reference file with its owner, territories, per-territory policy and exclusivity attestation; under Article 17 it is the relevant and necessary information (Copyright at Scale).
Safer: Thorn's commercial child-safety product: perceptual hashing for images and video, classifiers for novel CSAM, and a text classifier for exploitation and sextortion (Child Safety: Detection & Reporting).
Scam center: a compound, mostly in Southeast Asia and often staffed by trafficked workers, that runs investment and impersonation scams at industrial scale; platforms remove its accounts as networks, and the US sanctions its operators and infrastructure (Crypto Investment Scams & Impersonation).
Scams Prevention Framework: Australia's 2025 Act requiring businesses in designated sectors (banks, telecommunications and digital platforms from 2026) to meet principles of governance, prevent, detect, report, disrupt and respond, with a 28-day safe harbour for proportionate disruptive action (Crypto Investment Scams & Impersonation).
Scola v. Facebook: the California moderator class action whose settlement got final approval on 14 July 2021, with a $52 million fund and terms (muted grayscale video, counseling, vendor duties) as reported, the best-documented reviewer protections (Moderation at Scale).
Section 230(c)(1): the US rule that no provider or user of an interactive computer service is treated as the publisher or speaker of information another information content provider supplied; unlike the other regimes, notice doesn't remove it (The Law of Hosting User Content).
Section 230(c)(2): the companion immunity for good-faith actions to restrict access to objectionable material, so moderating some content doesn't make a platform the publisher of the rest (The Law of Hosting User Content).
Section 512 safe harbors: the DMCA's four copyright safe harbors by function: transitory communications (512(a)), caching (512(b)), information stored at users' direction (512(c)) and information location tools (512(d)) (The Law of Hosting User Content).
Sextortion: coercing a victim, often a minor, with threats to share sexual images, including financial sextortion run through payment handles and gift cards (Child Safety: Detection & Reporting).
Shadow mode: running a candidate model or vendor on live traffic with its outputs logged and ignored, then comparing against labeled decisions before letting it act (Moderation at Scale).
Signal vendor: a supplier that returns scores or matches (Hive, Community Sift, Safer, Google's Content Safety API); changing one changes a signal (Moderation at Scale).
Skewing (OAT-016): OWASP's automated-threat name for repeated clicks, requests or submissions intended to alter a metric such as likes, votes or poll results (Spam, Bots & Inauthentic Behavior).
Small-service regime: Article 17's lighter conditions for services in the EU under three years with turnover below EUR 10 million; stay-down applies once monthly visitors exceed 5 million (Copyright at Scale).
SMS pumping: fraud that abuses a phone number field to send one-time codes to blocks of numbers on a carrier that shares the termination revenue; also called artificially inflated traffic (Spam, Bots & Inauthentic Behavior).
STM (standard technical measures): identification and protection measures developed by broad multi-industry consensus and available on reasonable terms, which DMCA safe harbors require platforms to accommodate (Copyright at Scale).
StopNCII: SWGfL's service where adults hash their intimate images on their own device and partner platforms match and remove copies under their policies (Intimate Image Abuse).
Substantial compliance: the DMCA test for notices: one that doesn't substantially comply can't show knowledge, but one that identifies the work, the material and the contact obliges the platform to try to get a compliant notice (Copyright at Scale).
Sunset Section 230 Act: S. 3546, a December 2025 bill that would repeal Section 230 two years after enactment; as of October 2026 its only action is referral to committee (The Law of Hosting User Content).
Sunset To Reform Section 230 Act: H.R. 6746, a December 2025 bill that would end Section 230's effect after 31 December 2026; as of October 2026 it has only been referred to committee (The Law of Hosting User Content).
Take It Down: NCMEC's service for images taken before the person was 18: the hash goes to NCMEC's list and participating platforms scan public or unencrypted services against it (Intimate Image Abuse).
TAKE IT DOWN Act (TIDA): the 2025 US law that criminalizes publishing non-consensual intimate depictions and digital forgeries and, since 19 May 2026, requires covered platforms to remove reported images within 48 hours of a valid request (Intimate Image Abuse).
TCO Regulation: the EU's Terrorist Content Online Regulation (EU) 2021/784, applying since June 2022 to hosting providers that disseminate to the public, with one-hour removal orders (Terrorism, Violent Extremism & Graphic Content).
Transfer lock: a status that stops a domain moving to another registrar, used with a suspension to prevent evasion (Abuse Desks for Hosts & Registrars).
Trusted reporter: a volume reporter, such as a blocklist operator or CERT, given a priority lane at an abuse desk; the infrastructure counterpart of a trusted flagger (Abuse Desks for Hosts & Registrars).
UK-linked: in the UK reporting duty, content with evidence linking it to the UK, such as where it was uploaded, the offender's nationality or location, or a suspected victim's location (Child Safety: Detection & Reporting).
Valid removal request: a TAKE IT DOWN Act request with a signature, information to locate the depiction, a good-faith statement that it isn't consensual, and contact information; the 48-hour clock runs from it (Intimate Image Abuse).
Viewed flag (fileViewedByEsp): the CyberTipline field recording whether a person at the platform viewed a file before reporting; after United States v. Wilson it changes what law enforcement can do without a warrant (Child Safety: Detection & Reporting).
VOD muting: silencing archived broadcast audio where third-party music is detected; Twitch began it in 2014 in 30-minute blocks (Copyright at Scale).
Vote fuzzing: altering visible vote totals so manipulators can't tell whether their votes counted; Reddit admins did it as an anti-spam measure (Spam, Bots & Inauthentic Behavior).
Vote ring: a group of accounts that coordinate votes to push content up or down; detected as a cluster of voters, not single votes (Spam, Bots & Inauthentic Behavior).
VVR (violative view rate): YouTube's prevalence measure: the share of views on videos that violate its Community Guidelines, estimated by sending a sample of videos to reviewers (Moderation at Scale).
Warning screen (interstitial): a full overlay naming the kind of content that a viewer clicks through, used for graphic material kept up for news, documentary or awareness (Terrorism, Violent Extremism & Graphic Content).
Workflow vendor: a supplier that holds the queues, policies, decisions and regulatory filings (Checkstep, Cinder); changing one is a migration of the moderation system of record (Moderation at Scale).
XARF: a set of JSON schemas for abuse reports (phishing, malware, copyright, DDoS, child exploitation and more) developed by Abusix, carried by email, API or stream (Abuse Desks for Hosts & Registrars).