CHARLESTON, W.Va. — West Virginia Attorney General JB McCuskey has filed a lawsuit against Apple, alleging the tech giant knowingly allowed its iCloud platform to turn into a hub for the distribution of child sexual abuse material (CSAM). The suit, filed February 19, 2026, claims Apple prioritized user privacy over the safety of children, a decision McCuskey characterized as “inexcusable.” This legal action marks the first of its kind brought by a government agency specifically targeting the distribution of CSAM on Apple’s data storage platform, signaling a potential shift in how tech companies are held accountable for content hosted on their services.
The lawsuit centers on internal Apple communications where company employees reportedly described iCloud as “the greatest platform for distributing child porn,” yet took no meaningful action to address the issue. According to the complaint, Apple failed to implement industry-standard detection tools used by competitors like Google and Meta, despite being aware of the problem. The state alleges this inaction constitutes a violation of West Virginia law and a betrayal of the responsibility to protect vulnerable children. The core of the argument rests on Apple’s control over its entire ecosystem – hardware, software and cloud infrastructure – making it, in the state’s view, unable to claim ignorance of the illicit activity occurring on its platform.
Federal law mandates that U.S.-based technology companies report detected CSAM to the National Center for Missing and Exploited Children (NCMEC). However, Apple’s reporting numbers are significantly lower than those of its peers. In 2023, Apple filed just 267 reports with NCMEC, a stark contrast to Google’s 1.47 million reports and Meta’s more than 30.6 million reports. This disparity, the lawsuit argues, isn’t a matter of oversight but a deliberate choice by Apple.
The Encryption Debate and Apple’s Shifting Approach
West Virginia’s lawsuit highlights Apple’s move toward end-to-end encryption as a key factor enabling the proliferation of CSAM. End-to-end encryption protects data by ensuring that only the sender and receiver can decrypt it, effectively shielding it from access by Apple and law enforcement with a warrant. While privacy advocates champion this technology as vital for protecting user data and preventing mass surveillance, governments argue it hinders criminal investigations. Apple has grappled with this tension for years, initially considering scanning images for abuse material but ultimately abandoning the approach due to concerns about privacy and potential misuse by governments, as reported by Reuters in 2020.
In 2021, Apple announced NeuralHash, a system designed to scan images on users’ devices before upload to iCloud, aiming to balance CSAM detection with privacy. However, the system faced criticism from security researchers who worried about false positives and from privacy advocates who feared it could be expanded for broader surveillance purposes. The state’s lawsuit claims Apple promoted NeuralHash as a solution while knowing it was “inferior” and easily circumvented. Apple ultimately delayed and then canceled the NeuralHash program in December 2022, opting instead to launch an option for end-to-end encryption for iCloud data.
Allegations of Unfair Practices and Public Nuisance
The lawsuit accuses Apple of engaging in unfair or deceptive practices by promoting NeuralHash, which West Virginia contends was a flawed solution. The state argues that Apple’s product design choices create a public nuisance by facilitating the collection, storage, and spread of CSAM. This, the state claims, has caused widespread harm to West Virginia’s public health and child-protection systems. The complaint seeks both statutory and punitive damages, as well as a court order compelling Apple to implement safer product designs and effective measures for detecting abusive material.
This case echoes concerns raised in a separate proposed class action lawsuit filed in California in late 2024, where individuals depicted in CSAM are suing Apple. Apple has moved to dismiss that lawsuit, citing Section 230 of the Communications Decency Act, which generally shields internet companies from liability for content posted by users. The outcome of that case could have significant implications for Apple’s legal standing in relation to user-generated content.
Communication Safety and Reporting Disparities
While Apple abandoned plans to scan all iCloud uploads, the company has implemented Communication Safety, a feature that blurs nudity and sensitive content in messages sent to and from children’s devices. However, the state’s lawsuit emphasizes the significant disparity in CSAM reporting between Apple and its competitors. In 2023, Apple reported 267 instances of CSAM to NCMEC, while Google reported 1.47 million and Meta reported over 30.6 million. This difference underscores the state’s argument that Apple’s approach to content moderation is inadequate.
Attorney General McCuskey stated, “Preserving the privacy of child predators is absolutely inexcusable. And more importantly, it violates West Virginia law. Since Apple has so far refused to police themselves and do the morally right thing, I am filing this lawsuit to demand Apple follow the law, report these images, and stop re-victimizing children by allowing these images to be stored and shared.”
The case is being heard in Mason County Circuit Court. The next step in the legal process is Apple’s response to the complaint, which is expected in the coming weeks. The outcome of this lawsuit could set a precedent for how tech companies are held accountable for the content hosted on their platforms and could reshape the debate surrounding encryption and child safety.
If you or someone you recognize needs support, the National Center for Missing and Exploited Children is available 24/7 at 1-800-THE-LOST (1-800-843-5678) or online at https://www.missingkids.org/.
Have thoughts on this developing story? Share your comments below.
