Online Exploitation Evidence: What to Preserve (Checklist)

Last updated: October 2026

If you discover that someone exploited or targeted your child online, the most important things to preserve are the account details, the other person’s usernames, the dates and the platform names. You should also write down what your child told you. But there is one firm rule: never copy, save, screenshot or forward any sexual image of a minor, even as evidence. Report it instead. Knowing how to protect online exploitation evidence in the right way can help police, NCMEC and, if you choose, a participating law firm act on what happened.

This practical checklist walks you through what to preserve after discovering online exploitation, in what order, and how to protect your child while you do it.

First: make sure your child is safe

Before you think about evidence, focus on your child. Stay calm, thank them for telling you, and let them know they are not in trouble. Children often fear losing their devices or being blamed. Those fears can stop them from sharing the rest of the story.

• If your child is in danger right now, call 911.
• If an adult is pressuring your child for images or threatening them, stop all replies to that person.
• Do not confront the other person or try to trick them. Leave that to law enforcement.
• If your child talks about self-harm, call or text 988 any time.

The RAINN National Sexual Assault Hotline (800-656-4673) offers free, confidential support for parents and survivors.

Report to the NCMEC CyberTipline

The National Center for Missing & Exploited Children runs the CyberTipline, the national reporting system for online exploitation of children. You can report online at report.cybertip.org or by phone at 1-800-843-5678, 24/7 (NCMEC).

NCMEC reviews each tip and works to send it to the right law enforcement agency. You can also file a report with your local police. Ask for a report or case number and write it down.

If a sexual image of your child is being shared or threatened, NCMEC’s free Take It Down tool can help. It creates a digital fingerprint of the image on your device. The image itself is not uploaded.

The preservation checklist

Work through this list at your own pace. You do not need every item. Save copies somewhere safe, such as a printed folder or a notes file on your own device.

Account information

• Your child’s username and display name on each platform.
• The email address and phone number tied to each account.
• The date each account was created, if you know it.
• The platforms involved, such as a game, a chat app or a social media app.

The other person’s details

• Their usernames and display names, spelled exactly.
• Any profile links or ID numbers you can see.
• Any names, ages or locations they claimed.
• Any phone numbers or other accounts they asked your child to use.

A written timeline

• When contact started and where.
• When the conversation moved to another app.
• Any gifts, including in-game currency or gift cards.
• When and how you found out.

Messages that do not contain sexual images

It is generally fine to take screenshots of text messages, friend requests or usernames that do not include sexual images. Include the date and the username in the shot when you can.

If a conversation includes a sexual image of a minor, do not screenshot it, save it or send it to anyone, including police by email or text. Tell law enforcement it exists and where it is. They can collect it legally.

What not to do

It is natural to want to clean up what happened. But some actions can make a case harder.

• Do not delete your child’s account. Keep it, and change the password.
• Do not delete the app until you have written down the account details.
• Do not reset or trade in the device. Keep it charged and in a safe place.
• Do not block the other person yet if police have not reviewed the account. Blocking can sometimes hide their profile. If your child feels unsafe, safety comes first, so block and tell police you did.
• Do not post about it on social media. Public posts can affect an investigation and your child’s privacy.

Records beyond the device

Online exploitation cases often involve records outside the phone or computer.

• Bank, card or app store statements showing purchases or gifts.
• School records if grades, attendance or behavior changed.
• Medical or counseling records, which also help your child heal.
• Copies of any reports you made to the platform, NCMEC or police.

Platforms keep their own records, such as login data and chat logs. A law firm may be able to send a preservation request so those records are not deleted.

Why preservation matters for a legal claim

Many families are now bringing claims against online platforms. Federal cases about child exploitation on Roblox and related apps were combined in December 2025 into MDL 3166, led by Chief Judge Richard Seeborg in the Northern District of California (Harris Martin summary). The defendants include Roblox, Discord, Snap and Meta.

In a claim like this, records help show where contact happened, how it moved between apps and what safety tools were or were not in place. They can also help show how the harm affected your child. The details you save now may matter later.

Caring for your child while you gather records

Collecting evidence can feel like a job that has to be done right now. It is important, but your child’s well-being matters more. Try not to question your child over and over. Repeated questioning can be stressful, and investigators or child advocacy centers are trained to talk with children gently.

• Let your child know they did the right thing by telling you.
• Keep daily routines as normal as you can.
• Ask your child’s doctor or school counselor for a referral to a therapist who works with children.
• Take care of yourself too. Parents often feel shock or guilt, and support can help.

If you feel stuck, it is okay to pause. The steps above can wait a day. Your report to the CyberTipline and police is the most urgent part.

How to Build a Simple Log of Online Exploitation Evidence

A checklist tells you what to save. A log helps you keep track of it. When online exploitation evidence is spread across phones, tablets, game consoles and email, a simple log keeps everything in one place and in order.

You can use a paper notebook or a basic document on your own computer. Keep it private, and do not share it with anyone except police or a law firm you choose to work with.

What to write for each item

Give each piece of online exploitation evidence its own short entry. Try to note:

• A number for the item, such as Item 1, Item 2 and so on.
• What it is, for example “screenshot of friend request” or “bank statement showing gift card purchase.”
• The platform or source, and the username involved.
• The date and time shown on the item, plus the date you saved it.
• Where the item is kept now, such as “printed folder” or “Mom’s laptop, folder named Records.”
• Who you shared it with, such as police, NCMEC or a law firm, and the date.

This last point matters. A clear record of who handled the online exploitation evidence, and when, can help show later that nothing was changed.

Keep the original device as it is

Your log is a guide, not a replacement for the device. The phone, tablet or computer may hold data you cannot see, such as login times or deleted messages that investigators can sometimes recover.

• Write the device make, model and color in your log.
• Note who uses the device and whether anyone else had access to it.
• Turn off automatic updates or settings that clear old messages, if you can do so easily.
• Do not install “phone cleaner” or data recovery apps. They can overwrite information.

If you are not sure how to change a setting, leave it alone. Tell police or your law firm which settings you noticed, and let them decide next steps for the online exploitation evidence.

Check every device and account

Exploitation rarely stays on one app. Before you finish your log, think about every place your child may have been contacted. Online exploitation evidence can turn up in places parents do not expect.

• Game consoles and handheld devices with chat or voice features.
• Old phones or tablets kept in a drawer.
• School-issued laptops. Tell the school, but let police decide how to collect anything on them.
• Shared family computers and the email accounts linked to your child’s games.
• Purchase histories in app stores and game stores.

You do not need to search each one yourself. Simply list them so investigators know where to look.

Store copies safely

Keep your log and any allowed screenshots in a place your child cannot easily open, and away from shared family accounts. A printed copy in a folder is a simple backup.

Remember the firm rule from earlier in this guide: online exploitation evidence that includes a sexual image of a minor should never be copied, saved or sent. Only write down that it exists and where it is.

How Platforms and Police Preserve Online Exploitation Evidence

Parents often worry that the most important records are out of reach. In many cases, much of the online exploitation evidence is held by the platforms themselves. Federal law gives police and NCMEC tools to keep it from being deleted.

The REPORT Act and the one-year rule

Online services that send a report to the NCMEC CyberTipline must preserve the contents of that report. The REPORT Act, signed into law on May 7, 2024, extended that preservation period from 90 days to one year. Providers may also choose to keep the material longer to help reduce the spread of exploitation.

This change gives investigators more time to request online exploitation evidence before it is gone. It is one reason a prompt CyberTipline report can make a difference.

Preservation requests from law enforcement

Under the federal Stored Communications Act, a government agency can ask an online service to preserve records while it gets a court order. The service must keep those records for 90 days, and the agency can extend that by another 90 days.

Parents cannot send this type of request on their own. That is why it helps to give police the usernames, profile links and dates from your log. Those details help them ask the platform for the right online exploitation evidence.

Protection for families who report

The REPORT Act also protects a child shown in exploitative images, and a parent or legal guardian acting for that child, from civil claims or criminal charges that arise from reporting the material to the CyberTipline. In plain terms, reporting through the proper channel is the safe way to raise the alarm.

Preservation in a civil claim

In a civil lawsuit, a law firm may send the platform a letter asking it to keep certain records. Once a case is filed, the court process can also require both sides to keep relevant online exploitation evidence. Rules differ by court and by state, so a firm can explain what may apply.

If Your Child Is Facing Sextortion: Protecting Online Exploitation Evidence

Sextortion is when someone threatens to share sexual images unless a child sends more images, money or gift cards. It moves fast, and children often feel panic and shame. Your calm response, and careful handling of online exploitation evidence, can help.

The U.S. Department of Justice gives parents four main steps:

• Preserve evidence by writing down names, usernames and phone numbers the person used, and taking screenshots of messages that do not contain sexual images.
• Report to the FBI at 1-800-CALL-FBI or tips.fbi.gov, or to the CyberTipline.
• Report the account on the platform where it happened.
• Do not comply with demands. Paying or sending more rarely stops the threats.

If your child already paid, do not panic. Save the receipts, gift card numbers or payment app records. That payment trail is useful online exploitation evidence, and it can help police trace the person.

What to tell your child

Children in sextortion cases often believe their life is over. Tell them clearly that they are the victim, that you are not angry, and that the threats are a crime. If your child talks about self-harm, call or text 988 right away.

Questions to Ask a Law Firm About Online Exploitation Evidence

If you decide to talk with a participating law firm, it helps to go in with questions. A firm may review your situation and explain how it would handle online exploitation evidence in a case like yours.

• Which records from my log are most useful, and what else should I look for?
• Will you send preservation letters to the platforms involved, and when?
• Should I hand over the device, and who will keep it safe?
• How will you protect my child’s privacy, including the option to file under a pseudonym where allowed?
• Will my child need to be interviewed, and who would do it?
• What filing deadlines may apply in our state, and does my child’s age change them?
• How will you keep me updated as the case moves forward?

Bring your log, report numbers and any permitted screenshots to the first call. Do not bring or send any sexual images. A firm can explain how online exploitation evidence of that kind is handled through police and the courts.

Mistakes that can weaken a claim

Families act out of love, but a few common steps can make online exploitation evidence harder to use later:

• Cropping, editing or drawing over screenshots. Save the original and write notes in your log instead.
• Logging in to the other person’s account or messaging them while pretending to be your child.
• Forwarding messages to your own email or to relatives, which can spread material and create privacy problems.
• Waiting months to report. Platforms do not keep every record forever.
• Signing up for paid “evidence recovery” or “image removal” services that contact you out of the blue.

Every family’s situation is different, and deadlines vary by state and claim type. Taking steps to protect online exploitation evidence early can help keep your options open while your child heals.

Online exploitation evidence: frequently asked questions

How Direct2Attorney can help

When you are ready, Direct2Attorney can connect your family with a participating law firm that handles online exploitation claims. Share what happened through our Roblox lawsuit page or our sexual abuse claims page. A firm may review your situation for free and in confidence.

Knowing what to preserve after discovering online exploitation can feel overwhelming. Take it one step at a time. Your child’s safety and healing come first.

Direct2Attorney is a legal marketing and referral service, not a law firm. This article is general information, not legal advice. Submitting information does not create an attorney-client relationship.