CSAM Screening Across OpenRouter
By Steven Van ·
OpenRouter will screen every inference request in flight, including Zero Data Retention traffic, and may retain flagged content for human review.
All inference requests passing through OpenRouter will now be screened for child sexual abuse material (CSAM), according to the company's announcement. Screening happens in flight, during request processing. Content flagged as potential CSAM may be retained for human review, with reporting and preservation where required by law.
How screening works
- Known material: in-flight screening includes comparing applicable content against hashes (digital fingerprints) of previously identified CSAM.
- Suspected new material: OpenRouter may begin retaining flagged content for human review, including content that does not match a known hash. A flag indicates suspected material and is not itself a determination that the content is CSAM.
OpenRouter notes that hash matching detects known material, while classifiers can identify suspected material not yet in a hash database. It cites the National Center for Missing & Exploited Children (NCMEC), which recommends hashing and image classifiers as basic child-safety measures for services handling images and video, including generative AI services.
Zero Data Retention traffic is included
Screening also applies to requests covered by OpenRouter's Zero Data Retention (ZDR) policy. OpenRouter is updating its documentation and related terms to state its retention commitment explicitly. For ZDR-covered inference content, it does not retain prompts or responses after processing, except when a user explicitly chooses to have them stored or when retention is needed for CSAM review, reporting, and related legal preservation.
The company says these provisions do not authorize general retention of ZDR content for unrelated purposes, and that its commitment not to use inputs or outputs for model training continues.
Reporting and preservation
OpenRouter describes reporting and preservation as established legal obligations that ZDR does not remove. Under U.S. law, covered providers must report to NCMEC's CyberTipline as soon as reasonably possible after obtaining actual knowledge of facts or circumstances indicating specified apparent offenses. Reported contents and certain related contextual material must be preserved for one year after submission. That requirement applies to reported material, not to every item flagged for review (18 U.S.C. § 2258A(a) and (h)).
Provider policies may differ
Model labs and providers may use their own screening and retention methods, and some may retain content for a period to run automated safety checks before anything is flagged. OpenRouter says those practices are separate from its in-flight screening and are governed by the applicable model and provider policies. It documents provider policies so users can see the requirements that apply to their requests, and advises reviewing them when choosing a model or provider, especially for organizations with specific data-retention requirements.
