# AI CSAM Ruling: What It Actually Means > A US appeals court held that possessing self-made AI CSAM at home is protected speech. What the ruling covers, what stays a felony, and who it actually affects. By Rose · September 9, 2026 · 11 min read · Privacy Source: https://bluwarden.com/blog/ai-csam-first-amendment-ruling --- On 25 August 2026 the US Court of Appeals for the Seventh Circuit decided [United States v. Anderegg](https://law.justia.com/cases/federal/appellate-courts/ca7/25-1354/25-1354-2026-08-25.html). It held that a federal ban on possessing obscene visual depictions of minors is unconstitutional **as applied** to one man's possession, in his own home, of images he generated himself with a locally run AI model and never shared with anyone. That is the entire holding. Three other counts against the same defendant - producing the material, distributing it, and sending it to a 15-year-old boy - were left untouched and are still headed for trial. The court did not legalise AI-generated child sexual abuse material, did not address images built from photographs of real children, and does not bind courts outside Illinois, Indiana and Wisconsin. Most of the coverage has not been careful about any of that. Below: what the court decided, the cases it turns on, what remains a serious crime, and why the practical damage lands on detection and moderation teams rather than on the law. --- ## What the Seventh Circuit actually decided Steven Anderegg was charged in the Western District of Wisconsin in 2024 after Meta reported an account to the National Center for Missing and Exploited Children. He had used Stable Diffusion running on his own machine to generate thousands of images. No real child appears in any of them. He faced four counts. The district court, Chief Judge James D. Peterson, dismissed one. The government appealed that dismissal, and lost. | Count | What it charges | Status after the appeal | |---|---|---| | 1 | Producing the material | Live | | 2 | Distributing it | Live | | 3 | Transferring it to a minor under 16 | Live | | 4 | Possessing it at home (18 U.S.C. § 1466A(b)(1)) | Dismissed; dismissal affirmed | Two details do most of the work here, and both get dropped in the coverage. **It was an as-applied challenge, not a facial one.** The court did not strike § 1466A(b)(1) off the books. It held the statute unconstitutional against these specific facts: material the defendant made himself, kept at home, and did not distribute. The statute stands for everyone else. **The panel said plainly that it disliked the result.** Writing for the court, Judge John Z. Lee noted that "we now live in an age where GenAI models can render images depicting the abuse of virtual children that are virtually indistinguishable from those depicting the abuse of actual children," then explained why that did not change the outcome: "we are not free to redraw them ourselves. Unless we wish anarchy to prevail within the federal judicial system, we must follow Supreme Court precedent." Judges Lee and Kolar filed a concurrence asking the Supreme Court to revisit the question. --- ## The precedent it turns on None of the reasoning is new. It is a 2026 application of case law stretching back nearly sixty years. **Stanley v. Georgia (1969)** held that the state cannot criminalise private possession of obscene material in the home: "If the First Amendment means anything, it means that a State has no business telling a man, sitting alone in his own house, what books he may read or what films he may watch." The government argued Stanley covers only adult obscenity. The panel rejected that, because Stanley's holding was built on the **location** - the home - not the subject matter. **Ferber (1982) and Osborne (1990)** carved child sexual abuse material out of First Amendment protection entirely, private possession included. But both rest on a real, abused child: the image is a permanent record of a crime, and the market for it drives more crimes. Neither rationale reaches an image with no child behind it. **Ashcroft v. Free Speech Coalition (2002)** decides this case. The Supreme Court struck down a ban on virtual child pornography and rejected, one by one, the arguments the government made again in 2026: that the material is used to groom children, that it normalises abuse, that banning it shrinks the market for the real thing, and that telling synthetic from real is too hard for prosecutors. On that last point the Court was blunt, and the Seventh Circuit quoted it: "The Government may not suppress lawful speech as the means to suppress unlawful speech." The panel's position in one line: this is the same argument the Supreme Court already rejected, and a court of appeals does not get to overrule the Supreme Court because the technology improved. --- ## What is still a crime Worth reading twice, because the gap is far narrower than "AI CSAM is legal now." | Conduct | Still prosecutable? | Why | |---|---|---| | Producing AI CSAM | Yes | Not covered by Stanley. Count 1 in this case is proceeding | | Distributing or sharing it | Yes | Count 2 is proceeding | | Sending it to a minor | Yes | Count 3 is proceeding | | Downloading or receiving it | Yes, in practice | Federal courts treat online receipt as commerce rather than mere possession. See [United States v. Whorley](https://cyberlaw.stanford.edu/blog/2009/02/congress-can-ban-receipt-obscene-pornographic-text-drawings-online/) (4th Cir. 2008) | | Any image built from a real child's photo | Yes, as ordinary CSAM | [18 U.S.C. § 2256(8)(C)](https://www.law.cornell.edu/uscode/text/18/2256) covers depictions "created, adapted, or modified to appear that an identifiable minor is engaging in sexually explicit conduct" | | The same conduct under state law | Almost everywhere | [46 states](https://enoughabuse.org/get-vocal/laws-by-state/state-laws-criminalizing-ai-generated-or-computer-edited-child-sexual-abuse-material-csam/) criminalise AI-generated or computer-edited CSAM as of August 2026 | | Possession outside the Seventh Circuit | Unresolved | No other circuit has ruled. Anderegg binds Illinois, Indiana and Wisconsin only | The download row matters more than any other. The protection Anderegg won depends on his having generated the images locally and kept them to himself. Acquiring the same material over the internet is receipt, and receipt has never been treated as protected private possession. --- ## What this means for a normal user For almost everyone: nothing changed, and the ruling is not permission for anything. The version of this problem that actually reaches ordinary people is not the Anderegg fact pattern. It is a "nudify" app pointed at a real photograph of a real child, very often a classmate. That is not virtual anything - an identifiable minor makes it child sexual abuse material under § 2256(8)(C), with no First Amendment question to argue, and it is prosecuted as such. The second version is sextortion, and that is where the numbers have gone badly wrong. NCMEC's [2025 CyberTipline data](https://www.missingkids.org/blog/2026/the-work-never-stops-first-look-at-ncmecs-2025-data) records 1.4 million reports of online enticement, a 156% increase on 2024, out of 21.3 million reports overall. AI removed the last practical barrier, because an offender no longer needs a real image from a victim to threaten them with one. If you have teenagers, that conversation is worth more than any court ruling, and it runs on the same instinct as our [guide to scam texts](/blog/smishing-anatomy-phone-protection): the threat arrives as a message, and the correct response is to stop, not to reply. If you encounter this material anywhere, report it to the NCMEC CyberTipline or, in the UK and Europe, the Internet Watch Foundation. Do not download it, screenshot it, or try to build a case yourself. Collecting evidence is the conduct the statutes prohibit. --- ## What this means for businesses The First Amendment restrains governments. It does not restrain your acceptable use policy, your terms of service, or your right to dismiss someone. A ruling about what a prosecutor may charge changes nothing about what you may prohibit on your own systems, and every major platform and model provider still bans this outright. 1. **Have a defined path before you need one.** If this surfaces on company hardware, in a corporate cloud account, or in an internal AI tool's logs, the failure mode is improvisation: a manager opening files to "check", copies made for an investigation, evidence handled by people with no mandate. Write the escalation path now - who is told, who is not, who contacts counsel and law enforcement, and the standing instruction that nobody views or copies anything. 2. **Do not assume mandatory reporting covers it.** The federal provider reporting duty in [18 U.S.C. § 2258A](https://www.law.cornell.edu/uscode/text/18/2258A) is keyed to the CSAM statutes - sections 2251, 2252, 2252A and their neighbours. Section 1466A is not on that list. Providers can and do report obscene virtual material voluntarily, and should, but if your compliance programme assumed a statutory duty here, check it. 3. **Outside the US, this is not your framework at all.** The UK's [Crime and Policing Act 2026](https://www.gov.uk/government/publications/crime-and-policing-act-2026-factsheets/crime-and-policing-act-2026-child-sexual-abuse-material-factsheet) went the other way: an offence of adapting, possessing, supplying or offering to supply an AI model optimised to generate CSAM, up to five years, with a narrow testing defence for designated organisations. The EU's own scanning fight, covered in our [Chat Control explainer](/blog/chat-control-is-back), is still live and pushing in the same direction. 4. **If you ship image generation, your exposure is on the production side.** Anderegg's possession count fell. His production count did not. Model safeguards, prompt filtering and abuse logging are product requirements, not trust-and-safety garnish. --- ## Why this is a security problem, not just a legal one The enforcement machinery for this material was built on one assumption: that abusive images are copies of known files. That assumption is now false, and the ruling makes the gap harder to close by statute. **Hash matching does not see it.** PhotoDNA and its equivalents compare a file against a database of known material. Every generated image is a new file, so it matches nothing. Detection has to move to classifiers, which are slower, noisier and much easier to argue with. **The volume is drowning triage.** NCMEC processed more than 1.5 million reports with a generative-AI nexus in 2025, over a million of them automated submissions from a single AI provider that contained no actionable information at all. The Internet Watch Foundation counted a [260-fold rise in AI-generated abuse videos](https://fortune.com/2026/04/03/internet-watch-foundation-260-fold-increase-ai-generated-csam) in one year, from 13 in 2024 to 3,443 in 2025. Investigator time spent sorting synthetic from real is time not spent identifying children. **"It's AI" is now a defence in real cases.** Once synthetic images are indistinguishable, every prosecution involving genuine material invites doubt about provenance. That is a second-order harm to actual victims, and one reason the concurring judges wanted the Supreme Court to look again. **Guardrails only bind hosted models.** Anderegg ran Stable Diffusion locally. Vendor filtering, prompt moderation and account bans reach the API, not a checkpoint file on somebody's own GPU. The concurrence also noted that some training sets have been found to contain real abuse material, which weakens the clean line between "virtual" and "connected to a real child" that Free Speech Coalition drew in 2002. It is the same pattern that shows up across security: a control that only works on the managed path stops being a control the moment the path is unmanaged, which is also [what actually breaks company security](/blog/what-actually-breaks-company-security-2026). --- ## What happens next The concurrence is effectively an invitation. Judges Lee and Kolar wrote that they "would benefit from additional guidance from the Supreme Court regarding the intersection between the First Amendment and virtual CSAM," noting that Free Speech Coalition was decided when the internet was still more of a prototype than a finished product. As of 9 September 2026 there is no reported petition for rehearing or certiorari, and Anderegg still faces trial on the three surviving counts. Congress can legislate, but the panel's reasoning is constitutional rather than statutory, so a new federal statute meets the same precedent unless the Supreme Court moves first. State legislatures did not wait, which is how 46 states already have laws this ruling does not touch. --- ## Summary 1. The ruling is **narrow**: one count, one defendant, self-generated material kept at home, three states. 2. Production, distribution, transfer to a minor, and **downloading or receiving** the material all remain federal crimes. 3. Anything built from a photograph of a real, identifiable child is ordinary CSAM and is unaffected. 4. 46 states criminalise AI-generated CSAM independently, and the UK now criminalises the models themselves. 5. **Businesses:** your policies are unchanged by a First Amendment ruling. Write the escalation path before you need it, and do not assume § 2258A reporting covers § 1466A material. 6. The lasting problem is **detection**, not doctrine: hash matching cannot see synthetic material, and the volume is already overwhelming the reporting pipeline. The court reached a result it did not like because precedent left it no room. That is a legitimate thing for a court of appeals to do, and it is also why this is unlikely to be the last word. --- *Need help writing that escalation path, or working out where your obligations sit across US, UK and EU rules? [Get in touch](/#contact) - the bluwarden team can review your policies and incident response before you need them.* *This post is general information, not legal advice. Liability here turns on jurisdiction and on facts, and the law is moving quickly. For advice on a specific situation, consult qualified legal counsel.*