✓ Primary source verified. All findings cited in this post are drawn directly from the NCOSE 2026 Dirty Dozen List, published 31 March 2026, and from independently corroborated research cited by NCOSE. Tuteliq's analysis and commentary are our own.
The Dirty Dozen List has run annually since 2013. It has produced measurable results. Google, Netflix, TikTok, Verizon, and the US Department of Defense have all changed policies following campaigns. It is not a fringe publication. It is a disciplined, evidence-based accountability exercise by the National Center on Sexual Exploitation, one of the most cited organisations in child protection research. The 2026 list names 12 platforms and one individual. What strikes us at Tuteliq is not the anger behind the list, it is the precision. Every finding points to a failure of infrastructure that is, in principle, solvable.
What the NCOSE Dirty Dozen List is, and what it is not
NCOSE is a non-partisan, non-profit organisation founded in 1962. It leads a coalition of over 300 member organisations. The Dirty Dozen List is its flagship annual accountability campaign, not an opinion survey, but a documented, referenced dossier for each named entity, drawing on legal filings, internal documents revealed in litigation, academic research, and its own investigators' findings.
Past campaigns have led to platform policy changes at Google (2016), Hilton Worldwide (2017), and TikTok (2022), among others. When platforms are named and do change, NCOSE removes them from the list. When they are named and do not, they return. Discord has now appeared five consecutive times.
On scope: Tuteliq's focus is child safety. The NCOSE list is broader, it also addresses adult exploitation, pornography, and sex trafficking. This analysis focuses on the five platforms where the documented harms involve children specifically, where detection infrastructure is directly relevant, and where Tuteliq's integrations or endpoints address the identified failure mode.
The five findings that demand a technical response
Discord. Named 5 consecutive years
NCOSE describes Discord as "a pipeline for grooming, coercion, and sextortion." Predators use Discord to lure minors from other platforms, escalating contact through DMs, video calls, and private servers, using these closed environments to share CSAM and coordinate organised sextortion networks. Promised "teen-by-default" safety settings, announced after Congressional testimony and multiple lawsuits, have been repeatedly delayed.
The structural failure here is not moderation capacity, it is architecture. Discord relies on user reporting as its primary harm detection mechanism. In a private server or DM between a predator and a child, there is no third-party user to report. The harm escalates in a closed environment with no detection layer.
Tuteliq. Discord Integration (Available). Tuteliq's Discord integration provides real-time scanning of all channels and direct messages. Grooming pattern detection, sextortion language identification, coercive control signals, and unsafe content classification, running proactively, not waiting for a user report. Platforms cannot rely on victims to identify their own exploitation in real time.
detect_grooming · AI_ENHANCED_SEXTORTION · detect_coercive_control · tuteliq.ai/integrations/discord
Telegram. Dirty Dozen 2026
NCOSE documents Telegram's channels, bots, and integrated payment systems being used to advertise victims, distribute CSAM, and monetise abuse through cryptocurrency and bot-driven marketplaces at industrial scale. A Wired investigation cited by NCOSE found Telegram is the primary market platform for crypto-funded human trafficking operations, with stablecoins as the payment mechanism.
This is consistent with the AI Forensics study we covered earlier this year, 2.8 million messages across 16 Telegram groups, 24,000 participants, 82,000 files shared in six weeks. Encryption without safeguards does not protect privacy. It protects offenders.
Tuteliq. Telegram Integration (Available). Tuteliq's Telegram integration provides AI-powered grooming, bullying, and self-harm detection in group chats with private admin alerts, without breaking end-to-end encryption for legitimate users. Detection can operate on message metadata and patterns observable to the platform without requiring full content decryption.
detect_grooming · detect_unsafe · detect_social_engineering · tuteliq.ai/integrations/telegram
Snapchat. Dirty Dozen 2026
NCOSE names Snapchat as "a tool of choice for sextortion and abuse", citing the platform's own internal safety research showing it was aware of its role in sextortion escalation, and that solutions were proposed internally and rejected. The IWF's 2025 Report Remove data shows sextortion reports rose 34% year-on-year, with 98% of victims being boys aged 14–17. Snapchat's disappearing message feature is specifically cited as enabling coercion, threats are harder to document and screenshots trigger alerts, adding to victim isolation.
Tuteliq. Sextortion Detection. Sextortion follows a detectable escalation pattern across any platform, flattery, image solicitation, sudden tone shift, payment demand. Tuteliq's AI_ENHANCED_SEXTORTION detection identifies this language sequence in real time, including AI-assisted scripts used by organised networks. The critical intervention window is between threat and first payment, that window is detectable.
AI_ENHANCED_SEXTORTION · detect_grooming · analyze_emotions
TikTok. Dirty Dozen 2026
TikTok first appeared on the Dirty Dozen List in 2020. NCOSE's 2026 finding is that the platform stopped pursuing safety measures and created an environment where predators thrive through livestreams, comments, and private messages. Internal documents cited by NCOSE show TikTok's livestream algorithm incentivises users paying other users to stream sexual content. A 2024 Stanford Internet Observatory study found TikTok's algorithm connected adult strangers to minor accounts within minutes of simulating a child creating a new account.
The algorithm finding is particularly significant from a detection perspective. The harm is not only in individual interactions, it is in the platform's own recommendation infrastructure actively facilitating child exposure. Detection must operate on both the content and the connection pattern.
Tuteliq. Content and Context Detection. Grooming detection analyses conversation dynamics over time, not just individual messages, identifying the pattern of adult-initiated escalation with a minor across multiple exchanges. Emotional distress monitoring surfaces fear and withdrawal signals in a victim's own messages, creating an early-warning layer that operates independently of whether the predator's content would itself trigger a flag.
detect_grooming · analyze_emotions · detect_unsafe
Meta. Mark Zuckerberg (named personally)
NCOSE's decision to name Mark Zuckerberg personally, the first time an individual has appeared on the Dirty Dozen List in its 13-year history, follows the New Mexico jury verdict of March 2026 finding Meta liable for enabling child sexual exploitation ($375 million), and a coalition of 42 US attorneys general pursuing coordinated state actions.
The NCOSE finding is specific: Meta's own internal data showed 3.5 million profiles engaged in inappropriate interactions with children via Instagram DMs in 2019. Researchers recommended defaulting teen accounts to private, an estimated 5.4 million unwanted contacts daily would have been prevented. The recommendation was rejected. By 2022, Instagram's recommendation algorithm was directing 1.4 million teens toward potential predators daily. These are not allegations. They are internal documents revealed through litigation.
The 2026 finding also cites Meta's recent AI chatbot rollout, which included design features allowing the chatbot to engage in sexual conversations with minors, a finding independently confirmed by multiple researchers and reported by major outlets before Meta partially restricted the feature.
Tuteliq. Multi-layer Detection for Social Platforms. The Meta case demonstrates that harm at scale requires detection at the infrastructure level, not the content-review level. Tuteliq's suite covers grooming pattern detection, sextortion escalation, emotional distress in victims, AI-generated synthetic imagery, and coercive control signals, operating across text, voice, image, and video, typical 1.1 to 1.5s response, with zero content retention.
detect_grooming · AI_ENHANCED_SEXTORTION · detect_synthetic_image · detect_coercive_control · analyze_emotions
Apple App Store. Dirty Dozen 2026
NCOSE documents nudify apps, stranger-connection apps rated for 13-year-olds, and sex games rated for preschoolers passing App Store review. 87% of US teenagers use iPhones, making the App Store the de facto gatekeeper of childhood's digital experience. On 17 April 2026, NCOSE formally urged Apple and Google Play to remove search capability and advertising for nudify apps, following a Tech Transparency Project investigation.
The nudify app failure connects directly to our earlier coverage of AI deepfake imagery in schools, documented in 28 countries, affecting over 600 pupils, and traced in every case to freely available apps that passed app store review. The distribution channel for this harm is the app store. The tool of harm is available at zero cost, in seconds, through a platform that markets itself as curated and safe.
Tuteliq. Synthetic Image Detection. Nudify app output carries detectable forensic signatures, pixel statistics, EXIF metadata, and perceptual hashing patterns that distinguish AI-generated imagery from real photography. Tuteliq's 6-signal synthetic image detection pipeline identifies this content before it circulates, operating at the platform level rather than after a victim report.
detect_synthetic_image · SYNTHETIC_CSAM · AI_GENERATED_IMAGE · AI_MANIPULATED_MEDIA
The Watch List, two more platforms on notice
Alongside the Dirty Dozen, NCOSE published a Watch List of platforms where harm is documented but trajectory is being monitored. Two are directly relevant to Tuteliq's detection capabilities.
Character.AI. Watch List 2026
Multiple lawsuits allege Character.AI's chatbots exposed minors to sexual abuse and grooming conversations, isolation tactics, and mental health harms including suicide. The platform has begun to settle some lawsuits and asserts it is adding age-based models and enhanced moderation. NCOSE is watching to assess whether these changes are substantive or cosmetic.
Tuteliq, AI Companion Safety. AI companions that engage in emotional manipulation, isolation tactics, or sexual conversations with minors generate detectable patterns. Tuteliq's coercive control detection, grooming analysis, and emotional distress monitoring apply to AI-generated conversational content as well as human-to-human messaging.
detect_coercive_control · detect_grooming · analyze_emotions
Reddit. Watch List 2026
NCOSE cites Reddit's "woefully insufficient" moderation of user-generated CSAM communities, image-based sexual abuse, and non-consensual imagery sharing. The ICO fined Reddit £14.47 million in February 2026 for failing to deploy any robust age assurance mechanism, a finding we covered in detail in our earlier post on the ICO penalty. NCOSE recommends investigations and lawsuits be pursued against Reddit for continued failure despite years of advocacy.
The structural argument: predictable, preventable, unaddressed
The phrase that appears consistently across the NCOSE findings, and across the regulatory actions, the court verdicts, and the harm data from the IWF, is that these failures were foreseeable. Not just foreseeable in retrospect, but foreseeable at the time, with internal documentation proving it. Discord has been on the list five years. Meta had internal data in 2019. Snapchat proposed and rejected its own solutions.
This is the structural argument that matters most for platform operators. The legal standard is not whether you intended harm. It is whether harm was foreseeable, and whether you took proportionate steps to prevent it. Courts in New Mexico, regulators in the UK, and 42 US state attorneys general are all applying that standard right now. The direction of enforcement is clear.
"When AI promotes child sexual abuse or sexual violence, when social media executives knowingly allow predators to reach children, when digital platforms enable image-based sexual abuse to flourish, it is time for them to be called out and exposed for the harm they are perpetuating. The time for half-measures is over."
, Haley McNamara, Executive Director, NCOSE, 31 March 2026
01. Harm is detectable before it escalates
Grooming follows a documented psychological sequence. Sextortion has a characteristic language escalation. AI-generated imagery carries forensic signatures. These are not invisible harms, they are patterns that detection infrastructure can identify in real time.
02. User reporting is not a safety system
Every platform named by NCOSE relies primarily on user reporting. In a private DM between a predator and a child, there is no third party to report. Reactive moderation is not safety infrastructure. Proactive detection is.
03. The enforcement standard has moved
Regulators and courts are no longer satisfied with policies and promises. They are asking: what technical infrastructure did you deploy? What did it detect? What action followed? Audit trails and documented detection are the new baseline expectation.
04. The cost of inaction compounds
Epic Games: $520M. Meta New Mexico: $375M. Reddit ICO: £14.47M. These are not one-off penalties, they are precedents being cited in active litigation involving dozens of platforms. The financial calculus for non-compliance has permanently shifted.
What Tuteliq addresses, endpoint by endpoint
The following maps each platform finding directly to a Tuteliq detection capability. This is not a comprehensive list, it is the specific intersection between what NCOSE documented and what detection infrastructure can interrupt. All detection operates typical 1.1 to 1.5s response across text, voice, image, and video. Zero content retention. SOC 2 Type II attestation in progress.
--- · --- · ---
Discord · Grooming, sextortion coordination, CSAM in private servers and DMs · detect_grooming · AI_ENHANCED_SEXTORTION
Telegram · Abuse networks, trafficking, CSAM via channels and bots · detect_grooming · detect_social_engineering
Snapchat · Sextortion escalation, coercive image demands, victim isolation · AI_ENHANCED_SEXTORTION · detect_coercive_control
TikTok · Adult-minor grooming via comments and DMs, predatory connection patterns · detect_grooming · analyze_emotions
Meta (Instagram) · Grooming, sextortion, AI chatbot sexual conversations with minors · detect_grooming · AI_ENHANCED_SEXTORTION · detect_coercive_control
Apple App Store · Nudify apps generating AI synthetic CSAM, no age verification · detect_synthetic_image · SYNTHETIC_CSAM · /v1/age-verify
Character.AI · AI companions using grooming and isolation tactics with minors · detect_coercive_control · detect_grooming · analyze_emotions
Reddit · CSAM communities, image-based abuse, no age assurance mechanism · detect_synthetic_image · /v1/age-verify · DPIA audit trail
Detection is not a complete solution. Tuteliq's infrastructure addresses the technical layer, identifying harm patterns in content and conversations. The structural failures NCOSE documents also require regulatory action, platform design changes, legal accountability, and policy reform. Detection that surfaces harm for human review and escalation is part of the response. It is not all of it.
The harm NCOSE names is detectable. The infrastructure exists.
Tuteliq integrates with Discord and Telegram today. Every other platform can integrate via the REST API and 8 official SDKs. Free tier, 1,000 API calls/month, no credit card required.
References
- National Center on Sexual Exploitation. About NCOSE. endsexualexploitation.org/about
- NCOSE. 2026 Dirty Dozen List. Discord. Published 31 March 2026. endsexualexploitation.org/discord
- NCOSE. 2026 Dirty Dozen List. Telegram. Citing: Wired, "Crypto-funded human trafficking is exploding."
- NCOSE. 2026 Dirty Dozen List. Snapchat.
- NCOSE. 2026 Dirty Dozen List. TikTok. Citing Stanford Internet Observatory (2024).
- NCOSE. Mark Zuckerberg Named to 2026 Dirty Dozen List. 31 March 2026.
- NCOSE. 2026 Dirty Dozen List. Apple App Store. Citing Tech Transparency Project investigation, April 2026.
- NCOSE. 2026 Dirty Dozen Watch List. Character.AI. Citing Social Media Victims Law Center lawsuit filings.
- IWF. Report Remove 2025 Annual Data. April 2026. iwf.org.uk
- ICO. Reddit issued with £14.47M fine for children's privacy failures. 24 February 2026.
- McNamara, H. NCOSE Executive Director. Press statement, 31 March 2026.