Csam Screening

OpenRouter, a service that routes developers' requests to models from many AI providers through one API, says it will screen every inference request for child sexual abuse material (CSAM) as it passes through, and that the screening covers customers on its Zero Data Retention (ZDR) policy. The practical change for ZDR customers is a narrow exception to the promise that OpenRouter keeps nothing: content flagged as possible CSAM may now be retained for human review, reporting and legal preservation.

According to the announcement, screening happens during request processing. It compares content against hashes, digital fingerprints of material already identified as CSAM, which catches known images. OpenRouter also says it may retain content flagged as potential CSAM for human review even when it matches no known hash, and it stresses that a flag is a suspicion, not a determination. It notes that classifiers can identify suspected material not yet in any hash database, and cites guidance from the National Center for Missing & Exploited Children (NCMEC) recommending hashing and image classifiers for services that handle images and video, including generative AI.

OpenRouter says it is rewriting its ZDR terms to state the exception explicitly: for covered traffic it does not retain prompts or responses after processing, unless the customer asks it to store them or retention is needed for CSAM review, reporting and related legal preservation. It says the provision does not permit retaining ZDR content for other purposes and that its commitment not to train on inputs or outputs continues. The company grounds the change in U.S. law, which requires covered providers to report apparent offenses to NCMEC's CyberTipline and to preserve reported material for one year. By its reading, that preservation duty applies to material actually reported, not to everything flagged for review.

The announcement covers only OpenRouter's own handling. Model labs and providers behind it may run their own screening, and some keep content for a period to run automated safety checks before anything is flagged. OpenRouter tells customers with strict retention requirements to check those provider policies separately, since its ZDR terms do not govern them.