When It Happens at Your School
For school administrators, counselors, and teachers. What to do in the first 24 hours, who to notify and in what order, how to support the victim without retraumatizing them, and what the CDT Model Policy requires.
The first 24 hours: sequence matters.
The order in which you notify parties is not administrative preference — it is a trauma-informed standard that affects victim outcomes.
Notify the victim's family first
Before contacting other parents, law enforcement, or the broader school community. The family has the right to know before anyone else — and to have time to prepare their child for what may come next. This is both the ethical standard and the CDT recommendation.
Connect the student with a counselor before any interview
A trauma-informed counselor must be available before any adult asks the victim 'what happened.' Asking a traumatized child to recount the incident without clinical support is a source of secondary trauma. The counselor's role is to stabilize — not to gather facts for the administration's investigation.
Preserve evidence without investigative overreach
Screenshot, timestamp, and document any images or messages brought to your attention — but do not view more than necessary to establish the nature of the incident. Distributing or viewing AI-generated sexual imagery of a minor may constitute a crime. Contact law enforcement before viewing anything yourself; request that evidence be turned over to them.
Contact law enforcement — and know your mandated reporter obligations
If a minor is depicted in sexual imagery — including AI-generated imagery — you are likely a mandated reporter and legally required to report to law enforcement or CPS. The Lancaster, Pennsylvania case illustrated what happens when school officials fail to report citing a 'loophole': that loophole has since been closed in Pennsylvania and several other states.
Notify NCMEC
Contact NCMEC CyberTipline (1-800-843-5678). NCMEC's Take It Down service can initiate hash-based image blocking across participating platforms without requiring the student to submit the image. This can happen in parallel with law enforcement contact.
Communicate carefully to the school community — or not at all yet
Premature or poorly framed communication to parents or the broader school community can amplify harm to the victim. See Section 5 below for what not to say.
Trauma-informed response checklist.
How you respond to the victim in the first hours shapes their long-term outcomes. These principles are drawn from trauma-informed care research and CCRI guidance.
Believe the student without investigation
Your first response is to support, not to verify. The investigation is for law enforcement. Your job is the student.
Offer agency wherever possible
Ask what they would like to happen. Who do they want present? Do they want to go home? Agency in small decisions is therapeutic when large agency has been stripped away.
Affirm: they did nothing wrong
State this explicitly and early. Many victims internalize shame before any adult has spoken to them. Explicit, simple affirmation disrupts this.
Keep the circle of disclosure small
Only people who absolutely need to know should be told. Every additional adult who learns about this increases the victim's sense of exposure.
Ask why they posted or shared anything
This implies the victim did something that contributed to the harm. They didn't. AI-generated NCII requires only that the victim exists and has any publicly accessible image.
Show the images to additional staff for 'confirmation'
This is not necessary, may be illegal, and extends the exposure of images that should not circulate.
Discuss the incident in any group setting with the student present
IEP meetings, parent meetings, or counseling groups where the student is present are not appropriate for discussing the incident.
Ask what the images 'showed'
This question adds no value for the administrative response and can cause significant trauma. The legal determination of what the images contain is for law enforcement.
What not to say to the school community.
Premature or poorly framed communication amplifies harm to the victim. RAND found 2/3 of school staff received no training on this.
Naming the victim in any communication to the broader school community
Why: The victim has not consented to disclosure. Every additional person who knows their identity extends the social exposure that constitutes the core harm.
Describing the images or what they depicted
Why: Describing the content creates a proxy version of the harm — the audience now has a mental image even without the original. It serves no protective purpose.
Framing the communication as 'a reminder about appropriate use of technology'
Why: This implies the victim misused technology. The victim did not. The perpetrator did. Generic framing lets perpetrators off the hook and further burdens the victim.
Announcing consequences before legal process is complete
Why: Pre-announcing consequences creates pressure to circumvent due process and can compromise subsequent legal proceedings.
Communicating to the student body before the victim's family has been fully notified
Why: The victim's family learns about the incident from their child's peers as a result. This violates the sequence that protects the family's ability to respond on their own terms.
The CDT Model Policy: what it includes.
The Center for Democracy and Technology's model K-12 NCII policy is the current legislative standard. Here are its core elements.
A clear definition of NCII that includes AI-generated imagery and requires no distribution to have occurred — possession and creation are covered.
Mandatory reporting requirements triggered by any school employee who learns of a potential NCII incident — not just administrators.
A named victim support coordinator role — a designated counselor or administrator responsible for victim contact and support throughout the process.
A prohibition on victim-blaming language in any school communication, disciplinary proceeding, or interview.
Clear data preservation and evidence chain-of-custody protocols before law enforcement handoff.
Return-to-school planning provisions — including schedule adjustments, counselor availability, and peer support — for victims who experience classroom reintegration challenges.
Staff training requirements — annual, with documentation — covering recognition, response, and mandated reporting obligations.
References and further reading.
Want CPAI resources in your school or district?
We partner with districts, libraries, and nonprofits to deliver research-based AI education where it is needed most.