Observed 9 September 2026. Acquisition closed after six focused queries and the named primary pages below. This is an administrative-document review, not a service test or a complete licence audit.
The evidence supports conditional access through different instruments. It does not establish a public entitlement to PhotoDNA, a licence refusal against a named applicant, or permission to obtain every reference-hash collection. The dates and product distinction matter: the posted Cloud terms carry a May 2018 update date; that text cannot establish the terms of a later Tech Coalition software sublicense.
What recipients receive
Microsoft describes PhotoDNA as software that computes an image signature for comparison with other signatures; a reference database supplies previously identified material for matching. Its landing page reports a donation of the technology to NCMEC and free provision to qualified organizations and law-enforcement tool providers. These statements do not themselves convey an open-source licence or a recipient's independent rights to every comparison database. [Microsoft PhotoDNA](http[local research file] substantive headings “How does PhotoDNA technology work?” and “Who uses PhotoDNA technology?”, retained derivative lines97–104.
The FAQ distinguishes installed technology requiring integration from the hosted REST service. It describes Cloud applicants as trusted online providers/businesses hosting user content, approved individually following an unnamed third party's evaluation; keys follow vetting. It directs law enforcement toward forensic-tool providers or the on-premise licensing process rather than this Cloud offering. The posted FAQ says Cloud handles images, while a separate PhotoDNA technique can handle video. It advertises a benign-image integration environment and says customer images are not stored. These are provider descriptions, not independently observed operating guarantees. [Microsoft FAQ](http[local research file] retained derivative lines87–116.
The documentation landing places portal access, sample code and test transactions after onboarding and describes subscription-key REST calls comparing a supplied image or URL against a hash set. That establishes a described matching interface; it does not promise a raw reference-set download. The linked portal was not opened. [Documentation](http[local research file] retained derivative lines86–91.
Cloud control clauses, with their date preserved
The live-posted terms, visibly updated May 2018, incorporate MOSA/Online Services Terms and give these specific terms precedence. Microsoft retains eligibility discretion, reverification and access suspension. Customers must supply accurate information, secure accounts and report account-security breaches. Use is restricted to preventing CSAM distribution and supporting related investigations. Customers authorize usage audits and customer-identified aggregate match-count reports to NCMEC; those reports do not replace customers' own legal reporting duties.
The text specifies internal use, excludes managed-service provision, gives a 30-day subscription term, allows throttling, and describes limited free transactions or Content Moderator charges for high volume. It supplies neither support nor an SLA and contractually excludes Microsoft Azure Service status. That designation differs from the FAQ's hosting statement that the service runs on Azure. The dated pricing references are not a verified September 2026 commercial offer. No refusal-review procedure was located in these seven sections; incorporated agreement versions remain unexamined. [Cloud terms](http[local research file] sections1–7, retained derivative lines86–115.
A documented licensing outcome
Microsoft's 19 March 2012 announcement says the “Netherlands Forensics Institute” (publisher's wording) and New Zealand Department of Internal Affairs had licensed PhotoDNA source code. It separately describes NetClean and CETS integration routes and direct licensing for agencies able to integrate the code. This is a dated licensor account of named software access, not an executed agreement, current licence status, cash grant or proof of a particular enforcement action. [Microsoft announcement](http[local research file] reader lines14–18. Original GET returned403; the complete substantive public-reader extraction is retained instead.
Tech Coalition and the boundary still open
The parallel Tech Coalition lane owns its expanded sublicense announcement and application rules. None of the Microsoft pages read here identifies Tech Coalition as the unnamed Cloud vetter, supplies its master sublicense agreement, or establishes that the Cloud terms govern its software distribution. Keep these as separate instruments unless a contract cross-reference joins them. Likewise, Microsoft's NCMEC technology-donation account is not a finding about who selects or corrects a particular reference entry; the root NCMEC lane examines those administrative rules separately.
No named Microsoft rejection or revocation decision, current signed on-premise licence, or TC master licence was located in this finite pass. That is a search limitation, not proof of universal approval or absence of restrictions. A current dated software licence/sublicence form and a public executed approval or reasoned refusal would discriminate between advertised availability and the precise approval, downstream-use, termination and reconsideration machinery. Likely custodians are Microsoft licensing and the relevant sublicensor; no contact was made.
The local forest implication is that technical availability passes through separate approval and data-access decisions. A historical software grant supplies an actual access outcome; the posted Cloud terms supply express continuing control. Neither alone establishes authority over a recipient's individual moderation decision or a working correction chain after an underlying reference changes.
Source custody and reading scope
microsoft-captures.json records URL, observation time, original/derived hashes, HTTP state and exact substantive reading scopes. Four original HTML responses were retained and hash-checked: home, FAQ, Cloud terms and documentation. Their complete substantive bodies were read; navigation and footer material were not treated as evidence.
The 2012 source has only microsoft-licensees-2012.reader.json: its SHA identifies the reader extraction, not original HTML. The ordinary403 route is closed. No incorporation-by-link terms were presumed read; no application, account, authenticated portal, endpoint transaction, media or reference hash set was accessed. Six recorded focused queries close this instrument-level pass. The court-text leads Rosales and Bebris were relayed to the root lane as secondary leads only and supply no findings in this packet.