"Trade, gift, sell": 1,300 pedophiles caught on TikTok, the marketplace of child pornography

They operate within their own ecosystem of codes for requesting, exchanging, selling, and giving away child sexual abuse material, along with comments that lead to channels outside of TikTok with the same purpose. In this way, they have created a pedophile community that grows based on the abuse of minors. The platform thus serves as a marketplace for pedophiles.

To determine if a user is a potential pedophile, this investigation has focused not only on users with an adult male profile who comment on videos of minors, but also on those who show interest in exchanging, buying, giving away, obtaining, or selling child abuse videos.

“I trade forced,” “I trade in that size”: exchanging is the most common way to share child pornography on TikTok

Across the 50 videos of girls we analyzed, 59% of the comments contained calls to exchange child sexual abuse material. Although many of them simply said “cambio” (trade in Spanish) others provided more information about the type of content they were referring to and remained visible without being moderated by the platform: “I trade mother and son,” “I have niece photos to trade,” “I trade forced,” “I trade sleeping,” and “I have my own homemade” are some examples. There were also messages that referred to the young girls in the videos, such as “trade that age?”, “trade 10 of her,” and “trade in that size.”

According to Javier Sanz, a criminologist specializing in cybercrime and cyberspace behavior analysis, TikTok is mostly inhabited by "the collector or community pedophile": a type of user who does not have or need advanced knowledge, but rather "seeks community and peer validation, and free exchange is more than enough for him."

Several also included coded language. In our previous investigation, “Predators on TikTok: A Goldmine for Pedophiles,” we already warned about the use of the abbreviation “cp,” short for child pornography. Now, we’ve encountered variations of that code, such as “pc,” and phrases beginning with c and p, like “Café con Pan” (Coffee with Bread), “Código Postal” (Postal Code), and “Ce Puede”. These terms aren’t exclusive to exchange messages: they were also visible in comments asking for, giving away, selling, or redirecting to other platforms.

Among these comments, we found some from users asking what “trade” meant. Others responded with: “They have groups about what Epstein did” or “pedos [pedophiles] use it to share illegal content.”

These data are consistent with other research in this area, such as that by AI Forensics, published in April 2026, which analyzed more than 2.8 million messages in Telegram groups that distributed and monetized non-consensual intimate images in Italy and Spain (including child sexual abuse material). They also identified a greater number of "trade" comments (more than 240,000 messages) compared to over 1,400 "sell" comments.

According to the Spanish National Cybersecurity Institute (INCIBE), reciprocity is a common dynamic in child pornography exchange networks: “It can generate a sense of belonging or community within informal networks, in addition to reducing the perceived risk associated with direct financial transactions.” Furthermore, “it is more efficient for a pedophile to exchange (and obtain more material) than to sell (and not obtain more content),” according to criminologist Javier Sanz.

We also found messages from users claiming to sell material (for example, “selling 10 for 3 euros, I’ll send you whatever you imagine, 3-13 years old” or “selling my little sister’s”), but these make up less than 1% of the total messages analyzed. “Exchanging is more common than selling in that TikTok and Telegram environment, but if we go into the Dark Web, the situation changes considerably,” Sanz maintains.

16% of users requested material, while 2% said they were giving away videos

Despite being the most popular, comments about exchanging weren't the only ones: almost 16% of the messages analyzed included requests for material, with phrases like "who will give me some" or "can someone give me some?". Some even seemed to be asking specifically for content of minors, attaching their photos. In these messages, we found a pattern: many said they didn't have anything to exchange and that's why they were asking. In fact, an account that was asking in February left a comment in March saying they were trading. 

Sanz explains that this is what is known as "step-by-step progression in a criminal career": a new member enters this community without their own material, which implies a "social inferiority." The gift they receive serves to "integrate them into the network, to be 'accepted,' and that generates a symbolic debt that can only be repaid by obtaining more material to compensate."

We also found comments promising to give away child sexual abuse material. Sanz explains that these “gifts” aren't given without reason: “What it really does is demonstrate that they have material (a status symbol), build a reputation (the more they contribute, the more credibility), and generate what's known as reciprocal debt.” The criminologist describes it as “when someone gives us something and we feel obligated to return the favor, even when they haven't explicitly asked for it.” Added to this is the social reinforcement the giver receives, which the expert explains comes from the “implicit validation that what they're doing ‘isn't so bad,’ because others are doing it.”

Another phenomenon we detected in the comments is the invitation to groups for exchanging child pornography. These are messages inviting users to join chats outside of TikTok (on Telegram, Zangi, and Signal), mostly under the promise that they will “contribute” videos.

Telegram, Zangi, and Signal: encrypted platforms where pedophiles share child sexual abuse material

From images with QR codes that redirect to the app, to abbreviations like “tlg” or “tlgm,” more than 37% of the comments we analyzed included references to Telegram, the encrypted messaging app. At Maldita.es, we already warned about its use for the exchange and sale of child pornography, something experts attribute to the anonymity and privacy the app provides, which these users exploit as a sales platform.

Mentions of other encrypted apps are also common. For example, Zangi appeared in more than 7% of the messages: an app that, according to its own website, offers the possibility of anonymous registration “without a phone number or sharing personal contact information” and “military-grade end-to-end encryption.” But it has already been flagged for its use in various crimes related to drug trafficking, gender-based violence, and the distribution of child pornography. Zangi is increasingly being used for criminal activities.

Although to a lesser extent, Signal also appears in these messages: the messaging app, which also features end-to-end encryption, is open source and claims to collect less user data than other services. We also find, to a lesser extent, mentions of TikTok direct messages, as well as WhatsApp, Discord and Instagram.

“Any platform that allows communication, whether through messages or comments, and that is popular among children, is susceptible to misuse by criminals,” says a spokesperson for the Internet Watch Foundation. But in particular, the use of tools that offer end-to-end encryption “is very worrying, as it hinders the detection of criminal content, such as CSAM [child sexual abuse material], by not allowing the secure scanning of images by comparing them to lists of known illegal content.”

For his part, Sanz emphasizes that “for those who want to distribute at scale, and not just chat, these three [Telegram, Zangi, and Signal] are the main networks with the logistical capacity to operate as a marketplace,” since they offer “massive distribution capacity.” According to the criminologist, this is complemented by an “anonymity architecture” that allows registration with minimal data, and “minimal friction with authorities.”

From accounts that repost videos of minors to adult men who upload images of their children: these are the profiles behind the comments

“Leaving a comment on a viral video of a minor allows them to ‘fish’ for other interested users, taking advantage of the video’s organic traffic, operating in the shadows of a post that the platform considers ‘safe’,” explains Álex Buitrago, a researcher specializing in social media. Sanz adds that “these are not messages directed at them [the minors]: they are signals between peers, a meeting point to recognize one another within an online community.” Although they are not directed at girls, Pablo Duchement, a professor and forensic computer expert, explains that it generates a “pull effect” towards them: “In the end, we are calling many consumers of child sexual exploitation material to gather around the content of a child.”

What are the TikTok accounts behind these comments like? Almost 74% of the profiles analyzed were public, while 26% were set to private. The vast majority had been created recently: the highest figure in 2025 (33%), and secondly, profiles registered only during the first three months of 2026 (15%). However, there are also accounts created at least since 2017 that continue to operate normally on TikTok, despite their activity.

Several of these profiles contained terms like “trade,” “for sale,” “ce puede,” (variation of Spanish for ‘allowed’, including the code ‘cp’) and others we've already analyzed in their usernames or descriptions, and appeared to be dedicated solely to these activities. But other public accounts belonged to adults, mostly men, who uploaded videos of their lives, jobs, and even of the minors in their families. Why? Sanz explains that it's very difficult to pinpoint a single theory, but that “the behavior is clear enough to consider it, at the very least, an indicator of serious risk,” since “these profiles are not only distributors, but could potentially be active producers or those on the path to becoming so, and the minors appearing in their photos are potential victims at real risk.”

Videos from TikTok of adults who upload photos with minors, compiled by Maldita.es

These types of accounts are joined by those that collect and republish videos of minors (as revealed by the watermarks, which indicate they come from other users). This is a trend we've already warned about, but in this case, it's being used to attract accounts that claim to exchange, give away, or sell child pornography. Several of these include direct links to Telegram in their descriptions or to websites with child sexual abuse material. For example, the latest video shared by one of these accounts has the watermark of an account belonging to a family offering brand collaborations with a 4-year-old "child model."

On these accounts, stolen videos of minors show them dancing, doing gymnastics, applying makeup, or singing. But on other profiles, the videos posted were more explicit. For example, one account has a video of a girl who appears to be a minor kneeling in her underwear, looking at the camera: it has been viewed 1,748 times. Another account, which promotes a Signal group in its description, has uploaded a video where a minor appears completely naked. At the time of publication of this article, these videos are still available on TikTok.

At Maldita.es, we reported a sample of 106 comments on the platform that offered or requested child pornography. Although 99% were removed, TikTok allowed 96% of the accounts that posted them to continue operating normally.

This article was written with the help of Javier Sanz, a criminologist specializing in cybercrime and cyber behavior analysis and contributor of Maldita.es.

Thanks to your superpowers, knowledge, and experience, we can fight harder and better against lies. The Maldita.es community is essential to stopping misinformation. Help us in this battle: send us any hoaxes you come across to our WhatsApp service, lend us your superpowers, spread our debunkings, and become an Ambassador.