That's a really common reaction to people first hearing about the delta between how society talks about the subject vs what they actually do about it. Its a bit like the fiction of the social safety net or strong institutions.

The truth is impunity is the rule, victims especially of CSA and CSAM, or revenge porn, or of Mark or Musk's companies generating naked images of their body have basically no power, and its an exception when someone who is an abuser AND has any amount of social standing is put away.

Does their definition of CSAM exclude material that's not unlawful in the US? People can be (let's say) tactical about its inclusion from case to case. But I can't say if it's the case here, nor how much it explains the 36 million not explained by other better replies.

it can take awhile for things to work their way from NCMEC (national center for missing & exploited children) to the appropriate local agency, then have that agency do their investigation, get a warrant (if they can), etc. and that is assuming that there is even a cooperative jurisdiction for NCMEC to send the initial report to.

but, plenty of people do end up in prison, especially if its facebook/dropbox/gmail/etc... they just dont make the headlines (especially nationally) unless its especially heinous.

In most western countrys, is often more than 50% from CSAM from underaged teenagers, like selfies etc. And then are cases like some overmotivated parents post nude baby pictures. I guess such pictures also get flaged. But even if its just 50%, 18 million, your point still standes. Why are not more people in jail.

media without abuse is labelled csam

VPNs, hacked accounts, no jurisdiction, etc., I'd presume.

Because the overwhelming majority of these reports are for teens sexting each other.

Bots, good luck finding the people responsible for them.

Also how much of the child exploitation material was created by the children themselves?

Teenagers who send each other nude photos are creating child exploitation material but you hardly want to put them jail for that.

Because then half the world leaders would be in jail and the other half would lose their excuse for building mass surveillance systems