I assume 18 USC 2258A, but they seem to be going above and beyond. Under current law, they are only required to report, they are not required to prevent[1].

Presumably, they are doing this voluntarily now to stave off future legislation around this that might require more invasive scanning.

1. 18 USC 2258C(c)