The European Union is moving to restore temporary rules that permit certain online communication providers to scan private messages voluntarily for child sexual abuse material.
The stated objective is urgent and legitimate: identify abusive material, report suspected offenses and prevent images of child sexual abuse from continuing to circulate online.
The privacy implications are equally serious.
Scanning private communications requires a provider to analyze information that would ordinarily be protected by the confidentiality requirements of the EU’s ePrivacy framework. Even when the scanning is automated and directed toward illegal material, the system must still examine communications belonging overwhelmingly to people who are not suspected of a crime.
That tension has turned the legislation into one of Europe’s most consequential digital-rights disputes.
Supporters argue that providers need a lawful mechanism to continue detecting child sexual abuse online while the EU completes a permanent regulatory framework. Critics warn that repeatedly extending a temporary exception could normalize widespread inspection of private communications and establish technical infrastructure that may later be used for broader purposes.
The European Parliament Revived a Rule It Rejected Months Earlier
The temporary framework originated in Regulation (EU) 2021/1232, which created a limited exception to certain ePrivacy Directive requirements. It allowed providers of messaging, webmail and similar communication services to use specific technologies voluntarily to detect, report and remove online child sexual abuse material.
The framework was initially scheduled to expire in August 2024. It was later extended until 3 April 2026 while negotiations continued over permanent EU legislation.
In March 2026, the European Parliament rejected another extension. The temporary regime consequently expired on 3 April.
The Council of the European Union revived the proposal in July by adopting a first-reading position that would extend the framework until April 2028. That triggered a second reading in Parliament under voting rules requiring an absolute majority of all members to reject or amend the Council position.
On 9 July, Parliament adopted amendments that would restore the temporary exception while excluding communications to which end-to-end encryption is, has been or will be applied.
The amended text now returns to the Council. The Council can accept Parliament’s amendments or send the legislation into a conciliation process. The European Commission has said it can support the amended version as a temporary measure.
The Rules Permit Voluntary Scanning Rather Than Government Access
The temporary framework is frequently described by critics as “Chat Control.” That label can obscure an important legal distinction.
The legislation does not give EU officials a universal inbox through which government personnel can read everyone’s messages. It creates an exception allowing covered communication providers to deploy their own technologies voluntarily for the specific purpose of detecting online child sexual abuse.
Under the original framework, providers could process certain communication content and related traffic data to identify known material, detect potentially new material and identify suspected solicitation or grooming of children.
Providers could then report identified material or suspected activity to law enforcement authorities or organizations acting in the public interest against child sexual abuse.
The distinction between provider scanning and direct government surveillance is legally important. It does not eliminate the privacy concern.
From the user’s perspective, a private communication may still be subjected to automated analysis without either participant being suspected of wrongdoing.
The ePrivacy Exception Does Not Cancel the GDPR
The temporary regulation derogates from particular confidentiality requirements in the ePrivacy Directive. It does not create a general exemption from European data protection law.
The GDPR continues to apply.
This means a provider relying on the temporary framework must still address fundamental questions concerning:
- The lawful basis for processing personal data
- Purpose limitation
- Data minimization
- Data protection by design and by default
- Security of the information being processed
- Retention and deletion
- International data transfers
- Data subject rights
- Special-category personal data
- Data protection impact assessments
The regulation itself expressly states that it does not supply the GDPR legal basis for processing. It instead removes a particular ePrivacy obstacle for providers that can otherwise establish the lawfulness of their activity.
This distinction creates a significant compliance burden.
A platform cannot justify scanning simply by pointing to the CSAM derogation. It must determine why the processing is lawful under the GDPR, document that analysis and demonstrate that the technology is necessary and proportionate to the stated purpose.
End-to-End Encryption Became the Central Political Boundary
The Parliament’s July amendments seek to exclude communications protected by end-to-end encryption.
End-to-end encryption is designed so that only the communicating users can access the message content. The service provider does not ordinarily possess the key required to decrypt the conversation.
That protection is important for ordinary users, but it is particularly consequential for journalists, attorneys, human rights defenders, government officials, businesses and victims communicating about sensitive matters.
Attempting to scan end-to-end encrypted communications can require one of several controversial approaches.
A provider could weaken the encryption architecture. It could create an exceptional-access mechanism. It could inspect content before encryption or after decryption on the user’s device through client-side scanning.
Each approach creates a potential security weakness.
A mechanism designed to identify prohibited content may also create a target for hostile governments, cybercriminals, commercial surveillance companies and other actors seeking access to private information.
The European Data Protection Supervisor has warned that client-side scanning can substantially degrade confidentiality and requires strong legal and technical protections for information stored on users’ devices. The Parliament’s encryption exclusion is therefore a material privacy safeguard, not a minor drafting change.
Scanning for Known Material Is Different From Predicting New Abuse
Not all CSAM detection technologies create the same level of privacy risk.
Hash-matching systems can compare an image against a database of digital fingerprints representing material that has already been confirmed as illegal. The system is looking for a match rather than attempting to interpret every image from the beginning.
Detecting previously unknown material is more complicated.
Those systems may use classifiers or other probabilistic technologies to decide whether an image appears likely to contain abusive content. Detecting grooming in text conversations requires additional analysis of language, context and patterns of behavior.
The more interpretive the system becomes, the greater the risk of error.
A tool searching for known material can still produce false matches. A system attempting to determine whether an unfamiliar image is illegal or whether a conversation is grooming can misinterpret consensual communications, family photographs, medical material, jokes, educational content or conversations between teenagers.
The European Data Protection Supervisor has raised particular concerns about technologies used to identify unknown CSAM and solicitation. It has questioned whether general and automated analysis of text communications can satisfy the requirements of necessity and proportionality and has pointed to the error risks associated with probabilistic detection.
False Positives Can Expose Highly Sensitive Information
A false positive in this context is not comparable to an inaccurate advertising recommendation.
A person may be flagged as potentially involved in one of the most serious categories of criminal conduct. Their communications, account information and identifying data may then be reviewed, retained or transmitted to another organization or law enforcement authority.
Even where the person is ultimately cleared, the consequences may include:
- Account suspension or termination
- Disclosure of private communications
- Retention of intimate images
- Law enforcement scrutiny
- Reputational harm
- Emotional distress
- Loss of access to essential communication services
That makes human review, error testing and redress procedures essential.
Providers should be able to explain how a detection system was tested, what error rates were observed, when human review occurs, what information is disclosed and how an affected person can challenge an incorrect determination.
The original temporary regulation requires providers to report information about false positives, safeguards, retention practices and complaints. The practical debate is whether those reporting obligations have produced enough reliable evidence to establish that the framework is operating proportionately.
The EU Still Lacks Complete Evidence About the System’s Impact
The temporary nature of the framework was intended to give the EU time to establish a permanent system.
Instead, the exception has repeatedly been extended while the permanent legislation remains unresolved.
That pattern has intensified privacy concerns because lawmakers are being asked to preserve intrusive processing without a complete picture of how the existing measures have performed.
In its 2026 opinion, the European Data Protection Supervisor noted that available implementation data were insufficient to determine definitively whether the regulation had achieved an appropriate balance between combating child sexual abuse and protecting the fundamental rights of service users.
The EDPS also identified gaps concerning whether providers had used the least privacy-intrusive technologies and whether appropriate data protection impact assessments and prior consultations had been completed.
Extending a temporary rule without correcting those evidentiary and governance gaps, the regulator warned, remains highly problematic. Child Protection Advocates Warn That Losing the Framework Creates Its Own Harm
The privacy objections must be considered alongside the consequences of eliminating detection entirely.
Child sexual abuse material documents an actual crime against a child. Its continued circulation can repeatedly victimize the person depicted, while online communication services can also be used to solicit and exploit additional victims.
After Parliament rejected the extension in March, Europol warned that the resulting legal gap could damage investigations and child-protection efforts.
Europol said it had processed approximately 1.1 million CyberTips during the preceding year that were relevant to 24 European countries. Those reports can contain multiple files and other pieces of information supporting investigations.
Supporters of the temporary framework argue that providers should not be forced to stop established detection practices while lawmakers continue negotiating permanent legislation.
Dutch Member of the European Parliament Jeroen Lenaers has rejected the characterization of the law as general surveillance. He argues that neither Parliament nor the member states seeks a system of mass monitoring and that a permanent framework can balance privacy with children’s rights.
The Real Dispute Is Over the Architecture of Detection
Few participants in the debate dispute the need to combat child sexual abuse.
The unresolved question is whether the technical and legal architecture used to pursue that goal creates an unacceptable surveillance capability.
A narrowly targeted system could focus on confirmed material, specific risk indicators and accounts already connected to credible evidence.
A broad system could analyze communications belonging to entire populations in an attempt to identify the small percentage containing illegal activity.
Those approaches may pursue the same objective but present radically different privacy consequences.
Important safeguards include:
- Restricting detection to clearly defined categories of illegal material
- Excluding end-to-end encrypted communications
- Prohibiting generalized analysis of all text conversations
- Using the least intrusive effective technology
- Requiring independent validation of detection tools
- Mandating human review before reporting uncertain matches
- Limiting data retention
- Providing effective complaint and redress procedures
- Requiring regulatory supervision
- Publishing reliable transparency and error-rate information
Without enforceable limitations, temporary child-protection infrastructure could become reusable surveillance infrastructure.
With limitations that are too restrictive or technically unrealistic, the system may fail to identify children who are being exploited.
Function Creep Is a Legitimate Governance Concern
Privacy law frequently distinguishes between the original purpose for collecting information and later uses of that information.
The same concern applies to communications-scanning systems.
A detection capability introduced for child sexual abuse could face future pressure to identify terrorism, extremist content, fraud, copyright violations, drug trafficking or other unlawful activity.
Each proposed expansion may be presented as socially beneficial. The cumulative result could be the normalization of automated inspection across private communications.
This is known as function creep: a system developed for a narrow purpose gradually expands into additional uses.
Preventing function creep requires more than political assurances.
The limitations must be embedded in the statutory purpose, technical architecture, access controls, retention rules, audit requirements and enforcement regime.
Providers Face Significant Privacy Governance Obligations
Communication platforms considering voluntary detection should treat the activity as high-risk processing.
A defensible program should address the entire lifecycle of the scanning system.
Establish the Legal Basis
The provider should document the GDPR legal basis for each processing activity. The ePrivacy derogation alone is not sufficient.
Complete a Data Protection Impact Assessment
The assessment should evaluate the necessity and proportionality of scanning, risks to users, false positives, potential disclosures, international transfers and available alternatives.
Define the Material and Conduct Being Detected
Known CSAM, unknown CSAM and suspected grooming should not be treated as one undifferentiated category. Each involves different technologies, error risks and legal implications.
Evaluate the Detection Technology
Providers should validate accuracy, bias, resilience, security and false-positive rates before deployment and through recurring testing.
Control Human Access
Any human review of flagged material should be restricted to specially trained personnel operating under confidentiality, security and access-control requirements.
Restrict Retention
Information should not be retained indefinitely merely because it passed through a detection system. Retention should be tied to a documented legal and operational purpose.
Document External Disclosures
The provider should identify which organizations receive reports, where they are located, what information is transferred and which safeguards govern that transfer.
Provide Redress
Users need a meaningful process to challenge account actions or reports resulting from an incorrect match.
Maintain Audit Evidence
The provider should retain evidence showing which technology was used, how it was tested, how reports were reviewed and whether safeguards operated as intended.
The Permanent CSAM Regulation Will Determine the Larger Privacy Outcome
The revived temporary framework is only one part of the European debate.
EU institutions are still negotiating a permanent regulation intended to establish longer-term rules for preventing and combating child sexual abuse online.
That permanent legislation could have substantially broader consequences than the temporary voluntary exception.
The final text will determine whether detection remains voluntary or becomes mandatory in defined circumstances, how risk assessments operate, which services are covered, what role regulators and courts play and whether encrypted communications remain protected.
It will also determine whether Europe adopts a targeted child-protection framework or creates the foundation for continuous communications monitoring.
Child Safety and Privacy Cannot Be Treated as Opposing Values
The debate is frequently presented as a choice between protecting children and protecting privacy.
That framing is incomplete.
Children also depend on privacy. Young people use confidential communications to seek medical care, report abuse, obtain counseling and communicate with trusted adults. Weakening the security of communications can expose children as well as adults.
At the same time, privacy cannot become an excuse for ignoring platforms used to distribute evidence of abuse or target new victims.
The governing challenge is to develop detection measures that are effective against perpetrators without treating every user as a presumptive suspect.
That requires measurable effectiveness, technical restraint, independent oversight and enforceable limits.
Captain Compliance Helps Organizations Govern High-Risk Data Processing
Captain Compliance helps organizations assess high-risk processing, conduct data protection impact assessments, document lawful bases, evaluate vendors and artificial intelligence systems, establish retention controls and maintain evidence supporting GDPR and privacy compliance.
Organizations deploying content detection, automated monitoring or safety technologies should understand exactly what information is processed, how conclusions are generated, where reports are sent and which individuals may be affected by errors.
A legitimate objective does not remove the obligation to govern the technology used to pursue it.
Europe’s renewed CSAM debate demonstrates why the most difficult privacy questions are rarely about whether an objective is worthwhile.
They are about how much access to private information should be permitted in the name of achieving it.
Frequently Asked Questions
Did the European Union reinstate private-message scanning?
The European Parliament voted to restore a temporary ePrivacy derogation with amendments excluding end-to-end encrypted communications. The Council must still accept the amendments or proceed to conciliation before the legislation is finalized.
Does the law require every platform to scan messages?
No. The temporary regime permits qualifying providers to use detection technologies voluntarily, subject to legal conditions. It is distinct from the proposed permanent framework, which has generated separate debate over potential obligations.
Can the government directly read messages under the temporary rules?
The framework permits providers to conduct voluntary detection and report suspected material or conduct. It does not create a general government inbox for reading private messages. However, flagged information may be disclosed to authorized organizations or law enforcement.
Are end-to-end encrypted messages included?
The amendments adopted by the European Parliament exclude communications to which end-to-end encryption is, has been or will be applied. That exclusion must remain in the final agreed text to become legally effective.
Does the ePrivacy derogation replace the GDPR?
No. Providers must still comply with the GDPR, including lawful-basis, necessity, proportionality, security, transparency, data minimization and data protection impact assessment requirements.
Why do privacy groups call the proposal Chat Control?
Critics use the term to argue that scanning private communications, even through automated systems operated by providers, creates a form of generalized monitoring and could establish infrastructure capable of broader surveillance.
Why do supporters consider the framework necessary?
Supporters argue that providers need a lawful mechanism to identify and report child sexual abuse material while the EU completes permanent legislation. They warn that a legal gap could reduce reports and impede investigations.
What is the main privacy risk?
The central risk is that systems may analyze communications belonging to people who are not suspected of wrongdoing, produce false positives, expose highly sensitive information or gradually expand beyond their original child-protection purpose.