EU Failure on Child Safety: Why CSAM Detection Laws Must Be Restored

Under EU privacy law, services are generally not allowed to scan the content of interpersonal communications. At the same time, many companies already use technologies that help identify child sexual abuse material and detect attempts to groom children online. Without a specific legal exemption, these safety tools could be interpreted as being in conflict with privacy rules. 

The temporary derogation resolved this potential conflict by explicitly stating that online services can use their detection tools on a voluntary basis, while remaining compliant with EU law. It does not require companies to ‘scan’ messages, but provides legal certainty for those that choose to use safety measures on a voluntary basis only to detect illegal material. 

The temporary framework allowed online platforms to continue using established, highly targeted technologies to detect child sexual abuse within interpersonal communication environments. These include tools that can: 

• Identify known child sexual abuse images and videos using digital fingerprints (“hash matching”)
• Detect previously unidentified abuse material
• Identify patterns that may indicate online grooming
• Report confirmed cases to law enforcement or specialised organisations that process abuse reports 

These technologies are highly privacy-preserving and widely used across the internet. They are deployed successfully in the background on platforms we all use every single day. They play a vital role in identifying victims and stopping the spread of material that revictimises victims and survivors with every share, view and click. 

The temporary derogation was essential because it provided legal certainty for companies working to detect and report child sexual abuse on their platforms. Without it, some companies may feel they cannot safely continue these efforts due to the risk of conflicting with EU privacy rules.

We saw the real-world consequences of legal uncertainty once before. In late 2020, when companies were unsure whether detecting abuse was permitted under EU law, reports of child sexual abuse material from EU-based accounts to the National Center for Missing and Exploited Children (NCMEC) dropped by 58% in just 18 weeks.

Databases of known child sexual abuse material do not appear spontaneously. They are built because previously unknown material is first detected, verified and confirmed by authorised bodies such as the Internet Watch Foundation. This process depends on technology companies deploying a layered set of tools, including hash-matching, AI-based classifiers, and human moderation, that work together to identify both known and previously unknown CSAM. 

Fewer reports translate into fewer opportunities for authorities to identify victims and intervene. Legal certainty is not just a technicality; it is critical to the proactive work done by companies to protect children online.

Since the EU Parliament last debated these issues, the digital landscape has changed dramatically. Generative AI technologies now make it possible to create child sexual abuse material that has never existed before, content that is inherently unknown and cannot be detected through traditional hash-matching systems alone. Unlike previously circulating material, this content cannot simply be flagged by comparing it to existing databases.

This shift fundamentally changes the detection challenge. Companies now face the urgent need to identify even greater volumes of previously unseen abuse. Legal uncertainty risks slowing or halting these efforts.

Asking companies to deactivate systems developed over more than a decade to keep users safe would mean that child sexual abuse continues unchecked and children remain unseen. A drop in reports would not reflect a drop in abuse.

Last year was a record year for the number of reports actioned by the IWF. The prevalence and volume of CSAM online is enormous.

This is a highly dangerous moment for the EU to require technology companies to dismantle their safety systems.

The temporary derogation was always intended as a short-term solution while the EU negotiates a permanent law to combat child sexual abuse online. This proposal for a permanent law is called the Child Sexual Abuse Regulation.  

That legislation is still under negotiation and is unlikely to be finalised before the current rules expire in April 2026. Without an extension, companies once again face legal uncertainty. 

Over the course of February and March 2026, EU lawmakers negotiated their position on the extension of the temporary derogation.  

The European Commission proposed extending the measure until 2028 to provide enough time for negotiations on the permanent law to conclude. EU Member States agreed that they would like the legal cover to continue until 2028 with its current scope.  

Neither of these positions would imply asking companies to do anything new or different to detect CSAM on their platforms. This is about maintaining the current baseline of protection. 
The situation in the European Parliament became more complicated. Ultimately, the Parliament did not succeed in finding a position that would enable interinstitutional negotiations to proceed.

As a result, the temporary derogation to the ePrivacy Directive lapsed on 3 April 2026.

The official title of the proposal is the “Regulation of the European Parliament and of the Council laying down rules to prevent and combat child sexual abuse” (reference: 2022/0155(COD)). 

You can see the Commission’s original proposal here, and read more about why the Commission recognised the need for this legislation here.

It is commonly known as the “CSA Regulation”, “CSAR”, or the “CSAM proposal”. Some critics have also labelled it “Chat Control”. Read more about why this nickname is misleading here.

The legislation was originally ‘adopted’ or proposed by the European Commission on 11 May 2022. 

The proposal functions as lex specialis in relation to the Digital Services Act, meaning it complements and further specifies provisions of the DSA that are particularly relevant to addressing child sexual abuse material online. Its legal basis is Article 114 of the Treaty on the Functioning of the European Union, which underpins measures aimed at ensuring the proper functioning of the EU internal market.

The proposed CSA Regulation is still a proposal, which means it is not yet in law. It must be agreed between the two co-legislators: the European Parliament, which represents European citizens, and the Council of the EU, which represents the governments of the 27 Member States. The proposed regulation was stuck in the Council of the EU for a long time, but it has now progressed to interinstitutional negotiations, commonly known as trilogues. Though this represents a significant step forward, negotiations are likely to take some months yet.

No. CSAM detection is a targeted process, not mass surveillance. Automated tools scan for matches against known indicators and only flag content that meets defined risk thresholds. Nobody has access to the content of private communications unless a case is flagged for further review under strict procedures – and even then, only the suspected illegal content is shared.

No. These tools operate within strictly defined legal and technical frameworks with a clear and limited purpose: identifying child sexual abuse material. They cannot be used to monitor individuals or political content. Their deployment is subject to independent oversight and must comply with fundamental rights protections, including privacy, data protection, and freedom of expression. Any attempt to repurpose these tools would fall outside their permitted scope and be subject to legal consequences.

No. Hash lists are built and maintained by trusted organisations, such as the IWF, following strict standards to protect their integrity. A hash list can only confirm whether a given hash matches a known image of child sexual abuse – nothing more. Platforms operate in secure environments where only the hash comparison takes place, with no access to the actual image or to user data. Companies can also use privacy-protected query methods, such as Private Set Intersection, to further strengthen security.

No. The IWF advocates for a method called upload prevention, which is entirely privacy-preserving. Upload prevention conducts a check before content reaches the server – before  anything is encrypted and sent – meaning encryption is never touched or weakened. It follows the same principles as everyday security features such as malware detection.

Upload prevention is a privacy-preserving method for detecting and blocking known CSAM. It works by conducting a check on content before it reaches the server, so before anything is encrypted and sent. This means the encryption itself is never compromised. It is a balanced solution that stops known child sexual abuse material from spreading in end-to-end encrypted environments while fully protecting user privacy. 

The IWF has published a dedicated explainer for anyone who wants to explore this in more detail.

If you want to read more about privacy-preserving content moderation, see this paper by the Centre for Emerging Technology and Security.

Upload prevention does not compromise encrypted environments or give anyone access to private messages. Without proactive detection in place, end-to-end encrypted environments have become major channels for the distribution of CSAM. All platforms have a duty to ensure they are not safe havens for criminals targeting children. Upload prevention allows platforms to uphold both the security of private communications and the fundamental rights of victims and survivors.

No. Blocking CSAM can never be a pointless endeavour. Every barrier put in place stops criminal content from circulating and protects victims and survivors from being revictimised. When these images resurface online, so does the abuse – for victims and survivors, the harm does not end when the crime itself stops. Every time that material is shared, their dignity and right to privacy are violated all over again. The goal is to narrow the spaces where CSAM can be shared until it is virtually impossible.