‘Chat Control’? A revived European proposal on online child safety and its implications for your personal data.
Grand Place, Brussels, Belgium.
Over the past few decades, the internet has become integral to daily life. Most individuals consume media across various digital platforms and conduct routine communication via direct messaging, thereby actively contributing to the continuous generation of data stored on these platforms' servers. The expansion of the online environment has fundamentally altered how information is retrieved and shared, yet it has also facilitated the spread of illicit content due to inadequate oversight mechanisms and the overwhelming volume of data.
The European Commission recognised the prominence of one problematic type of content: online child sexual abuse material (CSAM). Referring to material showing a child engaged in real or simulated sexually explicit conduct, CSAM also encompasses disturbingly realistic AI-generated imagery.[1] Organisations such as the National Centre for Missing and Exploited Children ('NCMEC') to whom US providers are obliged to report under US law when they become aware of child sexual abuse on their services, received over 21 million reports in 2020, of which over 1 million related to EU Member States. The most recent reporting figure for 2021 shows a further increase, approaching the 30 million mark.[2]
In response to this evolving threat, in 2022 the Commission proposed a draft Regulation under the name COM(2022) 209 final, intended to strengthen the detection, reporting, and removal of CSAM across the European Union (hereby referred to as 'the proposal' or 'the CSAM Regulation').
Building on the 2020 EU strategy for a more effective fight against CSAM, the proposed regulation would complement the existing Child Sexual Abuse Directive and repeal the very similar temporary Regulation 2021/1232, the so-called Interim Regulation, both allowing for a partial derogation from Directive 2002/58/EC (the ePrivacy Directive).[3][4]
The content control mechanism is straightforward: providers compile mandatory risk assessment reports and present the envisaged mitigating measures on the risk of their platforms being misused to the newly created European Centre on Child Sexual Abuse ('EU Centre') an independent agency with the purpose of report coordination and contacting national law enforcement.[5][6] The EU Centre may under certain circumstances conduct online searches for child sexual abuse material or notify such material to the providers of hosting services concerned requesting removal or disabling of access, for their voluntary consideration (Article 49).[7] Detection orders may then be issued by courts on the request of the Coordinating Authorities, i.e. national authorities relevant to the investigation and delegated to this function in advance.[8] Then, based on the assessment and a list of indicators picked out and verified by the EU Centre to identify illegal material, the Coordinating Authorities assess the accessed data.[9] While providers remain relatively free to choose how to meet their obligations, they must deploy the least privacy-intrusive, state-of-the-art technologies while minimising false positives.[10] Coordinating Authorities may issue removal orders if CSAM is not taken down in a timely manner, while internet access providers must block images and videos that cannot be removed.[11]
However, implementing digital safety mechanisms raises a legal question: how to balance effective enforcement against illicit content with the preservation of user privacy.
Although it was first drafted back in 2022, it has recently become the topic of discussion because of the adopted extension of the very similar Interim Regulation due to concerns about privacy and potential compromising of encryption.
The procedural history of the CSAM Regulation begins indirectly in 2021, with the adoption of the Interim Regulation, which was in effect until April 2026 but an extension until 2028 was successfully voted upon this year[12] with the goal to avoid a prolonged legal gap pending the adoption of the long-term legal framework. The Interim Regulation does not require companies to scan their services, but only provides for a legal basis to store data and run it through CSAM detection technologies and report back to a 'supervisory authority'[13], posing a temporary solution but lacking some of the technical essential details of the long-term proposal, including the creation of the EU Centre. Another provision ensures that end-to-end encrypted communications remain excluded from the renewed temporary rules - an amendment proposed by the European Parliament (EP),[14] which was also well-received in the Council even if it remains open whether it will make the final text.
The long-term CSAM Regulation passed through the EP in 2023 and made it possible for trilogue negotiations, i.e. informal discussions between the Commission, the Council and the EP, to begin once the Council adopts its position. This happened in November 2025, leading us to more recent times, as the fifth trilogue took place on June 29, 2026. Despite progress, no final agreement could be reached. Positions differ particularly widely on the issue of detection orders. While the Council wants to leave it to providers to take voluntary measures, the EP advocates for mandatory detection orders from judicial authorities in cases of reasonable suspicion. However, internet services are permitted to voluntarily scan their users' content, according to member states. The ePrivacy Directive explicitly prohibits this.[15]
However, what has sparked controversy is the July 2026 vote to extend the Interim Regulation because more Members of the European Parliament voted against the measure than in its favour. Nevertheless, opponents failed to reach the absolute majority required to reject the proposal under the parliamentary procedure chosen to adopt the act. The rejection motion received 314 votes, compared with 276 votes in favour and 17 abstentions, while at least 361 votes were necessary to block the proposal. This threshold applies because, under Article 294 of the Treaty on the Functioning of the European Union (TFEU): once an act reaches its second reading, the voting rules move beyond the standard simple majority (50 percent) requirement. Defeating a Council's position requires an absolute majority of all seated MEPs, which is 361, and because 112 MEPs were absent during the final session before summer recess, their empty seats effectively counted as a "yes".[16]
The bottom line is that the rules in the proposal are already largely applied in the face of the Interim Regulation and will be for two more years, when it is possible that the attitude of the legislator will be swayed in favour of the long-term CSAM Regulation anyway. This seems to be the current trend, as both legislators were hesitant at first and affirmative later.
The Commission's explanatory memorandum for the Regulation begins with the existing sector-related framework leaving gaps in enforcement. The Child Sexual Abuse (CSA) Directive harmonises criminal law provisions about definitions of CSAM and exploitation offences, the corresponding sanctions, and requires the establishment of prevention and victim support measures[17] but leaves it to Member States' (MS) authorities to comply with those responsibilities in the way that suits national specificities. This is due to the instrument chosen – a directive is not directly binding on EU citizens and legal persons operating in the EU, it needs to be integrated in national legal systems by each Member's legislator. The CSAM Regulation solves this issue from an internal market perspective, i.e. private companies offering their services in the European Single Market would not need to adjust their practices depending on the Member State, as regulations become binding immediately upon adoption on European level, also referred to as direct effect.[18]
From the Commission's perspective, this harmonization is essential due to already existing differences in the way the CSA Directive was transposed and further attempts on a national level. Some Member States relatively recently adopted new legislation unrelated to the Directive (e.g. Germany, Austria, the Netherlands)[19][20][21]. Approaches are by nature limited to national jurisdictions, which is unsuitable given the cross-border nature of the Internet.
By creating immediate and identical obligations for providers, the Commission hopes to have an 'indirect' effect on the implementation of the CSA Directive by essentially outsourcing activity on the Member States' side, many of whom have disregarded their obligation to transpose the Directive into national law. According to the Impact Assessment of the proposed Regulation issued by the Commission, a study for evaluating the CSA Directive shows that now there are ongoing infringement procedures against 21 Member States.
The other issue with existing legislation, so the Impact Assessment Report, is the lack of cooperation in prevention and investigation. To root this out, the CSAM Regulation creates the EU Centre, which will work closely with Europol. The Centre will receive the reports from online service providers, make sure they are likely to be actionable, i.e. not unfounded and can in principle be acted upon, and forward them to Europol and national law enforcement agencies.[22]
The Europol Regulation sets out the mandate of the EU's law enforcement agency Europol, which is to support and strengthen action by competent authorities of MS and aid their cooperation, especially in preventing and combating serious forms of crime. Europol's mandate allows the agency to store, process and exchange criminal intelligence and to notify MS of any connections between offences, and to organise investigations. The EU Centre would not have any operational capability on investigations. In this way, it could make the process quicker by providing ready processed material without elongating or complicating the investigations themselves. It could also contribute to MS' efforts towards prevention through sharing of best practices.[22]
Another important aspect of the act is that providers are expected to cooperate with MS, the EU Centre and further institutions. But why does the Regulation focus on providers? Online intermediaries are often the only ones to have the possibility to detect the ongoing abuse. Frequently, the abuse is only discovered thanks to the efforts of online service providers to detect CSAM on their services. In a 2022 study, two-thirds of respondents who received sexually explicit material online as children from an adult they knew or someone they did not know, received it through a private messaging service (68%).[23]
Where providers detect online child sexual abuse, they are under no obligation under EU law to remove such material, so the Explanatory Memorandum to the CSAM Regulation. Given its obviously illegal nature and the risk of losing the liability exemptions, providers will regularly choose to remove it (or to disable access thereto). This refers to Arts. 12-15 e-Commerce Directive and Art. 7 Digital Services Act, according to which technical intermediaries from liability for third-party content, provided act in good faith and with due diligence when carrying out voluntary moderation. However, relying on good-faith voluntary actions of providers has proven to be unproductive.
The Commission argues that reliance on voluntary actions may be affected by changes in companies' policies. In 2023, Facebook implemented end to-end encryption (E2EE) by default in its instant messaging service.[24] Encryption means a security technique that conceals data by applying mathematical algorithms, so that it can only be decrypted by parties that hold the correct key. In the absence of accompanying measures, it is conservatively estimated that this could reduce the number of total reports of CSA in the EU (and globally) by more than half.[25] These estimates were confirmed after Facebook announced that it had stopped the detection of CSA in its instant messaging service in December 2020.
In the same way, in November 2020, Google announced that it had begun rolling out E2EE on Google Messages.[26] Other similar services that already incorporate E2EE, and which presumably have similar, if not higher, levels of CSA, include WhatsApp, Apple's iMessage, Telegram and others[27], showing a general trend of providers towards maximizing privacy.
One of the main points of scepticism revolves around uncertainty about the safety of the technology, which may be used by providers to execute detection orders, and whether it will compromise encryption. It is implied from the Impact Assessment that it likely is client-side scanning (CSS), a mechanism that allows on-device analysis of data before information is encrypted. The implication comes from the "mathematical impossibility of Server-Side Scanning". The European Data Protection Board (EDPB) and European Data Protection Supervisor (EDPS) note that for services utilizing E2EE, the service provider structurally cannot access the data while it is in transit. Therefore, to comply with a legal mandate to scan without technically breaking the cryptographic transit tunnel, the only alternative left to providers is to intercept and analyze the message at the endpoints (the user's device) before encryption occurs.[28] This is observed after an assessment by the Commission's technical expert group, which selected most viable detection methods, all of which are forms of CSS, including "on-device full hashing with matching at server" and "on-device partial hashing with remaining hashing and matching at server", despite both of them being reported to have level of secureness as "medium-low".[29] This leaves space for scepticism and accusations about potential surveillance efforts due to lack of transparency.
Furthermore, the EDPS and the EDPB note that the Proposal should foresee that technologies used to scan text in communications must not be able to deduce the substance of the content of the communications.[30] Currently, the Proposal simply provides in Art. 10(3)(b) that the technologies must not be able to 'extract' any other information than the relevant to the execution of a detection order. The two organisations, in their joint opinion, find this standard to be insufficiently stringent; it might be possible to deduce conclusions based on the substance of a communication without extracting information from it as such.[31] The EDPB and EDPS further point out that the Proposal sets no technology-specific requirements, whether concerning error rates, the use and validation of classifiers, or other limitations.[32] Consequently, the development of such criteria is left to practice when determining whether the use of a particular technology is proportionate, further undermining the Proposal's precision and clarity.
It is crucial to point out that the EU Centre will need vast data storages to not only to issue reports to several institutions, but to be able to function as a hub for fostering good practices. Art. 22(1) of the Proposal indicates that providers may also preserve information for the purpose of improving the effectiveness and accuracy of the technologies to detect online CSAM, but they shall not store any personal data for that purpose. The EDPB and EDPS note it might be difficult to ensure in practice that no personal data are stored for that purpose, as most content data and other data processed for detection purposes is likely to qualify as personal data.[33]
Firstly, the concern over effectiveness is due to the Proposal's enormous scope. It refers to a few types of addressees, including hosting services – store user-provided information, whether website files, application data, or user-generated content, i.e. cloud storage, file-sharing services, blog hosting etc. – and interpersonal communication services – messaging apps, direct messages (DMs) on other platforms, e.g. on social media, email services and others.[34] The scope of application encompasses the majority of modern-day online presence, putting the feasibility of proper detection into perspective.
A second point of contention is the administrative weight these processes carry. Art. 50(4) of the 2022 CSAM Proposal obligates the EU Centre to "provide the information referred to the execution of its tasks [...] to other Union institutions, bodies, offices and agencies, Coordinating Authorities, [...] and other public authorities of the Member States". The wording does not specify the requirements for granting information, nor to whom it could be granted. This would suggest that possibly a variety of unrelated actors within the larger EU institutional framework would be provided with details potentially compromising the investigation of their case.[35]
Furthermore, article 53(2) of the Proposal requires that Europol and the EU Centre shall provide each other with 'the fullest possible access to relevant information systems, where necessary for the performance of their respective tasks and in accordance with the acts of Union law regulating such access.' This will happen in the context of Article 50(2), which broadly tasks the EU Centre with acting as an information and expertise hub, collecting data, and supporting information-sharing initiatives. Without granular restrictions on what types of information are strictly necessary for these purposes and given that the conditions of Europol's access to data are not specified, this can be seen as a far-reaching step. It is not explained why it is necessary to grant Europol direct and almost unlimited access to the information systems of a non-law enforcement agency, containing highly sensitive personal data, whose link to criminal activity and crime prevention may not have been established.[36]
What is more, with such a high-risk processing, 12% failure rate as per Impact Assessment Report presents a high risk to data subjects affected by false positives.[37] It is unlikely that service providers could commit enough resources to review such a percentage of false positives.[38]
are false alarms
To add to this, there is a systematic and financial incentive for providers to disproportionately favour over-reporting.[39] The Cooperation Authorities have the power to impose fines for non-compliance with orders, or to request a judicial authority to do so. The scope of the penalties under Art. 35 is reasonable, with the maximum amount being 6% of global turnover of the preceding business year, which in comparison, for example, to the GDPR, has a higher cap on penalties (maximum fine is €20 million or 4% of annual global turnover, whichever is higher, see Art. 83(5) GDPR).[40] Compared to this, the maximum penalty for false reporting is capped at just 1% of global turnover (see Art. 35 (3) CSAM Regulation), incentivising companies to process more data and submitting reporting to avoid the stricter liability for negligently under-reporting. It is also implied that providers would prefer to infringe on GDPR provisions rather than on the CSAM Regulation depending on the infringement.
Despite the above, there are attempts to create checks and balances in certain provisions of the proposal. Under Art. 50(1), the EU Centre will make available technologies for providers to install for free to execute detection orders. Before including specific technologies on those lists, the EU Centre ought to request the opinion of its Technology Committee and of the European Data Protection Board. Under Art. 10(4), providers should establish effective internal procedures to prevent and, where necessary, detect and remedy any misuse of the technologies, indicators and personal data. They should further establish and operate an accessible mechanism that allows users to submit complaints about alleged infringements of providers' obligations (see Art. 12(3)).
There is a general sentiment in the EU toward strict data protection on a principal level, combined with a developed state of legislation to reflect it. Having said that, the European legislator has left room not only to allow a change of direction in case of emergencies, but has the political will to back off from the commitment to privacy to address a more emotionally tense issue. However, the question of conformity to the adopted EU legal framework protecting privacy remains. It would be answered only after a discussion whether the measures in the regulation are necessary, suitable and proportionate solutions (Art. 5(4) Treaty on the European Union, TEU), and are compatible with a democratic society (Art. 52 (1) Charter of Fundamental Rights of the European Union, CFR).
The scope of data processing is indicative of the concerns about proportionality. The CSAM Regulation "restricts in some respects the scope of the rights and obligations under the relevant provisions of [the ePrivacy] Directive", as mentioned in its explanatory memorandum. Thus, one can assume that the data covered is of the same type as in the restricted articles. Art. 1 (3) CSAM Regulation mentions limiting to the necessary extent the exercise of the rights and obligations in 5(1) and (3) and Article 6(1) ePrivacy Directive. These provisions are all related to confidentiality of communications and the related 'traffic data', especially prohibiting listening, tapping, or other kinds of interception and creating the obligation for providers to anonymise and erase traffic data processed, when it is no longer needed to transmit a communication. Traffic data is understood as any data processed for the purpose of conveying a communication on an electronic network (Article 2(b) ePrivacy Directive).
The Court of Justice of the European Union (CJEU) has repeatedly acknowledged that traffic data can reveal highly sensitive information about individuals, including enabling the tracing of the source and destination of a communication, the identification of its date, time, duration and type, and the establishment of the location of a mobile device.[41] When considered as a whole, such data "is liable to allow very precise conclusions to be drawn concerning the private lives of the persons whose data has been retained, such as everyday habits, permanent or temporary places of residence, daily or other movements, the activities carried out, the social relationships of those persons and the social environments frequented by them."[42] Particularly in relation to prevention and the development and recording of "good practices", the prolonged storage of such information appears implied.
Such legislation clashes with the fundamental rights enshrined in Articles 7 and 8 of the Charter of Fundamental Rights of the European Union ('Charter' or the CFR) concerning the right to privacy and the right to the protection of personal data.
The justification of this process is found in the Proposal's memorandum, which refers to Article 15(1) of the ePrivacy Directive. This provision allows Member States to adopt restrictions on the rights and obligations related to traffic data under the condition that they fulfill the requirements of necessity, suitability and proportionality under Art. 52 of the Charter. However, the EDPB and EDPS recall the CJEU clarified that Article 15(1) must be interpreted strictly[43]: the exception to the principle of confidentiality of communications permitted under Article 15(1) must remain an exception and must not become the rule.
The Court then argues in Tele2 Sverige AB and Watson that „even if such legislation does not permit [permanent] retention of the content of a communication and is not, therefore, such as to affect adversely the essence of [the right to private communication]", the retention of such concrete data could nonetheless have an overwhelmingly negative effect on the way one uses a platform.[44] Consequently, this would prevent the exercise by the users of their freedom of expression, guaranteed in Article 11 of the Charter.
As EDPB and EDPS point out, the rights enshrined in Arts. 7, 8 and 11 CFR are not absolute rights but must rather be considered in relation to their function in society. At the same time, any limitations must comply with Art. 52(1) of the Charter, including respect for the essence of the rights they limit and genuinely meeting objectives of general interest. Unarguably, preventing the spread of CSAM qualifies as far as the criteria of general interest. The essence of a right is affected 'if the right is emptied of its basic content', according to CJEU jurisprudence. The interference may not constitute, in relation to its goal, such a disproportionate and intolerable interference, that the individual cannot exercise it at all; that it ceases to exist.[45] This is the effect of the 2022 CSAM Regulation many experts foresee.[46]
History of attempts to introduce similar measures to the one in the proposal have resulted in a similar amount of backlash.
For the first time, an EU-wide data retention framework was introduced in 2006 through Directive 2006/24/EC (the Data Retention Directive), adopted under the first Community pillar on the basis of the EU's internal market competence. It required providers to retain traffic and location data of all users for periods ranging from six months to two years[47], making it available to national authorities for investigations for a prolonged period of time. Notably, the content of communications itself was excluded from the retention obligation.[48] The Commission justified this approach by pointing to the difficulties faced by law enforcement in accessing traffic data, which telecommunications providers had traditionally retained for their own commercial purposes.
In the joint cases Digital Rights Ireland and Seitlinger and Others, the CJEU confirmed that the indiscriminate retention of the data for the purpose of allowing competent national authorities to have possible access to them, does genuinely satisfy an objective of general interest, i.e. contribution to the fight against serious crime and ultimately to public security. However, the Directive had a similar flaw of the new CSAM Regulation: the proportionality principle was not respected.[49] Consequently, the Court declared the entire Directive invalid, with an ex-nunc effect (from the moment of the judgement onwards). The precedent, while not binding for all future cases, is indicative of the future practice of the Court, as it relies on a de facto system of precedent in practice.
Unsurprisingly, the Court found that the retention of data required by the Data Retention Directive constituted a particularly serious interference with the fundamental right to privacy and the other rights laid down in Art. 7 CFR. However, it was not considered to be "such as to adversely affect the essence of those rights" given that the Directive did not permit extracting the content of the electronic communications as such.[50]
From this case law it may be inferred that measures permitting public authorities to have access on a generalised basis to the content of a communication are more likely to affect the essence of the rights guaranteed in Articles 7 and 8 of the Charter. As to the 2022 proposal, if one could prove that truthful conclusions could be drawn based on the collected data, deduction (and not textbook extraction) would also infringe on the CFR.
The fight against CSAM is unquestionably a legitimate and urgent objective, but the means chosen to pursue it cannot be exempt from the very principles the European Union claims to protect. A system capable of scanning messages we would prefer to remain private and processing vast quantities of data risks transforming law enforcement techniques into an ordinary feature of digital life. The parallels with the invalidated Data Retention Directive and the warnings of multiple institutions should therefore be taken seriously rather than treated as obstacles to an emotionally compelling policy objective.
With that being said, there remains hope that further negotiations heal the flaws of the CSAM Regulation. What is certain is that they will reveal whether there is the political will to de-prioritise big tech to this effect.