Regulation to Prevent and Combat Child Sexual Abuse
European Union regulation proposal on child pornography detection
From Wikipedia, the free encyclopedia
The Regulation to Prevent and Combat Child Sexual Abuse (also known as the Child Sexual Abuse Regulation, or CSAR) is proposed European Union legislation designed to compel digital platforms to assess and mitigate risks related to the dissemination of abuse material and online grooming. The draft law also aims to enable authorities to remove or block illegal content while establishing a specialized center for regional coordination and victim assistance.[1] In public and political discourse, the initiative is widely criticized and referred to by detractors as Chat Control 2.0 or simply Chat Control.[2][3]
| European Union regulation | |
| Text with EEA relevance | |
 | |
| Title | Proposal for a Regulation of the European Parliament and of the Council laying down rules to prevent and combat child sexual abuse |
|---|---|
| Made under | Articles 114 and 294 TFEU |
| Preparative texts | |
| Commission proposal | COM(2022) 209 final |
| EESC opinion | EESC 2022/02804 |
| EP opinion | A9-0364/2023 |
| Reports | A9-0364/2023 |
| Pending legislation | |
While the framework is strongly supported by child advocacy groups[4] and most EU member states,[5] the legislative process has been gridlocked by disagreement over the scope and legal safeguards of automated monitoring.[6][7] Although inter-institutional compromises have been achieved on a majority of the provisions,[8] there remains an ongoing deadlock regarding controversial mandatory detection orders. Civil society organizations and privacy activists contend that requiring social media companies and messaging apps to proactively scan communications would compromise the right to privacy and data protection by introducing indiscriminate surveillance.[9][10][11][16]
Background
The European Union's historical approach to child sexual abuse was fragmented, divided between a 2011 criminal-law directive implemented unevenly by member states,[17] voluntary industry practices by digital platforms, and disconnected law enforcement and victim support initiatives. Official reviews of the 2011 directive identified significant implementation gaps,[18] prompting the Council and the Parliament to call for a more coordinated EU-wide framework in late 2019.[19]
The onset of the COVID-19 pandemic intensified these vulnerabilities by shifting schooling and social interactions online, which increased the digital exposure of children to offenders while simultaneously reducing the operational capacity of hotlines and law enforcement bodies.[20] In response, the European Commission integrated the issue into its 2020 Security Union programme,[21] and formally adopted its strategy for "a more effective fight against child sexual abuse" on 24 July 2020. This comprehensive strategy consolidated prevention, enforcement, and victim support under a single initiative, proposing temporary and permanent legislative measures to harmonize and expand voluntary platform detection mechanism practices.[22]
In October 2022, Article 18 of the Digital Services Act[23] introduced emergency reporting mandates for specific online businesses to flag imminent threats to life or safety. While these mechanisms are broadly compatible with the objectives of the CSAR, the regulation explicitly stopped short of imposing general or proactive content monitoring obligations.[24]
Industry practice
Voluntary detection of child sexual abuse material (CSAM) by digital platforms dates back at least to the mid-1990s, when AOL manually reviewed suspected abuse material and subsequently developed automated detection processes.[25] By 2015, the Internet Watch Foundation (IWF) was distributing a database of digital fingerprints, or hashes, derived from confirmed abuse material. The database included material identified through the IWF's own investigations, reports from the public and internet companies, and the UK's Child Abuse Image Database.[26] Facebook, Google, Microsoft, Twitter and Yahoo participated in trials and implementation of the service, comparing hashes generated from newly uploaded images with those in the IWF database.[27]
The use of automated detection and reporting systems has since become widespread, but their implementation and coverage vary substantially between services. A 2022 analysis submitted in the context of the proposed regulation argued that the voluntary system of detection and reporting by companies had proven insufficient to adequately protect children.[28] The number of reports submitted to the National Center for Missing & Exploited Children (NCMEC) also varies considerably between platforms. In 2020, Facebook submitted 20.3 million reports, compared with 546,704 from Google, 144,095 from Snapchat, 96,776 from Microsoft, and 265 from Apple.[29]
The extent to which these systems can be evaluated is limited by differences in transparency and reporting practices. A 2023 survey of 50 online services found that only 20 published transparency reports on child sexual exploitation and abuse, while only 10 defined such material in sufficient detail to establish what was prohibited on their services.[30][31] A separate study likewise found substantial differences in the metrics and reporting methods used by online services, making it difficult to assess the effectiveness of their measures.[30]
Automated detection
Existing industry practice relies primarily on automated detection technologies. Perceptual hashing is widely used to identify previously known material, while some providers use machine learning to detect previously unknown images and videos, and machine-learning-based analysis of text to identify potential online grooming.[32]
One of the most widely used perceptual hashing systems is PhotoDNA, developed by Microsoft and Dartmouth College in 2009.[33][34] In an analysis published by Ofcom in 2024, a PhotoDNA threshold selected to provide greater resistance to image alterations produced a false-positive rate of 0.3% under the conditions of the study.[35] Published independent performance data for other commercial classifiers and systems designed to detect grooming have generally been limited. Child Rights International Network noted that claims about the accuracy of PhotoDNA and other detection tools were not supported by sufficient independent evaluation, while the European Commission's impact assessment did not provide specific false-positive rates for some of the classifiers it considered.[36][37]
The accuracy and implications of automated detection can vary depending on the prevalence of the material being sought and the characteristics of the detection system. Of 4,192 reports assessed by the Irish police in 2020, 852 were confirmed to contain child sexual abuse material and 471 were classified as false positives.[38] The figures have been cited as an illustration of the base rate fallacy in the context of large-scale detection systems.[39] However, these figures describe reports received and assessed by law enforcement and should not be interpreted as a general estimate of the accuracy of automated detection systems. In contrast, a 2025 European Commission review reported that the automated detections examined in its assessment were "overwhelmingly confirmed" as child sexual abuse material following human review.[40]
ePrivacy derogation
The ePrivacy Directive was adopted in 2002 to regulate the processing of personal data and the protection of privacy in the electronic communications sector. The European Electronic Communications Code (EECC), adopted in 2018, included interpersonal communications services within the EU electronic communications regulatory framework. Member States were required to apply the EECC from 21 December 2020.[41]
The change in the legal framework affected the use of technologies by providers of number-independent interpersonal communications services to detect child sexual abuse material (CSAM) and the solicitation of children in private communications. In September 2020, the European Commission proposed a temporary derogation from certain provisions of the ePrivacy Directive to permit such technologies to continue to be used under specified conditions.[42] The legal uncertainty surrounding the change was associated with a reduction in reports of suspected child sexual abuse material from services operating in the European Union to the National Center for Missing & Exploited Children (NCMEC); the Internet Watch Foundation reported a 58% decrease over an 18-week period in late 2020 and early 2021.[43]
Regulation (EU) 2021/1232 established the temporary derogation in July 2021. It allowed providers of number-independent interpersonal communications services to voluntarily use specified technologies to detect, report and remove online child sexual abuse material and to detect and report the solicitation of children, subject to conditions and safeguards.[44] The regulation entered into force on 2 August 2021 and, following an extension in 2024, remained applicable until 3 April 2026.[45] The derogation was sometimes referred to as "Chat Control 1.0", particularly by organisations opposing the voluntary detection measures.[43]
During 2023, Meta reported that its services had actioned approximately 3.6 million pieces of CSAM detected using its media-matching technology in message threads involving an EU user. Users appealed approximately 7% of these actions, and 4.6% of the appealed items were restored after review.[46]
In March 2026, the European Parliament rejected a proposal to extend the application of Regulation (EU) 2021/1232. On 26 March, Parliament voted by 228 votes to 311, with 92 abstentions, against the proposed extension.[47] Parliament had supported a shorter extension, until August 2027, with a narrower scope, while the Commission proposal would have extended the derogation until 3 April 2028.[48] No agreement was reached with the Council, and Regulation (EU) 2021/1232 consequently ceased to apply on 3 April 2026.[49]
A new temporary derogation was subsequently adopted as Regulation (EU) 2026/1881. Adopted by the European Parliament and the Council on 24 July 2026, it again permits providers of number-independent interpersonal communications services to voluntarily use specified technologies to detect, report and remove online child sexual abuse material and to detect and report the solicitation of children, subject to conditions and safeguards.[50] The regulation was published in the Official Journal of the European Union on 28 July 2026 and is currently in force.[51] It applies until 3 April 2028.[52]
Provisions
In furtherance of its 2020 strategy for a more effective fight against child sexual abuse, the European Commission proposed a regulation in May 2022 to lay down rules for preventing and combating child sexual abuse online.[53] The proposal would establish obligations for online service providers to assess and mitigate the risk that their services could be misused for the dissemination of child sexual abuse material (CSAM) or the solicitation of children. It would also establish procedures for the detection, reporting and removal of CSAM, provide measures to assist victims in removing material depicting them, and establish an EU Centre on Child Sexual Abuse.[54]
Under the Commission proposal, providers would be required to carry out risk assessments covering the possibility that their services could be misused for the dissemination of CSAM or the solicitation of children. Providers would then be required to take proportionate measures to mitigate identified risks, including measures relating to the design and operation of their services, reporting mechanisms and user safety.[55]
The Commission proposal also provides for detection orders, which could require a provider to detect known or new CSAM or the solicitation of children under specified conditions. Detection orders would be issued by judicial or independent administrative authorities and would be subject to requirements concerning necessity, proportionality and safeguards. The proposal also provides for measures to prevent general monitoring and for the protection of users' fundamental rights.[56]
The Commission proposal would establish an EU Centre on Child Sexual Abuse to support the implementation of the regulation. The Centre would receive and process reports from providers, maintain databases of indicators relating to known CSAM, support national authorities and providers, and assist with the identification and removal of material depicting victims.[57]
The European Parliament adopted its negotiating position in November 2023. Parliament's position retained risk assessment and mitigation obligations but proposed narrower conditions for detection orders. Detection orders would be used as a measure of last resort, would be targeted to specific users or groups of users reasonably suspected of being connected with child sexual abuse, and would be subject to judicial authorisation and other safeguards. Parliament's position also excluded communications protected by end-to-end encryption from detection orders.[58]
The Council adopted its negotiating position in November 2025. Its position retained mandatory risk assessments and mitigation measures for online service providers, with national authorities able to require additional mitigation measures where necessary. It also established different risk categories for online services and retained the possibility of voluntary detection, reporting and removal of CSAM by providers. The Council position provided for an EU Centre on Child Sexual Abuse and powers for national authorities to order the removal of illegal content, block access to it or, in the case of search engines, delist search results.[59]
The Council's position removed the Commission proposal's mandatory detection orders and instead focused on risk assessment, risk mitigation and voluntary detection by providers.[60] Interinstitutional negotiations between the Council and Parliament began after the Council adopted its position. Council documents record several technical and political trilogues during 2026, but the legislative procedure remains ongoing.[61]
As of October 2026, the permanent regulation has therefore not yet been adopted. The Council and Parliament continue to negotiate the final text, including the scope and conditions of detection measures, while the temporary framework governing voluntary detection is dealt with separately under Regulation (EU) 2026/1881.[62][63]
Definitions, scope and territorial application
The proposal defines known and unknown abuse material, and grooming, definitions later used to determine risks providers must assess and to which its prevention, reporting and enforcement provisions apply.[64][65] The Council position added risk categories to the assessment framework, with stronger obligations for high-risk services.[66]
Providers of hosting, interpersonal communication, app stores and ISPs anywhere directing service toward the EU are covered,[67] Parliament's position explicitly brought online games into scope.[68]
Non-EU providers must maintain a point of contact within the EU for authorities and the proposed Centre to communicate with,[69] and to support cross-border enforcement.[70]
EU Centre for the Protection of Children from Child Sexual Abuse
The EU currently relies on NCMEC, which has experienced backlogs lasting weeks,[71] to triage reports of suspected abuse occurring in Europe.[72] The proposal establishes a regional Centre to:
- receive, via a secure reporting system,[73] reports to be assessed directly within the EU,[74]
- reject false positives without need for a material investigation,[75] and notify the originating platform enabling it to improve its detection methods.[76]
- route legitimate reports to Europol and any authorities with likely jurisdiction,[77][78]
- maintain databases of known and suspected abuse indicators,[79]
- making detection technologies available to providers for free,[80]
- serve as a knowledge hub,[81]
- support victim assistance,
- help law-enforcement authorities act on reports,[82][83]
- issue an annual transparency report on its own performance.[84]
As of June 2026 most provisions concerning the Centre are agreed, except for its authority to conduct its own searches.[85]
Risk assessments, mitigations and reporting
The draft legislation would harmonize industry practice by requiring providers to assess the risk that their services could be misused for abuse, adopt reasonable mitigations,[86] and report their assessments and mitigation measures to the Centre every 3 months.[87]
Incident reporting
The legislation requires hosting and interpersonal communications providers report potential abuse incidents arising from their own detection,[88] or from any detection order it has received[89] to the Centre immediately.[90] Reporting mandates sufficient information about an incident to be useful to authorities,[91] and information of sufficient quality.[92]
Incident data retention
The proposal limits how abuse incident data can be used and retained by platforms:[93]
- to improve their detection systems,[94] except where it requires retaining personal data, [95]
- when blocking or terminating service to an account associated with abuse, related complaints and legal processes,[96]
- only for as long as strictly necessary, and for no more than 12 months,[97] unless requested by a court,[98]
- and accessed only for the purposes for which it was originally retained.[99]
Enforcement measures
Detection orders
A court can issue a detection order against a service where its own efforts have failed to mitigate abuse.[100]
Removal orders
A court can also issue a removal order, requiring a hosting provider or communication service to remove content within 24 hours.[101]
Blocking orders
A blocking order enabled a court to require an ISP prevent access to material that cannot otherwise be removed.[102]
Delisting orders
Search engines can be required to stop surfacing abuse material through a delisting order.[103]
Redress, notice and restoration
Court orders under the legislation can be challenged by the platform itself or by the users it affects.[104]
Penalties and jurisdiction
The legislation introduces enforcement penalties against services:
- non-compliance fines up to 6% of worldwide annual income,[105]
- fines up to 1% of worldwide annual income for failing to provide, or providing incorrect information,[106]
- periodic fines up to 5% of average daily worldwide turnover for continued non-compliance.[107]
Fines must be calibrated to the seriousness and intentionality of the breach, and the size and financial health of the relevant service.[108]
Age verification
The proposed legislation requires app stores to stop children installing apps with a significant risk of grooming.[109]
Private message services are also required to use age verification if their assessment identified a significant risk of grooming.[110]
Victim rights and assistance
Victims are granted new rights under the proposal to know about incidents involving themselves, to receive support from the Centre, and support to remove abuse material involving them.[111]
User reporting
Providers are required to operate a user-friendly mechanism to flag potential abuse material on their services.[112]
Legislative timeline
- 11 May 2022 – The European Commission presented its draft legislation.[113]
- 28 July 2022 – The European Data Protection Supervisor and Data Protection Board issued a joint opinion stating the proposal "could become the basis for de facto generalized and indiscriminate scanning of the content of virtually all types of electronic communications", which could hinder sharing legal content due to the chilling effect.[114][115]
- 21 December 2022 – The Economic and Social Committee issued an opinion supporting the proposal's objective, but warned detection measures were disproportionate, risked widespread monitoring of private communications and could weaken privacy and end-to-end encryption.[116][117]
- 23 March 2023 – The Swedish Presidency of the Council circulated a new compromise text, 7595/23,[118] substantially reworking the May 2022 proposal and earlier Council drafts.[119]
- 13 April 2023 – The Parliamentary Research Service published an impact assessment commissioned by the LIBE Committee.[120] It found no available technology could reliably detect abuse material without substantial error rates, and warned teenagers could "feel uncomfortable when consensually shared images could be classified as abuse material".[121]
- 26 April 2023 – The Council Legal Service issued an opinion concluding detection orders risked amounting to general and indiscriminate scanning that could seriously interfere with the rights to privacy and protection of personal data under Articles 7 and 8 of the Charter of Fundamental Rights.[122] Drawing on Court of Justice of the European Union jurisprudence, it found a serious risk that the proposed regime would compromise the essence of those rights.[123]
- 12 October 2023 – The German government proposed splitting the draft regulation into broadly supported provisions and controversial provisions concerning mandatory detection. It proposed addressing detection measures in a separate regulation and extending the temporary derogation while negotiations continued.[124]
- 14 November 2023 – The LIBE Committee adopted a position limiting detection orders to time-limited, judicially authorized measures of last resort targeting individuals or groups rather than entire services, while excluding end-to-end encryption from their scope.[125]
- 13 February 2024 – The European Court of Human Rights ruled in an unrelated case that requiring degraded end-to-end encryption "cannot be regarded as necessary in a democratic society". The ruling underlined parliament's decision to protect encrypted communications.[126]
- 28 May 2024 – The Belgian Presidency circulated a text proposing "upload moderation" and seeking a majority by limiting scanning to images, videos, and URLs and requiring consent before transmission. Users who refused would lose the ability to share files. Critics argued that scanning before encryption still amounted to client-side scanning.[127]
- 20 June 2024 – The Belgian Presidency abandoned the vote because the proposal lacked the required qualified majority.[128][129][130]
- 12 December 2024 – The Hungarian Presidency's efforts also failed. Hungary continued work on variants of the Belgian approach, but member states remained divided over mandatory detection, encryption, proportionality, and the reliability of scanning technologies.[131]
- 5 June 2025 – The Polish Presidency explored another compromise centred on risk mitigation and a narrower detection system, but again failed to assemble a majority. A June 2025 Council progress document recorded continued disagreement over detection obligations and encrypted services.[132]
- 1 July 2025 – Denmark assumed the presidency, stating in its programme they would "give the work on the Child Sexual Abuse (CSA) Regulation and Directive high priority".[133]
- 8 October 2025 – The German government confirmed it would not support the Danish proposal, preventing it from reaching the required majority.[134][135]
- 30 October 2025 – The Danish Presidency removes mandatory detection orders, circulating a revised text 14092/25[136] abandoning the obligation to conduct mandatory scanning. It retained voluntary detection, strengthened risk-assessment and mitigation duties, and preserved the proposed EU Centre.[137][138]
- 19 November 2025 – Committee of Permanent Representatives endorse the Danish compromise as the basis for final Council approval.[139]
- 26 November 2025 – European Council adopted its negotiating position. It does not require providers to detect abuse proactively, emphasized compulsory risk assessments and mitigation while making the temporary voluntary-scanning regime permanent.[140]
- 9 December 2025 – Parliament, Council and Commission begin trilogues.
- 29 June 2026 – Parliament's negotiating team release a statement indicating negotiations had "managed to reach compromises on almost the entire Regulation", allowing "us to focus on finding balanced solutions on the remaining aspects of the Regulation, in particular on detection, as early as possible".[141]
- 23 July 2026 – European Council gave final approval to the reinstatement of the derogation.[142]
Trilogue negotiations
Trilogue meetings began after the Council adopted its negotiating position in November 2025.[143] By April 2026, negotiators had reached consensus on risk assessment, mitigation measures and reporting, while detection measures remained the focus of debate.[144]
As of July 2026, the principal dispute concerned whether detection by platforms should remain voluntary, or could also be required through targeted detection orders as a measure of last resort.[144][145] Open questions included which users or groups could be targeted, how they would be identified and the basis for selection.[146] Negotiation also continues on whether detection should cover known material, previously unknown material and the grooming of children.[147] Reporting has indicated agreement that end-to-end encrypted communications should be excluded from detection technologies.[148]
Support
The proposed regulation has been supported by child advocacy groups including the Internet Watch Foundation and members of the ECLAG coalition.[4][149] In the European Parliament, the European People's Party has been a strong supporter of the proposal.[2]
Criticism
Opponents of the original Commission proposal often highlight its mandatory detection provisions could impose surveillance of digital private communications, and as such refer to it as Chat Control.[12][150][13] Some civil society organisations and activists have argued it was incompatible with fundamental rights, infringing on the right to privacy.[151][152] Opposition has come from many sides of the political spectrum including from left-wing, liberal and right-wing politicians.[6]
In April 2023, Parliament confirmed they had received messages calling to vote against the Commission's proposal.[153]
EU Commissioner Ylva Johansson has been criticised regarding how the proposal was drafted and promoted. A transnational investigation by European media outlets revealed involvement of foreign technology and law enforcement lobbyists in its preparation.[154] This was also highlighted by digital rights organisations, which Johansson rejected to meet on three occasions.[155] Johansson was also criticised for the use of micro-targeting techniques to promote its controversial draft proposal, which violated the EU's data protection and privacy rules.[156]
Some claims criticizing the proposals, such as that governments would be able to read the messages of individuals at will, have been characterized as false or misleading.[157][158]
Public opinion
A poll released in April 2026 by the Central European Digital Media Observatory found that 58% of respondents across 9 EU states believed the proposal would improve online safety, though only 22% of respondents reported being aware of it. 28% of respondents believed the proposal would threaten freedom of speech.[159]
See also
- General Data Protection Regulation (GDPR) – EU privacy regulation
- Article 8 of the European Convention on Human Rights § Mass surveillance
- Directive on Copyright in the Digital Single Market – EU directive
- Online Safety Act 2023 – UK Act of Parliament
- Patriot Act – US anti-terrorism and surveillance law
- Mass surveillance in China § Internet
