The European Commission’s 2022 proposal for a Regulation on preventing and combating child sexual abuse (CSA Regulation) would allow national authorities to issue ‘detection orders’ requiring providers of interpersonal communication services to detect online child sexual abuse on their services, including in end-to-end encrypted environments. The proposal states that providers must deploy technologies capable of detecting known and new child sexual abuse material and grooming in the communications they transmit or store, and that these detection orders may cover all users of a given service when justified. Because end-to-end encryption prevents server-side scanning, the practical effect is that providers of encrypted messaging services would need to implement some form of on-device or client-side scanning to comply with such orders.

The Commission explains that its 2022 proposal for a Regulation to prevent and combat child sexual abuse would require certain online services to detect and report child sexual abuse online. It states that under the proposal, "detection orders" can be issued by courts or independent administrative authorities, obliging providers to detect known and new child sexual abuse material and grooming on their services. The page notes that these obligations can apply to **interpersonal communication services** (private messaging apps) when there is evidence of misuse, and that providers would be required to use "proportionate and sufficiently reliable technologies" to comply with detection orders.

On 15 February 2025 the Council agreed its negotiating position (general approach) on the proposed regulation to combat child sexual abuse. The press release says the text introduces a system of **detection orders** under which service providers can be obliged, as a last resort and under strict conditions, to detect online child sexual abuse material. According to the Council, detection orders would be targeted and limited in time, and would only be issued where there is evidence of a significant risk that a given service is being used for the dissemination of child sexual abuse material. It also notes that end-to-end encrypted services are not excluded a priori from the scope of detection orders, but any obligation must respect the essence of encryption and fundamental rights.

The article explains Parliament’s work on the Regulation to combat child sexual abuse. It states that Members of the European Parliament (MEPs) "do not endorse widespread web scanning, blanket monitoring of private communications or the creation of backdoors in apps to weaken encryption." It further explains that providers would have to carry out risk assessments and apply mitigation measures, and that detection orders could be issued only as a last resort "if there is reasonable suspicion that individual users or groups are linked to child sexual abuse material", with "end-to-end encrypted communication and text messages excluded from their scope."

In May 2022, the Commission proposed a Regulation to prevent and combat child sexual abuse online. The proposal would oblige certain online service providers, including hosting and interpersonal communication services, to "detect, report and remove" child sexual abuse material when ordered to do so. The Commission’s factsheet describes that competent national authorities could issue "detection orders" requiring providers to use technologies to detect known or new CSAM or grooming, but stresses that such orders must be targeted, time-limited, and subject to judicial or independent administrative authorisation, not a general obligation to monitor all communications.

Regulation (EU) 2021/1232, known as the interim derogation to the ePrivacy Directive, allows providers of number-independent interpersonal communications services to "continue the voluntary use of specific technologies" to detect online child sexual abuse on their services. Article 3 clarifies that the Regulation "does not impose an obligation" on providers to use such detection technologies; it merely provides a temporary legal basis for voluntary detection and reporting measures that some providers already apply.

The study explains that, for CSAM to be detected as per the measures laid down by the CSA proposal, “the communications of users need to be monitored for the types of content identified in the proposal.” It notes that the proposed detection orders “will significantly affect the confidentiality of communications,” and that “with regard to obligations on scanning the content of interpersonal communications by interpersonal communications providers … the analysis shows that the proposed rules compromise the essence of the fundamental right to privacy in the form of confidentiality of communications.” The report specifically flags client-side scanning, stating that “client-side scanning poses substantial vulnerabilities to attacks and abuse” and that extending scanning from servers to users’ devices would create new on‑device security risks.

On 26 November 2024, the Council agreed its general approach on the proposed regulation on preventing and combating child sexual abuse. The Council’s position “removes the mandatory detection obligations” that were present in the Commission’s original proposal and “does not foresee detection orders for end-to-end encrypted communications.” Instead, providers of interpersonal communications services are required to carry out risk assessments and take ‘reasonable mitigation measures’, but the use of detection technologies is framed as voluntary for non‑encrypted communications. The text also includes language that detection measures “shall not weaken or circumvent end‑to‑end encryption.”

In its first-reading position adopted on 24 April 2024, the European Parliament significantly amended the Commission proposal. The resolution states that the Parliament opposes "general and indiscriminate scanning" of private communications and removes any obligation for providers to scan content of end-to-end encrypted communications. It provides that detection orders must be targeted, based on specific and documented risks, and that "providers of interpersonal communications services offering end-to-end encryption shall not be required to weaken or circumvent encryption". Parliament’s text restricts scanning primarily to images and URLs and emphasises that text and voice communications should not be subject to generalised detection.

EDRi summarizes the latest Council position on the Child Sexual Abuse Regulation (CSAR), noting that "this unexpected but welcome agreement in Council means that any final deal on the CSA Regulation should not include provisions that could force services like Signal or WhatsApp to scan all their users’ private messages." It also states that the Council "no longer wants any mandatory scanning, proposing instead a permanent ‘voluntary’ scheme" similar to the earlier ePrivacy derogation, where providers may choose to scan under certain conditions but are not obliged to scan all communications. EDRi contrasts this with Parliament’s position, which allows mandatory scanning only in narrow, suspicion-based circumstances, saying Parliament "does want mandatory scanning, but only in narrow circumstances, where there is reasonable suspicion of a crime (similar to the idea of a warrant)."

EFF reports that the European Parliament "has dealt a real blow to voluntary mass-scanning of chats by voting to not prolong an interim derogation from e-Privacy rules in the EU. These rules allowed service providers, temporarily, to scan private communication." It stresses that in the EU, "the general and indiscriminate scanning of people’s messages is not legal" without a specific legal basis, and that the e-Privacy derogation that gave limited cover for such scanning "has now expired." EFF notes that the broader "Chat Control" proposal to mandate detection of child sexual abuse material is still being negotiated, but that "the most controversial idea, the forced requirement to scan encrypted messages, was given up by EU member states" in Council discussions.

A Max Planck Society analysis of the Council’s ‘chat control’ compromise notes that “a proposal by the Council of the European Union on chat monitoring, aimed at preventing the distribution of Child Sexual Abuse Material (CSAM), is now entering trilogue negotiations between the Council, the European Commission, and the European Parliament.” It explains that “the draft drops the earlier plan for mandatory surveillance. Instead, messaging services such as WhatsApp and Signal would be allowed to voluntarily install software for automated chat monitoring, and the scope of such monitoring could even be expanded.” The article adds that to allow authorities to search encrypted messaging services, “the proposal relies on a controversial technology known as client-side scanning,” where detection software is embedded in the app or operating system and scans content on the device before encryption.

TechGDPR explains that the original 2022 Chat Control proposal from the European Commission would have allowed or required providers to scan users’ messages, including private communications, for child sexual abuse material. It notes that after criticism, the proposal was significantly changed, and "as of 2025, the detection order provision was eliminated, instead opting for a risk-based approach: whereby scanning of communications was only a possible mitigation measure based on level of risk, and no longer an obligation." The article adds that additional provisions were added to ensure "the use and effectiveness of end-to-end encryption is not to be affected," and that the most controversial ‘chat control’ elements have been removed from the newest version of the Regulation’s text, even though voluntary communication scanning as a risk mitigation measure remains mentioned.

The article describes the Commission’s 2022 proposal for the Regulation to Prevent and Combat Child Sexual Abuse (CSAR), often called "chat control". It notes that, according to the original proposal, online service providers such as chat apps and social networks "would have a legal obligation to search the content of messages and stored files using algorithms", including scanning both encrypted and unencrypted private messages for CSAM. The piece also reports that the latest compromise text drafted under the Danish Council presidency stated that "only images and links – not text messages – would be subject to scanning" and that the system would be activated only following a decision by an independent authority, with a Commission spokesperson quoted as saying: "under this proposal, there is no general monitoring of online communications. There will be no such thing as ‘chat control’."

The Global Encryption Coalition notes that “previous versions of the proposal would have forced providers of encrypted communication services to introduce client side scanning capabilities to scan their users’ messages for such material.” It states that in the Council’s 26 November 2024 position, “it removes mandatory detection obligations that would have required providers to indiscriminately scan personal communications for child sexual abuse material, including in end-to-end encrypted environments.” The statement describes the new approach: “By making the use of detection technologies voluntary rather than mandatory, providers will no longer be forced to undermine the strong encryption that they offer their customers,” although the Council text requires risk assessments and allows voluntary scanning of non‑encrypted private messages, and obliges the Commission to reassess “the necessity and feasibility of making detection obligations mandatory” three years after entry into force.

EDRi describes the original Commission CSA Regulation proposal by saying that “under the proposal, the private communications of innocent people would be scanned with unreliable AI filters just in case they’re spreading CSAM. This is textbook mass surveillance.” It notes that “the proposal requires this to be done by end-to-end encrypted message services like WhatsApp and Signal,” and warns that “technologists around the world have been crystal clear that this cannot be done without compromising the integrity of these services. It would be like deploying personalised spyware to millions of people’s devices.” EDRi stresses that the law is still a draft: “The good news, however, is that the Chat Control bill still has several legislative hurdles to cross before it can become law. It hasn’t even reached final negotiations (aka trilogues) yet – and there’s a chance it won’t.”

EFF reports that the European Commission’s ‘Chat Control’ plan “would mandate mass scanning and other encryption-breaking measures,” but notes that in the Council’s agreed position “the good news is that the most controversial part, the forced requirement to scan encrypted messages, is out.” It explains that “the Council agreed on its position, which removed the requirement that forces providers to scan messages on their services,” and that the text includes “strong language to protect encryption.” However, it warns that the Council’s version still “allows for ‘voluntary’ detection, where tech platforms can scan personal messages that aren’t end-to-end encrypted,” and calls for clearer assurances that “client-side scanning cannot coexist with encryption.”

Help Net Security describes the evolution of the EU Chat Control (CSAR) proposal, stating that "early versions allowed authorities to require communication providers to scan messages, including encrypted content" as part of a mandatory framework against online child sexual abuse. It reports that after heavy criticism and political pushback, "the Council revised the proposal in late 2025" and that in the revised approach, "explicit scanning mandates were removed, and the system shifted toward risk assessments and mitigation duties" rather than blanket obligations to scan all communications. The article nevertheless warns that depending on implementation, providers could still adopt scanning technologies in some contexts under the new framework.

EU Perspectives reports that the European Parliament voted to extend the EU’s temporary legal exemption allowing platforms to voluntarily detect and report child sexual abuse material in private communications, known as ‘Chat Control 1.0’, "until August 2027 while negotiations continue." It notes that this extension concerns voluntary scanning by providers, not a new mandatory regime, and that Parliament simultaneously adopted an amendment stating that "scanning of private communications should apply only to users or groups suspected of CSAM and authorised by a competent judicial authority." The article explains that this amendment reflects Parliament’s position for the permanent CSAR framework, which favours targeted, suspicion-based scanning with judicial oversight rather than general scanning of all users’ messages.

CEDMO describes the temporary ePrivacy derogation (Chat Control 1.0) that allowed voluntary scanning by providers as a stopgap measure that "is valid until Friday, April 3, 2026, after which it will expire without replacement" unless extended. It notes that "the European Commission’s proposal to extend its validity until August 2027 was rejected by the European Parliament in March," meaning that the temporary legal basis for voluntary scanning of private communications under Chat Control 1.0 is set to lapse. The article highlights that the permanent legal framework, known as Chat Control 2.0 or the Child Sexual Abuse Regulation (CSAR), "is under discussion" and has become highly controversial over potential impacts on encrypted messaging, but that its final form and obligations are not yet decided.

The article explains that the Regulation to Prevent and Combat Child Sexual Abuse (CSAR), commonly known as "Chat Control", was proposed by the European Commission in May 2022. It notes that the purpose of CSAR is "to make it mandatory for service providers to scan messages for CSAM, and to bypass end-to-end encryption." It summarises critics’ concerns that the proposal would "effectively mandate mass scanning of all private digital communications" and enable "generalized, indiscriminate surveillance." The entry also records that, as of mid‑2024 and into 2025, the proposal faced strong opposition in the Council, with several governments announcing they would vote against it and some later texts moving away from mandatory scanning.

This expert explainer on the EU’s interim derogation notes that, under EU privacy law, services are generally not allowed to scan the content of electronic communications, which created uncertainty about voluntary CSAM detection tools. It explains that the temporary derogation "allows companies to continue using technologies" such as hash lists to detect and report CSAM while remaining compliant, but "does not require companies to ‘scan’ messages". The author adds that the measure is a stop‑gap while the EU negotiates a permanent Child Sexual Abuse Regulation, and that the Commission has proposed extending the interim rules until 2028 without asking companies "to do anything new or different" beyond existing voluntary detection.

This explainer on the EU ‘Chat Control’ debate states that the CSA Regulation draft introduced in May 2022 “set out to mandate sweeping detection, reporting, and removal obligations across messaging and hosting services,” with the “enforcement spine of the proposal” being client-side scanning. It describes client-side scanning as software on a user’s device that “reviews messages, photos, voice notes and links in the clear before end-to-end encryption can even begin, and potentially again on receipt of a message,” generating reports when content is flagged. The article argues that, applied across hundreds of millions of devices, this amounts to “continuous screening of the whole population’s private communications,” and notes that EU data protection authorities have warned that such detection orders would intrude deeply into privacy and raise serious necessity and proportionality concerns.

German Pirate Party MEP Patrick Breyer describes the Commission’s CSAM proposal as obliging providers "to search all private chats, messages, and emails automatically for suspicious content" using automated tools. He writes that the proposed legislation "allows the searching of all private chats, messages, and emails" for illegal depictions of minors and grooming, enabling providers like Facebook Messenger and Gmail "to scan every message for suspicious text and images" in a fully automated process, partly using error-prone artificial intelligence. Breyer notes that after protests, "mandatory chat control was removed" from the EU governments’ draft law in late 2025, but argues that revised versions still permit broad scanning at providers’ discretion.

The article explains that the EU’s proposed Regulation to Prevent and Combat Child Sexual Abuse, known as "Chat Control", would establish a detection framework requiring platforms to scan communications for child sexual abuse material. It notes that platforms using end-to-end encryption, including WhatsApp, Facebook Messenger and other services based on the Signal Protocol, "would be required to insert a pre-encryption scanning layer" under the Commission’s original vision. Every time a user composes a message or attaches media, the content would be analysed against CSAM databases and AI detection models before encryption, with flagged content transmitted to EU authorities. The author underlines that this is a regulation, so once adopted it would apply directly and uniformly across all 27 EU member states.

The civil society campaign site summarises the original Commission proposal as one that “would legalise scanning of all private digital communications, including encrypted messages and photos.” It warns that the regulation would allow or require providers of messaging, email, and other communication services to use automated tools to detect child sexual abuse material and grooming in users’ private communications. The campaign argues that this would, in practice, mean “mass surveillance of personal messages” and would undermine end-to-end encryption by obliging providers to implement scanning either on their servers or directly on users’ devices.

Mullvad, a privacy-focused VPN provider, writes that the European Commission is working on legislation called chat control. According to their description, if the law takes effect "all EU citizens will have their communications monitored and audited". They say chat control would involve total interception of private communication, with providers being forced to scan messages, images and other content using automated tools to detect child sexual abuse material. The company warns that this would effectively end secure private messaging and mass-surveil users on platforms such as WhatsApp and Signal.

As of early 2026, the EU’s Regulation to Prevent and Combat Child Sexual Abuse (CSAR) has not been finally adopted and remains under negotiation between the Council and Parliament. WhatsApp and other private messaging apps are not yet legally required by EU law to conduct AI-based scanning of all users’ messages; any detection that occurs is based on providers’ existing voluntary safety measures under the interim derogation. Proposals in Council and Parliament have moved away from explicit, universal obligations to scan all encrypted messages, in part due to legal and political concerns about mass surveillance and encryption backdoors.

A detailed summary post on r/privacy, citing official documents and news, states that trilogue negotiations on the CSA Regulation are underway and that "most Members of the European Parliament (MEPs) oppose any form of mass scanning, with the exception of the EPP group." The post explains that the Parliament’s position is for "targeted scanning only as a last resort, requiring a court order and aimed at specific individuals or groups (note that end-to-end encrypted apps would be excluded)." It also notes that a recent Council vote failed to approve a compromise text, primarily because of opposition to client-side scanning, and concludes that while the initiative is not dead, "the outcome of the trilogues remains uncertain" and no general obligation to scan all users’ messages has been agreed.