Author: Tymoteusz Onacko

Editor: Szymon Więk

Combating children sexual abuse by digital services' surveillance - is EU's legislative taking too radical steps?

A briefing of recent events

On 9th of July the European Parliament pushed the extension of the Derogation to ePrivacy directive (commonly refered to as Chat Control 1.0), leaving digital services' providers an ability to voluntarily scan their platforms' content in search of children sexual abuse materials (CSAM) and hand it over to non-government organisations (NGO's) combating children abuse. The act was adopted at second reading, four months after it was initialy rejected and referred back to the committee responsible for interinstitutional negotiations. The multi-institutional efforts to make law's extention happen after initial rejection were found by some opponents as contradictory to the democratic values, on which the European Union (EU) is built upon. It is not the sole controversy following this regulation. Despite bright intentions, many people and organisations raise concerns over it's purpose, arguing that it's sole role is to set up ground for continent-wide mass surveillance against EU citizens. Upcoming EU’s age verification app does not cool down the opponent's attitudes either. People argue that upcoming CSAM regulation (Chat Control 2.0) would compromise end-to-end encryption – one of the most effective privacy tools currently available. Yet in the time of widely spreading disinformation and emotion-based narrative finding truth is more difficult than ever before. Thus, is a game-changing threat to people's privacy truly coming or is it merely fear mongering?

What does the current law establish?

The first glimpse of the regulation to come appeared on 24 July 2020. Then, the European Commission adopted the "EU Strategy for a More Effective Fight Against Child Sexual Abuse" that teased tighter measures for protecting CSA victims and better detection mechanisms, highlighting the digital world. The need for new regulations was justified by the high impact of SARS-CoV-2 pandemic on children's digital services’ use growth as well, thereby strenghtening calls for greater digital platforms' regulations, such as tighter age verification mechanisms and scanning for unlawful content on digital platforms. As a temporary resolution to this problem, Chat Control 1.0 was adopted in 2020, entering into effect in 2021. Within it’s content, a few sentences addressed the topic of end-to-end encryption.

"End-to-end encryption is an important tool to guarantee the security and confidentiality of the communications of users, including those of children. Any weakening of encryption could potentially be abused by malicious third parties. Nothing in this Regulation should therefore be interpreted as prohibiting or weakening end-to-end encryption"

As seen above, the Derogation does not stigmatise end-to-end encryption’s usage but rather sees it as a valuable tool for security. Chat Control 1.0 only allows voluntary scanning of nonencrypted content. Ironically, most Big Tech providers, such as Alphabet or Meta can conduct scanning of unencrypted content on their own from the very beginning, including messaging apps and email. Facebook Messenger group chats and Gmail inboxes do not have end-to-end encryption by design, hence exposure to corporate scanning or data breaches is unavoidable. Purely by technical means, digital platforms’ mass surveillance is already there. What came with Chat Control 1.0 is merely a bitter confirmation of the current state of online privacy, but this time, utilised by a state-level actor. In the aspect of legislative process, pushing vote on the same act multiple times, despite clear opposition would highlight a superior position of the other EU Institutions to the Parliament, possibly undermining EU’s institutional balance. Thus, is privacy online threatened by this particular act? By itself – not. This could have marked the end of discussion were it not for the temporary nature of the measure, which was meant to precede the adoption of a long-term regulation.

Will CSAM regulation threaten privacy?

While Chat Control 1.0 does not change much in the area of data’s confidentiality. Is this still the case in the upcoming regulation? The first proposal for CSA regulation was presented to the European Parliament by the Commission on 11 May 2022. It’s content extends it’s predecessor’s ideas to establishing an EU centre to prevent and combat child sexual abuse, national coordinating authorities, strenghtening of age verification mechanisms, prevention of new CSAM accurance, stronger moderation of gaming platforms’, et cetera. In a briefing of the proposal, end-to-end encryption has been described as a possible safe place for child abusers, rather than just a security tool. Not to mention, it’s compromise was at the table in one of it’s drafts. It is an undoubful fact that the encryption allows criminals to communicate with eachother with way higher chances to stay undetected and break law. On the other hand, it is a strong protection to prevent data breaches, secure business correspondence, handle sensitive data or simply as an every day safety measure against ill intent. It’s increased use would result in a much safer digital space for Europeans, protected more effectively from cybercriminals, data brokers and foreign regimes’ change impact – especially in politically uneasy times. Hence, is this truly the frontier EU legislators should pursue? Up to today, there is still no clear agreement on the scale of the regulation, yet as shared in the ProtectEU strategy’s content – it continues to be one of the establishments that eventually must come about. The rapid development of Artificial Intelligence models could make platform-wide scanning for unlawful content way more effective than ever, enabling the regulation to be fulfilled by the digital platforms.

The strategy has shared a crucial piece of information regarding the future of encryption:

„Moreover, the Commission will support the research and development of new decryption capacities to ensure that Europol is well equipped after 2030 to support Member States, considering new technological developments such as quantum computing and the most advanced research in the field.”This sentence implies the possible future efforts to try breaking sophisticated encryption, in order to allow Europol access the once encrypted data. Post-quantum computing would be the very method to conduct such operations. 

What will the near future unveil?

ProtectEU, EU Digital Identity Wallets, as well as age-verification mechanisms are among the key developments in the near future. Coming with their own chances and dangers – these law establishments are what freedom and privacy advocates should be focused on regarding state interference in the Internet’s affairs. Deliberate mass surveillance of every EU citizen is unlikely, as it lacks concrete evidence to back up. What is going to change is the increase in effectiveness of digital services’ moderation and the amount of sensitive personal data we hand in to their providers. EU’s age verification app is said to be the very method of verifying one’s age without direct handling of sensitive data – is that really possible, though?

Sources

1. Regulation (EU) 2021/1232 of the European Parliament and of the Council of 14 July 2021 on a temporary derogation from certain provisions of Directive 2002/58/EC as regards the use of technologies by providers of number-independent interpersonal communications services for the processing of personal and other data for the purpose of combating online child sexual abuse. https://eur-lex.europa.eu/eli/reg/2021/1232/oj/eng (https://eur-lex.europa.eu/eli/reg/2021/1232/oj/eng) | Access: 12.09.2026

2. Regulation (EU) 2022/2065 of the European Parliament and of the Council of 19 October 2022 on a Single Market For Digital Services and amending Directive 2000/31/EC (Digital Services Act). https://eur-lex.europa.eu/eli/reg/2022/2065/oj (https://eur-lex.europa.eu/eli/reg/2022/2065/oj) | Access: 12.09.2026

3. Briefing EU Legislation in Progress EPRS | European Parliamentary Research Service Author: Mar Negreiro Members' Research Service PE 738.224 – January 2026 EN Combating child sexual abuse online.https://www.europarl.europa.eu/RegData/etudes/BRIE/2022/738224/EPRS_BRI(2022)738224_EN.pdf (https://www.europarl.europa.eu/RegData/etudes/BRIE/2022/738224/EPRS_BRI(2022)738224_EN.pdf) | Access: 12.09.2026

4. Council of the European Union Brussels, 6 November 2025 (OR. en) 14092/25 Interinstitutional File: 2022/0155 (COD).

5. European Commission Brussels, 24.7.2020 COM(2020) 607 final. Communication from the Commission to the European Parliament, the Council, The European Economic and Social Committee and the Committee of the regions EU strategy for a more effective fight against child sexual abuse. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:52020DC0607 (https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:52020DC0607) | Access: 12.09.2026

6. European Commision Brussels, 11.5.2022 COM(2022) 209 final 2022/0155 (COD) Proposal for a Regulation of the European Parliament and of the Council laying down rules to prevent and combat child sexual abuse. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A52022PC0209 (https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A52022PC0209) | Access: 12.09.2026

7. European Commission Strasbourg, 1.4.2025 COM(2025) 148 final Communication from the Commission to the European Parliament, the Council, the European Economic and Social Committee and the Committee of the Regions on ProtectEU: a European Internal Security Strategy. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:52025DC0148 (https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:52025DC0148) | Access: 12.09.2026

8. Encryption Migration and Home Affairs https://home-affairs.ec.europa.eu/policies/internal-security/lawful-access-data/encryption_en (https://home-affairs.ec.europa.eu/policies/internal-security/lawful-access-data/encryption_en) | Access: 12.09.2026

9. European Parliament 2024-2029 Consolidated legislative document EP-PE_TC2-COD(2025)0429 9.7.2026.