EU Member States Forge Agreement to Combat Online Child Abuse

EU member states have reached a significant agreement aimed at combating online child abuse. During a meeting on March 1, 2024, justice ministers from the 27 EU countries endorsed a common position on the child sexual abuse (CSA) protection law, also known as the CSA Regulation. This deal mandates that social media platforms actively remove illegal content related to child sexual abuse, although the requirement for mandatory scanning of private messages has been omitted.

The proposed regulation aims to establish the EU Centre on Child Sexual Abuse, which will oversee the systematic removal of child sexual abuse material from online platforms. National authorities will gain the power to compel companies to eliminate or restrict access to such content. Despite the progress, the proposal has sparked considerable debate, particularly regarding privacy concerns and the implications for individual rights.

Controversial Measures and Industry Reactions

The negotiations surrounding the CSA Regulation have been ongoing since 2022. Various presidencies, including those of the Czech Republic, Spain, Belgium, Hungary, and Poland, faced challenges in finding a consensus. Ultimately, the Danish presidency succeeded in brokering a compromise, which included dropping the mandatory scanning of end-to-end encrypted messages. Instead, platforms like Facebook Messenger and Instagram will have the option to scan messages voluntarily.

While the tech industry has generally welcomed the compromise, organizations such as CCIA Europe have expressed reservations. In a statement, they emphasized the need for the new rules to strike a balance between protecting minors and maintaining the confidentiality of communications, especially concerning end-to-end encryption. “EU Member States have made it very clear that the CSA Regulation can only move forward if these new rules to prevent and combat child sexual abuse strike a true balance,” the group asserted.

Concerns Over Surveillance and Privacy

Privacy advocates have voiced strong opposition to the new measures. Former Pirate Party Member of the European Parliament, Patrick Breyer, criticized the Council’s endorsement as a “Trojan Horse.” He warned that legitimizing voluntary mass scanning could lead to unwarranted surveillance of millions of Europeans by large corporations. Breyer highlighted that current AI systems designed to detect child sexual abuse imagery are often inaccurate, with data from the German Federal Police indicating that approximately 50% of reports are not criminally relevant.

Additionally, the introduction of age-verification systems, which may rely on ID cards or facial recognition technology, raises further privacy concerns. Critics argue that such measures could compromise online anonymity and safety.

With the Council’s compromise now in place—despite dissent from the Czech Republic, Netherlands, and Poland—negotiations with the European Parliament and the Commission, known as trilogues, are set to commence in March 2026. These discussions must conclude before the expiration of the current E-Privacy regulation, which allows for exceptions permitting companies to conduct voluntary scanning.

The outcome of these negotiations will be closely monitored, as they hold significant implications for online safety, privacy rights, and the responsibilities of technology companies in the European Union.