The Regulation to Prevent and Combat Child Sexual Abuse (also known as the Child Sexual Abuse Regulation, or CSAR) is proposed European Union legislation designed to compel digital platforms to assess and mitigate risks related to the dissemination of abuse material and online grooming. The draft law also aims to enable authorities to remove or block illegal content while establishing a specialized center for regional coordination and victim assistance. In public and political discourse, the initiative is widely criticized and referred to by detractors as Chat Control 2.0 or simply Chat Control.
While the framework is strongly supported by child advocacy groups and most EU member states, the legislative process has been gridlocked by disagreement over the scope and legal safeguards of automated monitoring. Although inter-institutional compromises have been achieved on a majority of the provisions, there remains an ongoing deadlock regarding controversial mandatory detection orders. Civil society organizations and privacy activists contend that requiring social media companies and messaging apps to proactively scan communications would compromise the right to privacy and data protection by introducing indiscriminate surveillance.
Background
The European Union's historical approach to child sexual abuse was fragmented, divided between a 2011 criminal-law directive implemented unevenly by member states, voluntary industry practices by digital platforms, and disconnected law enforcement and victim support initiatives. Official reviews of the 2011 directive identified significant implementation gaps, prompting the Council and the Parliament to call for a more coordinated EU-wide framework in late 2019.
The onset of the COVID-19 pandemic intensified these vulnerabilities by shifting schooling and social interactions online, which increased the digital exposure of children to offenders while simultaneously reducing the operational capacity of hotlines and law enforcement bodies. In response, the European Commission integrated the issue into its 2020 Security Union programme, and formally adopted its strategy for "a more effective fight against child sexual abuse" on 24 July 2020. This comprehensive strategy consolidated prevention, enforcement, and victim support under a single initiative, proposing temporary and permanent legislative measures to harmonize and expand voluntary platform detection mechanism practices.
In October 2022, Article 18 of the Digital Services Act introduced emergency reporting mandates for specific online businesses to flag imminent threats to life or safety. While these mechanisms are broadly compatible with the objectives of the CSAR, the regulation explicitly stopped short of imposing general or proactive content monitoring obligations.
Industry practice
Voluntary detection of child sexual abuse material (CSAM) by digital platforms dates back at least to the mid-1990s, when AOL manually reviewed suspected abuse material and subsequently developed automated detection processes. By 2015, the Internet Watch Foundation (IWF) was distributing a database of digital fingerprints, or hashes, derived from confirmed abuse material. The database included material identified through the IWF's own investigations, reports from the public and internet companies, and the UK's Child Abuse Image Database. Facebook, Google, Microsoft, Twitter and Yahoo participated in trials and implementation of the service, comparing hashes generated from newly uploaded images with those in the IWF database.
The use of automated detection and reporting systems has since become widespread, but their implementation and coverage vary substantially between services. A 2022 analysis submitted in the context of the proposed regulation argued that the voluntary system of detection and reporting by companies had proven insufficient to adequately protect children. The number of reports submitted to the National Center for Missing & Exploited Children (NCMEC) also varies considerably between platforms. In 2020, Facebook submitted 20.3 million reports, compared with 546,704 from Google, 144,095 from Snapchat, 96,776 from Microsoft, and 265 from Apple.
The extent to which these systems can be evaluated is limited by differences in transparency and reporting practices. A 2023 survey of 50 online services found that only 20 published transparency reports on child sexual exploitation and abuse, while only 10 defined such material in sufficient detail to establish what was prohibited on their services. A separate study likewise found substantial differences in the metrics and reporting methods used by online services, making it difficult to assess the effectiveness of their measures.
Automated detection
Existing industry practice relies primarily on automated detection technologies. Perceptual hashing is widely used to identify previously known material, while some providers use machine learning to detect previously unknown images and videos, and machine-learning-based analysis of text to identify potential online grooming.
One of the most widely used perceptual hashing systems is PhotoDNA, developed by Microsoft and Dartmouth College in 2009. In an analysis published by Ofcom in 2024, a PhotoDNA threshold selected to provide greater resistance to image alterations produced a false-positive rate of 0.3% under the conditions of the study. Published independent performance data for other commercial classifiers and systems designed to detect grooming have generally been limited. Child Rights International Network noted that claims about the accuracy of PhotoDNA and other detection tools were not supported by sufficient independent evaluation, while the European Commission's impact assessment did not provide specific false-positive rates for some of the classifiers it considered.
The accuracy and implications of automated detection can vary depending on the prevalence of the material being sought and the characteristics of the detection system. Of 4,192 reports assessed by the Irish police in 2020, 852 were confirmed to contain child sexual abuse material and 471 were classified as false positives. The figures have been cited as an illustration of the base rate fallacy in the context of large-scale detection systems. However, these figures describe reports received and assessed by law enforcement and should not be interpreted as a general estimate of the accuracy of automated detection systems. In contrast, a 2025 European Commission review reported that the automated detections examined in its assessment were "overwhelmingly confirmed" as child sexual abuse material following human review.
ePrivacy derogation
The ePrivacy Directive was adopted in 2002 to regulate the processing of personal data and the protection of privacy in the electronic communications sector. The European Electronic Communications Code (EECC), adopted in 2018, included interpersonal communications services within the EU electronic communications regulatory framework. Member States were required to apply the EECC from 21 December 2020.
The change in the legal framework affected the use of technologies by providers of number-independent interpersonal communications services to detect child sexual abuse material (CSAM) and the solicitation of children in private communications. In September 2020, the European Commission proposed a temporary derogation from certain provisions of the ePrivacy Directive to permit such technologies to continue to be used under specified conditions. The legal uncertainty surrounding the change was associated with a reduction in reports of suspected child sexual abuse material from services operating in the European Union to the National Center for Missing & Exploited Children (NCMEC); the Internet Watch Foundation reported a 58% decrease over an 18-week period in late 2020 and early 2021.
Regulation (EU) 2021/1232 established the temporary derogation in July 2021. It allowed providers of number-independent interpersonal communications services to voluntarily use specified technologies to detect, report and remove online child sexual abuse material and to detect and report the solicitation of children, subject to conditions and safeguards. The regulation entered into force on 2 August 2021 and, following an extension in 2024, remained applicable until 3 April 2026. The derogation was sometimes referred to as "Chat Control 1.0", particularly by organisations opposing the voluntary detection measures.
During 2023, Meta reported that its services had actioned approximately 3.6 million pieces of CSAM detected using its media-matching technology in message threads involving an EU user. Users appealed approximately 7% of these actions, and 4.6% of the appealed items were restored after review.
In March 2026, the European Parliament rejected a proposal to extend the application of Regulation (EU) 2021/1232. On 26 March, Parliament voted by 228 votes to 311, with 92 abstentions, against the proposed extension. Parliament had supported a shorter extension, until August 2027, with a narrower scope, while the Commission proposal would have extended the derogation until 3 April 2028. No agreement was reached with the Council, and Regulation (EU) 2021/1232 consequently ceased to apply on 3 April 2026.
A new temporary derogation was subsequently adopted as Regulation (EU) 2026/1881. Adopted by the European Parliament and the Council on 24 July 2026, it again permits providers of number-independent interpersonal communications services to voluntarily use specified technologies to detect, report and remove online child sexual abuse material and to detect and report the solicitation of children, subject to conditions and safeguards. The regulation was published in the Official Journal of the European Union on 28 July 2026 and is currently in force. It applies until 3 April 2028.
Provisions
In furtherance of its 2020 strategy for a more effective fight against child sexual abuse, the European Commission proposed a regulation in May 2022 to lay down rules for preventing and combating child sexual abuse online. The proposal would establish obligations for online service providers to assess and mitigate the risk that their services could be misused for the dissemination of child sexual abuse material (CSAM) or the solicitation of children. It would also establish procedures for the detection, reporting and removal of CSAM, provide measures to assist victims in removing material depicting them, and establish an EU Centre on Child Sexual Abuse.
Under the Commission proposal, providers would be required to carry out risk assessments covering the possibility that their services could be misused for the dissemination of CSAM or the solicitation of children. Providers would then be required to take proportionate measures to mitigate identified risks, including measures relating to the design and operation of their services, reporting mechanisms and user safety.
The Commission proposal also provides for detection orders, which could require a provider to detect known or new CSAM or the solicitation of children under specified conditions. Detection orders would be issued by judicial or independent administrative authorities and would be subject to requirements concerning necessity, proportionality and safeguards. The proposal also provides for measures to prevent general monitoring and for the protection of users' fundamental rights.
The Commission proposal would establish an EU Centre on Child Sexual Abuse to support the implementation of the regulation. The Centre would receive and process reports from providers, maintain databases of indicators relating to known CSAM, support national authorities and providers, and assist with the identification and removal of material depicting victims.
The European Parliament adopted its negotiating position in November 2023. Parliament's position retained risk assessment and mitigation obligations but proposed narrower conditions for detection orders. Detection orders would be used as a measure of last resort, would be targeted to specific users or groups of users reasonably suspected of being connected with child sexual abuse, and would be subject to judicial authorisation and other safeguards. Parliament's position also excluded communications protected by end-to-end encryption from detection orders.
The Council adopted its negotiating position in November 2025. Its position retained mandatory risk assessments and mitigation measures for online service providers, with national authorities able to require additional mitigation measures where necessary. It also established different risk categories for online services and retained the possibility of voluntary detection, reporting and removal of CSAM by providers. The Council position provided for an EU Centre on Child Sexual Abuse and powers for national authorities to order the removal of illegal content, block access to it or, in the case of search engines, delist search results.
The Council's position removed the Commission proposal's mandatory detection orders and instead focused on risk assessment, risk mitigation and voluntary detection by providers. Interinstitutional negotiations between the Council and Parliament began after the Council adopted its position. Council documents record several technical and political trilogues during 2026, but the legislative procedure remains ongoing.
As of October 2026, the permanent regulation has therefore not yet been adopted. The Council and Parliament continue to negotiate the final text, including the scope and conditions of detection measures, while the temporary framework governing voluntary detection is dealt with separately under Regulation (EU) 2026/1881.
Definitions, scope and territorial application
The proposal defines known and unknown abuse material, and grooming, definitions later used to determine risks providers must assess and to which its prevention, reporting and enforcement provisions apply. The Council position added risk categories to the assessment framework, with stronger obligations for high-risk services.
Providers of hosting, interpersonal communication, app stores and ISPs anywhere directing service toward the EU are covered, Parliament's position explicitly brought online games into scope.
Non-EU providers must maintain a point of contact within the EU for authorities and the proposed Centre to communicate with, and to support cross-border enforcement.
EU Centre for the Protection of Children from Child Sexual Abuse
The EU currently relies on NCMEC, which has experienced backlogs lasting weeks, to triage reports of suspected abuse occurring in Europe. The proposal establishes a regional Centre to:
receive, via a secure reporting system, reports to be assessed directly within the EU,
reject false positives without need for a material investigation, and notify the originating platform enabling it to improve its detection methods.
route legitimate reports to Europol and any authorities with likely jurisdiction,
maintain databases of known and suspected abuse indicators,
making detection technologies available to providers for free,
serve as a knowledge hub,
support victim assistance,
help law-enforcement authorities act on reports,
issue an annual transparency report on its own performance.
As of June 2026 most provisions concerning the Centre are agreed, except for its authority to conduct its own searches.
Risk assessments, mitigations and reporting
The draft legislation would harmonize industry practice by requiring providers to assess the risk that their services could be misused for abuse, adopt reasonable mitigations, and report their assessments and mitigation measures to the Centre every 3 months.
The legislation requires hosting and interpersonal communications providers report potential abuse incidents arising from their own detection, or from any detection order it has received to the Centre immediately. Reporting mandates sufficient information about an incident to be useful to authorities, and information of sufficient quality.
Victims are granted new rights under the proposal to know about incidents involving themselves, to receive support from the Centre, and support to remove abuse material involving them.
28 July 2022–The European Data Protection Supervisor and Data Protection Board issued a joint opinion stating the proposal "could become the basis for de facto generalized and indiscriminate scanning of the content of virtually all types of electronic communications", which could hinder sharing legal content due to the chilling effect.
21 December 2022–The Economic and Social Committee issued an opinion supporting the proposal's objective, but warned detection measures were disproportionate, risked widespread monitoring of private communications and could weaken privacy and end-to-end encryption.
23 March 2023–The Swedish Presidency of the Council circulated a new compromise text, 7595/23, substantially reworking the May 2022 proposal and earlier Council drafts.
13 April 2023–The Parliamentary Research Service published an impact assessment commissioned by the LIBE Committee. It found no available technology could reliably detect abuse material without substantial error rates, and warned teenagers could "feel uncomfortable when consensually shared images could be classified as abuse material".
26 April 2023–The Council Legal Service issued an opinion concluding detection orders risked amounting to general and indiscriminate scanning that could seriously interfere with the rights to privacy and protection of personal data under Articles 7 and 8 of the Charter of Fundamental Rights. Drawing on Court of Justice of the European Union jurisprudence, it found a serious risk that the proposed regime would compromise the essence of those rights.
12 October 2023–The German government proposed splitting the draft regulation into broadly supported provisions and controversial provisions concerning mandatory detection. It proposed addressing detection measures in a separate regulation and extending the temporary derogation while negotiations continued.
14 November 2023–The LIBE Committee adopted a position limiting detection orders to time-limited, judicially authorized measures of last resort targeting individuals or groups rather than entire services, while excluding end-to-end encryption from their scope.
13 February 2024–The European Court of Human Rights ruled in an unrelated case that requiring degraded end-to-end encryption "cannot be regarded as necessary in a democratic society". The ruling underlined parliament's decision to protect encrypted communications.
28 May 2024–The Belgian Presidency circulated a text proposing "upload moderation" and seeking a majority by limiting scanning to images, videos, and URLs and requiring consent before transmission. Users who refused would lose the ability to share files. Critics argued that scanning before encryption still amounted to client-side scanning.
20 June 2024–The Belgian Presidency abandoned the vote because the proposal lacked the required qualified majority.
12 December 2024–The Hungarian Presidency's efforts also failed. Hungary continued work on variants of the Belgian approach, but member states remained divided over mandatory detection, encryption, proportionality, and the reliability of scanning technologies.
5 June 2025–The Polish Presidency explored another compromise centred on risk mitigation and a narrower detection system, but again failed to assemble a majority. A June 2025 Council progress document recorded continued disagreement over detection obligations and encrypted services.
1 July 2025–Denmark assumed the presidency, stating in its programme they would "give the work on the Child Sexual Abuse (CSA) Regulation and Directive high priority".
8 October 2025–The German government confirmed it would not support the Danish proposal, preventing it from reaching the required majority.
30 October 2025–The Danish Presidency removes mandatory detection orders, circulating a revised text 14092/25 abandoning the obligation to conduct mandatory scanning. It retained voluntary detection, strengthened risk-assessment and mitigation duties, and preserved the proposed EU Centre.
26 November 2025–European Council adopted its negotiating position. It does not require providers to detect abuse proactively, emphasized compulsory risk assessments and mitigation while making the temporary voluntary-scanning regime permanent.
29 June 2026–Parliament's negotiating team release a statement indicating negotiations had "managed to reach compromises on almost the entire Regulation", allowing "us to focus on finding balanced solutions on the remaining aspects of the Regulation, in particular on detection, as early as possible".
23 July 2026–European Council gave final approval to the reinstatement of the derogation.
Trilogue negotiations
Trilogue meetings began after the Council adopted its negotiating position in November 2025. By April 2026, negotiators had reached consensus on risk assessment, mitigation measures and reporting, while detection measures remained the focus of debate.
As of July 2026, the principal dispute concerned whether detection by platforms should remain voluntary, or could also be required through targeted detection orders as a measure of last resort. Open questions included which users or groups could be targeted, how they would be identified and the basis for selection. Negotiation also continues on whether detection should cover known material, previously unknown material and the grooming of children. Reporting has indicated agreement that end-to-end encrypted communications should be excluded from detection technologies.
Opponents of the original Commission proposal often highlight its mandatory detection provisions could impose surveillance of digital private communications, and as such refer to it as Chat Control. Some civil society organisations and activists have argued it was incompatible with fundamental rights, infringing on the right to privacy. Opposition has come from many sides of the political spectrum including from left-wing, liberal and right-wing politicians.
In April 2023, Parliament confirmed they had received messages calling to vote against the Commission's proposal.
EU Commissioner Ylva Johansson has been criticised regarding how the proposal was drafted and promoted. A transnational investigation by European media outlets revealed involvement of foreign technology and law enforcement lobbyists in its preparation. This was also highlighted by digital rights organisations, which Johansson rejected to meet on three occasions. Johansson was also criticised for the use of micro-targeting techniques to promote its controversial draft proposal, which violated the EU's data protection and privacy rules.
Some claims criticizing the proposals, such as that governments would be able to read the messages of individuals at will, have been characterized as false or misleading.
Public opinion
A poll released in April 2026 by the Central European Digital Media Observatory found that 58% of respondents across 9 EU states believed the proposal would improve online safety, though only 22% of respondents reported being aware of it. 28% of respondents believed the proposal would threaten freedom of speech.
↑"A beginner's guide to EU rules on scanning private communications: Part 2". EDRi. Retrieved 12 July 2026. The Commission's plans have been coined "Chat Control" by Patrick Breyer, a human rights lawyer and MEP, because they seek to automatically scan the chats, messages and web-based emails of every person in the EU (including young people)
↑Birchard, Rosie; Braunschweig, Beatrice von (14 October 2025). "EU delays 'chat control' law over privacy concerns". dw.com. Retrieved 12 July 2026. Under the latest proposal penned by current EU chair Denmark, tech firms deemed high risk could be ordered to scan all links, images and videos — though not texts — shared on their platforms, to report instances of suspected child sexual abuse material to law enforcement ... Most controversially, the rules would also apply to content shared on messengers such as WhatsApp, which use encryption — a technical promise that your message won't be seen by anyone other than the person it's intended for.
↑"Chat Control: What is actually going on?". European Digital Rights (EDRi). 24 September 2025. Retrieved 12 July 2026. EU governments will decide whether to endorse or reject a mass surveillance, encryption-breaking and anonymity-ending law: the EU CSA Regulation
↑"Combating child sexual abuse and exploitation"(PDF). European Parliamentary Research Service. September 2024. Retrieved 17 July 2026. During the previous term, Parliament repeatedly stressed the importance of fully implementing Directive 2011/93/EU.
↑"Single Market For Digital Services and amending Directive 2000/31/EC". Retrieved 12 July 2026. Where a provider of hosting services becomes aware of any information giving rise to a suspicion that a criminal offence involving a threat to the life or safety of a person or persons has taken place, is taking place or is likely to take place, it shall promptly inform the law enforcement or judicial authorities of the Member State or Member States concerned of its suspicion and provide all relevant information available
↑"Child sexual abuse 'hash lists' shared with internet giants". Wired. Retrieved 14 July 2026. The master list is based on content the IWF's own analysts investigations have assessed and confirmed. This content may have been flagged up as a part of their own investigations, warnings from the public, internet companies, or from CAID.
↑"Child sexual abuse 'hash lists' shared with internet giants". Wired. Retrieved 14 July 2026. When any new image is uploaded onto their services, it will be automatically hashed on their end. Then it can be automatically compared to our hash list.
↑Pingen 2022: "It is submitted that the current system based on voluntary detection and reporting by companies has proven insufficient to adequately protect children"
↑"What Apple Can Do Next to Fight Child Sexual Abuse". Wired. Retrieved 14 July 2026. Facebook topped the 2020 list-making 20.3 million reports last year. Google made 546,704; Dropbox 20,928; Twitter 65,062, Microsoft 96,776; and Snapchat 144,095. Apple made just 265 CSAM reports
12Lu, Mengyao; Lamond, Maria; Fry, Deborah (2024). "A content analysis of metrics on online child sexual exploitation and abuse used by online content-sharing services". Child Abuse & Neglect. 157 107046. doi:10.1016/j.chiabu.2024.107046. PMID39316848. Without such an evidence base, there are no objective measures to assess the progress and effectiveness in addressing OCSEA.
↑Transparency Reporting on Child Sexual Exploitation and Abuse Online(PDF) (Report). OECD. 2023. pp.6–7. Retrieved 13 July 2026. Only 10 of the 50 services define CSEA with sufficient detail to understand what is prohibited on their services, and only 20 of the services issue a transparency report on CSEA.
↑"Explaining the technology for detecting child sexual abuse online". Child Rights International Network. Retrieved 14 July 2026. PhotoDNA, one of the main tools for perceptually hashing photos and videos, has been said to have a false positive rate of 1 in 50 billion. However, there is no independent review of this technology.
↑"Explaining the technology for detecting child sexual abuse online". Child Rights International Network. Retrieved 14 July 2026. The Commission's Impact Assessment does not provide specific false positive error rates for Thorn's classifier or the other tools it mentions.
↑"COM(2025) 740 final". EUR-Lex. Retrieved 14 July 2026. The overwhelming majority of content detected using these technologies was confirmed as child sexual abuse material following human review.
↑Pingen 2022: "Providers will have to assess the risk that their services are misused to disseminate child sexual abuse material or for purposes to solicit children, known as grooming"
↑"Combating child sexual abuse online"(PDF). European Parliamentary Research Service. January 2026. p.4. Retrieved 15 July 2026. The general objective of the proposal is to improve the functioning of the internal market ... by introducing consistent mandatory EU rules to prevent and combat child sexual abuse online, covering both old and new CSAM as well as grooming.
↑Pingen 2025: "The Council text introduces three risk categories for online services, allowing proportional obligations – particularly for high-risk platforms, which may be required to contribute to the development of mitigation technologies."
↑"How the EU is fighting child sexual abuse online". European Parliament. 26 June 2025. Retrieved 16 July 2026. The regulation would also introduce specific mandatory mitigation measures for services directly targeting children, platforms primarily used for the dissemination of pornographic content, and certain chat services within games.
↑Global Response Against Child Exploitation: Legal Report(PDF) (Report). GRACE. 2024. p.77. Retrieved 16 July 2026. These European CSA reports are shared at first solely with the EU Centre via a secure information sharing system.
↑Pingen 2022: "The EU Centre will support national law enforcement and Europol by reviewing the reports from the providers to ensure that they are not submitted in error. It will channel reports quickly to law enforcement"
↑Global Response Against Child Exploitation: Legal Report(PDF) (Report). GRACE. 2024. p.77. Retrieved 16 July 2026. Having received such a report, the EU Centre has to assess whether the report is "manifestly unfounded" in order to avoid obvious false positives.
↑Global Response Against Child Exploitation: Legal Report(PDF) (Report). GRACE. 2024. p.77. Retrieved 16 July 2026. When the EU Centre considers a report to be "manifestly unfounded", the EU Centre has to inform the reporting provider to that extent and specify the reasons.
↑Pingen 2022: "The EU Centre will support national law enforcement and Europol by reviewing the reports from the providers to ensure that they are not submitted in error. It will channel reports quickly to law enforcement"
↑Global Response Against Child Exploitation: Legal Report(PDF) (Report). GRACE. 2024. p.77. Retrieved 16 July 2026. The EU Centre has to forward the report to Europol and to the competent national LEA(s) likely to have jurisdiction.
↑Pingen 2025: "It also confirms the creation of a new EU agency ... to support implementation, maintain a central database of verified CSAM indicators, and channel reports to Europol and national law enforcement."
↑Pingen 2022: "It will also make detection technologies available to providers free of charge so that detection orders addressed to providers can be executed."
↑Pingen 2022: "It will channel reports quickly to law enforcement and support Member States by serving as a knowledge hub for best practices on the prevention of child sexual abuse and assistance to victims. It will also make detection technologies available to providers free of charge"
↑Transparency Reporting on Child Sexual Exploitation and Abuse Online(PDF) (Report). OECD. 2023. p.32. Retrieved 13 July 2026. The proposed EU Centre will coordinate actions to fight against child sexual abuse, from detection and reporting, to prevention and assistance to victims. It will support law enforcement to act on reports.
↑Pingen 2022: "Providers will have to assess the risk that their services are misused to disseminate child sexual abuse material or for purposes to solicit children, known as grooming; providers must also take reasonable mitigation measures tailored to the risk identified"
↑LIBE 2023a: "Upon obtaining actual knowledge on potential online child sexual abuse on their services, they should act expeditiously ... and ... report it to the EU Centre"
↑LIBE 2023a: Providers "should act expeditiously to remove or to disable access to that content and to report"
↑LIBE 2023a: "Those reports should ... contain a minimum of information as specified in this Regulation, and providers should ensure the quality of the information submitted"
↑LIBE 2023a: "Providers should ensure the quality of the information submitted so the EU Centre can conduct its assessment"
↑"D2.3 Research Report on Legislation"(PDF). CESAGRAM. 20 March 2024. Retrieved 18 July 2026. The purposes concern … measures against users, handling complaints and redress, and responding to competent authorities
↑"D2.3 Research Report on Legislation"(PDF). CESAGRAM. 20 March 2024. Retrieved 18 July 2026. The data may be retained for as long as strictly necessary, but the retention period will never be more than 12 months
↑"D2.3 Research Report on Legislation"(PDF). CESAGRAM. 20 March 2024. Retrieved 18 July 2026. The data retention period may be extended upon request by a competent national authority or court where necessary for ongoing administrative or judicial redress proceedings
↑"D2.3 Research Report on Legislation"(PDF). CESAGRAM. 20 March 2024. Retrieved 18 July 2026. The data may only be accessed and processed for the purposes for which it was preserved
↑Pingen 2022: "Detection orders will be issued by courts or independent national authorities."
↑"Legislative Overview"(PDF). Online Trust Coalition. 1 January 2026. Retrieved 19 July 2026. Sanctions for providing incorrect, incomplete or misleading information, for failing to respond, failing to rectify incorrect, incomplete or misleading information or refusing to submit to an on-site inspection, shall not exceed 1% of the provider's annual income or total turnover.
↑"Last attempt at chat control: Hungary to force approval to scan". netzpolitik.org. Member States should ensure that the competent authorities, whether to impose a penalty and when determining the type and level of, penalty is account is taken of all relevant circumstances, including: the nature, gravity and duration of the infringement; whether the infringement was intentional or negligent; any previous infringements by the provider or the other person; the financial strength of the provider or the other person; the level of cooperation of the provider or the other person with the competent authorities; the nature and size of the provider or the other person, in particular it is a micro, small or medium-sized enterprise; the degree of fault of the provider or other person, taking into account the technical and organizational taking measures by the provider it to with this regulation.
↑"Online age verification and children's rights"(PDF). EDRI. 4 October 2023. Article 6 requires app stores ... to block 'child users' ... from downloading apps with a 'significant' risk of grooming ... and to use ... age assessment measures
↑"Online age verification and children's rights"(PDF). EDRI. 4 October 2023. Article 4.3 requires private message services, including those offered via gaming platforms, to use document-based age verification or age estimation measures if they have identified a risk of grooming
↑Gates, K&L. "Global Platform for Child Exploitation Policy, Legal Q&A: European Union"(PDF). Global Platform for Child Exploitation Policy. p.31. Retrieved 18 July 2026. Article 12(3) of the Proposal requires providers to 'establish and operate an accessible, age-appropriate and user-friendly mechanism that allows users to flag to the provider potential online child sexual abuse on the service,' ... thereby establishing a direct pathway for victims and the general public to report suspected CSAM or solicitation of children to platforms
↑Moreau, Claudie. "Danish Presidency backs away from 'chat control'". Euractiv. Archived from the original on 31 October 2025. Retrieved 14 July 2026. The Danish presidency of the EU Council has dropped mandatory detection obligations from its latest compromise proposal.
↑Meister, Andre (12 June 2026). "Trilog zur Chatkontrolle geht in entscheidende Phase". netzpolitik.org (in German). Retrieved 17 July 2026. Es sei auch nicht klar, wer diese Personen oder Gruppen identifiziere und auf welcher Basis.
↑Meister, Andre (12 June 2026). "Trilog zur Chatkontrolle geht in entscheidende Phase". netzpolitik.org (in German). Retrieved 17 July 2026. LVA sprach sich für einen weiten Anwendungsbereich (bekanntes Material, neues Material, Grooming) aus.
↑Meister, Andre (12 June 2026). "Trilog zur Chatkontrolle geht in entscheidende Phase". netzpolitik.org (in German). Retrieved 17 July 2026. Einigkeit besteht zwischen den Ko-Gesetzgebern, dass Ende-zu-Ende verschlüsselte Kommunikationsinhalte von Aufdeckungstechnologien ausgenommen bleiben sollen.
![[icon]](https://en.wikipedia.org/wiki/File:Wiki_letter_w_cropped.svg){kind=small}
