After years of deadlock, European Union member states have reached a compromise on a law designed to combat online child sexual abuse (CSA). The deal, secured by the Danish presidency, aims to force social media platforms to systematically remove illegal content. However, the agreement remains deeply controversial, with critics warning it could enable mass surveillance.
The Core of the Regulation
The proposed CSA Regulation will establish a new EU body, the EU Centre on Child Sexual Abuse, and empower national authorities to compel tech companies to remove or block access to abusive material. The key sticking point – and the reason for years of stalled negotiations – has been how content is detected.
The final compromise avoids mandatory scanning of private communications by authorities. Instead, platforms like Facebook Messenger and Instagram will be allowed to scan messages themselves. While Big Tech largely welcomes this approach, privacy advocates remain highly skeptical.
Surveillance Concerns and False Positives
Critics argue that even “voluntary” scanning legitimizes mass surveillance. Patrick Breyer, a former MEP, calls the deal a “Trojan Horse,” warning that US corporations will scan millions of Europeans’ messages without warrants.
The accuracy of automated detection systems is also a major concern. Data from German Federal Police reveals that roughly half of all CSA reports turn out to be false positives, meaning innocent content is flagged as illegal. The introduction of age-verification systems, such as ID checks or facial recognition, could further endanger online privacy.
The Path Forward
Negotiations with the European Parliament and the Commission (the so-called “trilogues”) will begin in 2026. The outcome hinges on balancing child protection with fundamental rights and data security. The regulation must also be finalized before the E-Privacy rules expire, which currently allow companies to conduct voluntary scanning under specific exceptions.
The compromise represents a step forward, but the true impact on privacy and surveillance remains uncertain. The debate underscores the growing tension between security demands and digital freedoms in the EU.
