EU privacy policy clash over child safety tools and data scans

The European Parliament let the ePrivacy derogation that permitted voluntary CSAM scanning expire on April 3, stripping Meta, Google and Microsoft of a legal basis to scan private messages for child sexual abuse material [2].

Expiration of the voluntary scanning framework

The ePrivacy derogation, introduced in 2021 as a temporary measure, allowed platforms to scan private communications for CSAM without breaching EU privacy rules. Its lapse means companies must pause any such scanning, as Meta confirmed for the EU market [2]. The loss of this legal cover is expected to reduce referrals of CSAM to the U.S. National Centre for Missing and Exploited Children, which processes the bulk of global reports.

New tools run into the same privacy wall

Just twelve days after the derogation ended, the European Commission rolled out a privacy‑preserving age‑verification app intended to protect children online. Researchers demonstrated a breach in under two minutes, underscoring the difficulty of building effective safeguards that respect EU privacy law [2]. Meanwhile, the proposed Child Sexual Abuse (CSA) Regulation—also known as “Chat Control”—remains stuck in trilogue negotiations. The Parliament has stripped the draft of the most contentious powers, such as scanning end‑to‑end encrypted messages, while the Council pushes for broader detection abilities, including unknown material and grooming behavior [2].

Encryption and fundamental rights

The European Court of Human Rights’ February ruling in Podchasov v. Russia declared that mandating decryption keys for private communications violates Article 8 rights to privacy [2]. This precedent directly challenges any future requirement for platforms to weaken encryption, a core element of the CSA Regulation’s detection orders. Companies like Signal have already signaled they would exit the EU rather than comply with such mandates, and Apple disabled its Advanced Data Protection feature in the UK after a government request for a backdoor [2].

What to watch

• July 2024 – the target date for a political agreement on the CSA Regulation in trilogue.
• Future EU age‑verification solutions – whether they can be hardened against rapid hacks while remaining privacy‑compliant.
• Platform responses – whether major services will re‑introduce voluntary scanning under a new legal framework or withdraw from EU markets.

The clash between child‑protection objectives and the EU’s privacy architecture leaves a regulatory gap: tools designed to locate abused children require the very data the GDPR and related laws prohibit collecting about minors. How Europe reconciles these opposing mandates will shape the operating environment for AI and other tech firms across the continent.