The European Parliament voted on 11 March 2026 to extend until 3 August 2027 the temporary framework that allows messaging providers to detect and report online child sexual abuse. But it also tightened the conditions: only already known content can be detected, end-to-end encryption is explicitly excluded, and any surveillance must target specific users identified in advance by a judge. This is not yet the final law: the text must now be negotiated with the governments of the member states.
The 2021 regulation had created a temporary framework, valid until 3 August 2026, so that messaging services could voluntarily detect and report child sexual abuse. The Commission simply proposed postponing this date by one year, without changing the rules. Parliament accepted the extension but used this text to strongly tighten the conditions under which such detections are authorised. The vote follows the report of the Committee on Civil Liberties, Justice and Home Affairs.
Extension until 3 August 2027The temporary framework for detecting and reporting online child sexual abuse, which was due to expire on 3 August 2026, is extended by one year, until 3 August 2027.
Detection limited to already known contentOnly the detection and removal of material already known to constitute child sexual abuse is authorised. The search for new or unlisted content is possible only if the provider has received a specific report concerning a specific communication, account or interaction.
Prohibition on touching encrypted messagesInterpersonal communications protected by end-to-end encryption may under no circumstances be processed, whether this encryption is already applied, has been applied or is to be applied.
Mandatory targeting validated by a judgeAny detection must target individual users or specific groups identified in advance by a competent judicial authority, on the basis of reasonable suspicion of a link to child sexual abuse material.
Regulated technologiesThe technologies used must be state of the art, as privacy-friendly as possible, and must not be able to infer the content of communications. They may detect only patterns revealing child sexual abuse.
Parliament adopted the text by 458 votes in favour, 103 against and 63 abstentions in an electronic roll-call vote.
For messaging users, the text strengthens safeguards: your end-to-end encrypted conversations cannot be scanned, and you can be surveilled only if a judge has specifically identified you as a suspect. Messaging providers, for their part, see their detection possibilities reduced to only already known content and specific reports, with technologies that must not be able to read the content of your messages. The extension until August 2027 avoids a legal vacuum, but Parliament will still have to negotiate with the member states before these rules apply definitively.
The European Parliament adopted on 11 March 2026, by 458 votes to 103 with 63 abstentions, a one-year extension of the temporary framework for voluntary detection of child sexual abuse online, until 3 August 2027. But above all it imposed strict safeguards: only already known content can be detected, end-to-end encryption is explicitly excluded, and any targeted surveillance must be authorized in advance by a judge. This is not yet the final law: the text must be negotiated with the member states.
Parliament chose to sharply restrict voluntary detection. On one hand, it extends the temporary framework, avoiding a legal vacuum. On the other, it limits detection to content already listed as child sexual abuse. The search for new content or grooming is possible only after a specific report from a user, a trusted flagger or a public body. In practice, providers can no longer broadly scan messages in search of new victims. This approach reduces the risks of privacy infringement, but it risks letting unreported new content slip through for lack of a prior report.
The explicit exclusion of end-to-end encryption is a heavy decision. It means that encrypted messaging services, such as WhatsApp or Signal, can under no circumstances be analyzed, even to detect abuse. Judicial authorities will have to make do with reports and unencrypted content. For users, this is a strong guarantee: their private conversations remain private. But for investigators, it is a major obstacle, because criminal networks increasingly use these channels.
The requirement of prior judicial authorization to target specific users adds a welcome layer of control. It prevents mass surveillance and requires reasonable suspicion. However, it slows investigations and could deter providers from reporting urgent cases. The text attempts to reconcile security imperatives and freedoms, but leans clearly toward privacy protection.
Messaging providers see their obligations become more complex. They must implement state-of-the-art technologies, as non-intrusive as possible, and incapable of inferring the content of communications. These technical requirements represent a significant compliance cost, particularly for small businesses. They could discourage innovation and competition in the sector.
For citizens, the text strengthens privacy protection, but it also creates an illusion of security. Child sexual abuse will not disappear because encrypted messaging is excluded. Criminals will turn to uncovered channels, or use circumvention methods. The priority should be to strengthen police and judicial cooperation, rather than multiply technological safeguards.
An approach based on subsidiarity and the market would have consisted of letting member states define their own rules, according to their legal traditions and capacities. It could also have encouraged providers to develop voluntary detection tools, without imposing uniform obligations. Parliament chose the regulatory path, with the risk of slowing local initiatives.
Extend for one year, but lock down encryption: Parliament protects privacy without guaranteeing the protection of children.
The European Parliament adopted on 11 March 2026, by 458 votes to 103 with 63 abstentions, a one-year extension of the temporary framework for voluntary detection of child sexual abuse online, until 3 August 2027. But above all it imposed strict safeguards: only already known content can be detected, end-to-end encryption is explicitly excluded, and any targeted surveillance must be authorized in advance by a judge. This is not yet the final law: the text must be negotiated with the member states.
Parliament chose to sharply restrict voluntary detection. On one hand, it extends the temporary framework, avoiding a legal vacuum. On the other, it limits detection to content already listed as child sexual abuse. The search for new content or grooming is possible only after a specific report from a user, a trusted flagger or a public body. In practice, providers can no longer broadly scan messages in search of new victims. This approach reduces the risks of privacy infringement, but it risks letting unreported new content slip through for lack of a prior report.
The explicit exclusion of end-to-end encryption is a heavy decision. It means that encrypted messaging services, such as WhatsApp or Signal, can under no circumstances be analyzed, even to detect abuse. Judicial authorities will have to make do with reports and unencrypted content. For users, this is a strong guarantee: their private conversations remain private. But for investigators, it is a major obstacle, because criminal networks increasingly use these channels.
The requirement of prior judicial authorization to target specific users adds a welcome layer of control. It prevents mass surveillance and requires reasonable suspicion. However, it slows investigations and could deter providers from reporting urgent cases. The text attempts to reconcile security imperatives and freedoms, but leans clearly toward privacy protection.
Messaging providers see their obligations become more complex. They must implement state-of-the-art technologies, as non-intrusive as possible, and incapable of inferring the content of communications. These technical requirements represent a significant compliance cost, particularly for small businesses. They could discourage innovation and competition in the sector.
For citizens, the text strengthens privacy protection, but it also creates an illusion of security. Child sexual abuse will not disappear because encrypted messaging is excluded. Criminals will turn to uncovered channels, or use circumvention methods. The priority should be to strengthen police and judicial cooperation, rather than multiply technological safeguards.
An approach based on subsidiarity and the market would have consisted of letting member states define their own rules, according to their legal traditions and capacities. It could also have encouraged providers to develop voluntary detection tools, without imposing uniform obligations. Parliament chose the regulatory path, with the risk of slowing local initiatives.
Extend for one year, but lock down encryption: Parliament protects privacy without guaranteeing the protection of children.
