EU Voluntary CSAM Detection Authority Expires After Parliament Rejects Extension, Creating Legal Uncertainty for Platforms

The European Union's temporary derogation from the ePrivacy Directive, which had since 2021 permitted online platforms to voluntarily detect and remove child sexual abuse material in private communications, expired on April 3, 2026 after the European Parliament and Council of the European Union failed to agree on an extension. Parliament rejected the extension on March 26, 2026 following sustained opposition over privacy concerns, despite having backed a narrower prolongation until August 2027 on March 11. The lapse removes the legal basis that had allowed messaging, webmail and internet telephony platforms to scan private communications for CSAM under limited conditions, leaving the EU without an interim arrangement while negotiations on a permanent Child Sexual Abuse Regulation framework continue, and creating significant legal uncertainty for providers over whether detection activities remain compatible with EU law.

The expiry demonstrates the structural tension inherent in framework-level prohibitions that treat detection as a derogation from privacy rather than a protective function: platforms now face the choice of curtailing abuse detection to avoid potential conflict with privacy law, or continuing without clear legal authority. Real-time pattern-based detection of the kind Guardii delivers operates differently from the content-scanning measures covered by the derogation. By identifying the shape of coercive or exploitative exchanges—sustained targeting, escalation toward image sharing, sextortion threats, age-inappropriate contact—before material is created or transmitted, such systems flag risk at the conversational layer rather than scanning message content or traffic data after the fact. That approach addresses the child-safety imperative the derogation was designed to meet while avoiding the indiscriminate mass-scanning objections that led Parliament to reject the extension, offering a technically and legally distinct pathway for platforms seeking to maintain protections without relying on exemptions from privacy rules.