Cybersecurity Policy Report, European Parliament Moves Toward Narrowed CSAM Detection Privacy Exemption, (Jul 9, 2026)

By Jeff Williams

The European Parliament today adopted amendments to the Council of the European Union’s position on the application of European Union e-Privacy rules, so that electronic communication services may voluntarily detect child sexual abuse material online, while excluding encrypted communications.

The Council position “would effectively have brought back a lapsed derogation allowing providers to voluntarily detect child sexual abuse (CSA) and solicitation of children in private communications on their services and remove and report relevant material,” and the amendments seek to “exclude ‘communications to which end-to-end encryption is, has been or will be applied’ from the scope of the law,” a Parliament press release said.

According to the release, the amendments will now be sent to the Council, which has three months to approve or reject them. “If the Council does not accept all of the amendments, EP and Council will move to conciliation to agree on the law,” it said.

Members of Parliament voted in March to extend until Aug. 3, 2027, the existing privacy rule exemption ahead of its scheduled April 3 expiration (CPR, March 13). Parliament and the Council could not reach a final agreement on extending the derogation, resulting in the exemption expiring, the release said.

“Subsequently, the Council decided to send the proposal back to Parliament for a second reading,” the release said. “The derogation is meant to be a temporary measure to prevent a legal vacuum while talks on a permanent regime to combat child sexual abuse online are ongoing.”

News: InternationalLegislation DataPrivacy