The Council of the European Union has initiated a written procedure to approve the European Parliament's amendments to a draft regulation that temporarily allows providers of number-independent interpersonal communications services to process personal data for combating online child sexual abuse. The procedure, launched on 23 July 2026, sets a deadline for delegations to submit their final decision by 23 July 2026 at 16:00 Brussels time.
The draft regulation introduces a temporary derogation from specific provisions of Directive 2002/58/EC (the ePrivacy Directive), enabling messaging apps and similar services to deploy detection technologies such as scanning for child sexual abuse material without full ePrivacy safeguards. The measure is intended to provide a legal basis for such processing until a permanent framework is adopted.
The written procedure follows the European Parliament's adoption of amendments at second reading, which the Council must now approve to finalise the regulation. The temporary derogation is limited in duration and applies exclusively to data processing for combating online child sexual abuse.
Policy orientations and trade-offs The regulation strikes a balance between child protection and privacy rights. By permitting data processing without full ePrivacy compliance, it enables faster detection of abuse material but raises concerns about user confidentiality and potential mission creep. The temporary nature of the derogation creates urgency for a permanent legislative framework that addresses both objectives.
Impact on stakeholders - Providers of number-independent interpersonal communications services (e.g., WhatsApp, Signal, Telegram): Gain a temporary legal basis to deploy detection technologies, reducing legal uncertainty but facing potential reputational risks from privacy advocates. - EU citizens and users: May benefit from enhanced protection against child exploitation but face reduced privacy guarantees, as their communications could be scanned without full ePrivacy safeguards. - National authorities and law enforcement: Obtain a clearer legal pathway to request data from service providers for combating child sexual abuse, improving operational effectiveness. - Privacy and civil society organisations: Likely to oppose the derogation as a precedent for weakening ePrivacy protections, arguing it undermines fundamental rights to confidentiality of communications.
Institutional follow-up The written procedure requires all Council delegations to submit their positions by the deadline. If approved, the regulation will be adopted and published in the Official Journal, entering into force shortly thereafter. The European Commission is expected to propose a permanent framework for combating online child sexual abuse, which will undergo the ordinary legislative procedure.