The Belgian EU Council Presidency has introduced a compromise text aimed at detecting and preventing online child sexual abuse material (CSAM). The proposal refines risk categorisation thresholds and outlines data retention obligations for service providers.

However, it has faced criticism for potentially allowing authorities to scan private messages on platforms like WhatsApp or Gmail. The draft legislation enables service providers to flag potential abuse, triggering detection orders mandating active searching for abusive content. Providers are also required to assist the newly established EU Centre by conducting audits at the source code level to combat such material.

Additionally, the compromise introduces specific risk thresholds for categorising service providers. It emphasises adherence to data processing principles, particularly focusing on lawfulness, purpose limitation, and data minimisation in age verification measures.

Why does it matter?

The EU's proposed legislation to employ surveillance technologies for detecting CSAM in digital messaging faced further scrutiny as the Commission's ombudsman criticised the lack of transparency in communications with a child safety tech company early this year. Critics argue that the proposal poses risks to privacy and fundamental freedoms and suggest lobbyists influenced it.

Since the law needs approval from the Commission, Council, and Parliament, the next step with the CSAM proposal remains to be determined.