EU extends interim rules for voluntary detection of online child sexual abuse material until 2028

The European Commission has welcomed the Council of the European Union’s adoption of a renewed interim regulation that allows eligible online communication service providers to continue voluntarily detecting, reporting, and removing child sexual abuse material (CSAM), as well as identifying instances of online grooming.

The new regulation reinstates a temporary derogation from certain provisions of the ePrivacy Directive, restoring the legal basis for providers to carry out these voluntary activities. The previous interim framework expired on 3 April 2026, leaving providers without a specific EU legal framework governing the voluntary use of detection technologies.

The renewed rules will remain in force until 3 April 2028, providing legal continuity while EU institutions continue negotiations on a permanent legislative framework to prevent and combat online child sexual abuse.

The regulation also incorporates amendments adopted by the European Parliament on 9 July, which exclude interpersonal communications protected by end-to-end encryption from the scope of the interim rules. Providers choosing to use voluntary detection technologies must continue to comply with applicable data protection requirements and other safeguards designed to protect users’ rights.

According to the European Commission, reports of newly created child sexual abuse material have increased by more than 200 times over the past three years, with the misuse of artificial intelligence identified as one contributing factor. During the same period, reports of online grooming have risen twelvefold. The Commission noted that voluntary reporting by service providers plays an important role in identifying victims, supporting law enforcement investigations, and removing abusive material that can continue to harm survivors long after it is first created.

While welcoming the extension, the Commission reiterated that the regulation is intended as a temporary measure and called for progress towards adopting a permanent EU framework addressing online child sexual abuse.

Why does it matter?

The extension ensures that online communication providers can continue voluntarily detecting and reporting child sexual abuse material under a clear legal framework while the EU develops long-term legislation. The inclusion of safeguards, including the exclusion of end-to-end encrypted interpersonal communications, reflects the ongoing effort to balance child protection objectives with privacy and data protection rights. The interim rules also provide continuity for law enforcement and child protection efforts as online threats, including AI-assisted abuse and online grooming, continue to evolve