On 29 June the Council and Parliament will sit down for the fifth and final trilogue on the Child Sexual Abuse Regulation, the file Brussels has spent four years failing to pass. Adoption is promised for July. The promise has been made before. What the negotiation will test is not whether Europe can protect children online, a goal no participant disputes, but whether the Union’s machinery can convert agreement on ends into agreement on means before the gap between them claims another year. On the present evidence, the question is open.

The case for the Council’s instinct deserves a fair statement, because the scale of the harm is not in doubt. The US National Center for Missing and Exploited Children logged more than one hundred million files of suspected abuse material through its CyberTipline in 2023, and when the EU’s voluntary-scanning basis lapsed on 3 April this year, a working tool went dark across the bloc. Europol has been blunter still: its 2026 threat assessment argues that the spread of encryption is widening the space in which exploitation operates unseen. The problem is European, not abstract: the Internet Watch Foundation traced 62 per cent of the world’s known abuse webpages in 2024 to servers inside the Union, which is the largest host of the very material it cannot agree how to police. The Commission built its case on the same premise: in its impact assessment it deliberately selected the most far-reaching option on the table, detection of known material, new material and grooming alike, on the ground that voluntary action had left the Union, in its own words, still failing to protect children. Those who want detection obligations are not authoritarians hunting for a pretext; they answer a catalogue of harm that grows by the day.

The case for Parliament’s resistance to the Child Sexual Abuse Regulation is equally serious, and it is not squeamishness. The detection the Council favours, applied to encrypted services, requires scanning a message on the sender’s device before encryption seals it. The European Data Protection Board and the European Data Protection Supervisor, the Union’s own privacy regulators, warned in a joint opinion that the measure risks becoming the basis for generalised and indiscriminate scanning of virtually all electronic communication. The Supervisor, Wojciech Wiewiórowski, put it starkly: generalised access to the content of communications, he said, affects “the essence of the right to private life.” More than three hundred cryptographers and security researchers have made the technical case alongside them, that client-side scanning cannot be added to an encrypted system without weakening it for everyone, because the scanning component becomes a new point of access that a future policy, not a new line of code, can widen. The protection encryption offers is conditional on no third party reading the message, and a mandated scanner is a third party by construction. Signal has said it will leave the European market before it will comply, and Germany’s governing coalition has likened indiscriminate scanning to opening every letter on the chance that one conceals a crime.

A regulation built to postpone itself

Here the argument turns, because the deadlock over the Child Sexual Abuse Regulation is not a failure of will. It is the predictable output of an institutional design that distributes the question across bodies built to want different things. The Council aggregates twenty-seven interior ministries, each answerable to a national electorate that feels the harm of abuse more vividly than the abstraction of a degraded encryption standard. Parliament answers to digital-rights advocates, technologists and civil-liberties committees for whom that standard is the harm. The Commission proposes and mediates. Each institution behaves rationally within its own incentives, and the sum of three rational actors is paralysis, because no single body owns the outcome and so no single body pays the price of failure. The contradiction runs inside the Council itself: its own Legal Service warned in April 2023 that the detection regime sat uneasily with Articles 7 and 8 of the Charter as the Court of Justice has read them, leaving compliance with fundamental rights largely to the discretion of the providers being ordered to scan. The relevant case law is settled and adverse: in La Quadrature du Net the Court held that general and indiscriminate retention of electronic communications data is incompatible with Union law, a principle that detection orders sweeping across all users would struggle to survive. A body negotiating against the written advice of its own lawyers, on ground its highest court has already mapped, is not deadlocked by conviction alone.

A negotiation that requires accumulated trust is reset twice a year by design.

The rotating presidency compounds the problem rather than resolving it. The Child Sexual Abuse Regulation has passed through successive presidencies, each inheriting a text, each reopening the central wound of scanning versus encryption, each handing an unfinished compromise to the next capital six months later. Denmark drafted the latest version and could not secure a Council vote. The Polish presidency carried it forward. Continuity of personnel, the thing a contested technical file most needs, is the one thing the system is structured to deny it. A negotiation that requires accumulated trust is reset twice a year by design.

The cost of the gap

The consequence of stalling the Child Sexual Abuse Regulation is not merely a delayed file. It is a vacuum with real occupants. When the interim derogation expired in April, the legal basis for voluntary scanning vanished, and the major platforms split: some announced they would continue scanning without a legal basis, others stopped. The result is the worst of both worlds the deadlock was meant to avoid. Scanning continues where no law authorises it, which is the surveillance the privacy camp fears, and stops where children were being protected, which is the exposure the protection camp fears. Four years of procedure has delivered, in the interim, precisely the two outcomes both sides agree are wrong.

There is a defence of all this, and it should be heard. Slow lawmaking on a question like the Child Sexual Abuse Regulation, touching both child safety and fundamental rights, is not obviously a vice. A Union that rushed to mandate client-side scanning, broke encryption for four hundred million people, and could not undo the damage would have erred far more gravely than one that deliberated too long. Friction is sometimes the system protecting citizens from a hasty majority, and anyone impatient with Brussels should sit with that before dismissing it.

But it proves less than it claims. There is a difference between deliberation and incapacity, and the test is whether the delay produces a better answer or merely defers the same fight. Four years and five trilogues have not narrowed the core disagreement, scanning against encryption, by a single substantive inch; they have only moved it from capital to capital. Deliberation that converges is a virtue. Deliberation that circles is a structure failing to do the one thing structures exist to do, which is to decide. The interim lapse is the proof: a system genuinely deliberating would not have let its existing protection expire with no replacement in hand.

The deadlock is the more dispiriting because a middle register exists and has been mapped in detail. Detection orders issued by a judge against a specific account on specific grounds, rather than a blanket obligation across all users, would import the warrant logic that governs physical searches into the digital one. Metadata analysis, patterns of contact and distribution rather than message content, catches much grooming behaviour without reading a word anyone writes. Age-verification systems, contested in their own right, address grooming at the point of contact rather than through surveillance of everyone.

None of these is a clean answer, and their critics are not wrong. Targeted detection orders presuppose that authorities already know which account to suspect, which is little help against abuse that has not yet surfaced. Metadata analysis is itself a revealing form of surveillance. Age verification, to work, tends to demand the identity disclosure that erodes the anonymity on which dissidents, journalists and abuse survivors themselves depend. The point is not that these measures are costless. It is that they map a contested middle ground where the genuine policy argument lives, and four years of negotiation have produced no legislation within it.

What the 29 June trilogue will reveal is which of these the Union has been doing. If the Child Sexual Abuse Regulation emerges in a form that genuinely reconciles detection with encryption, through narrow targeting, judicial authorisation and a hard exemption for end-to-end services, then the years will have bought something. If instead the deal papers the disagreement with ambiguous language about risk mitigation that each side reads as victory, the file will pass and the substantive fight will move to the courts, where the Court of Justice will rule on what the legislators left unresolved. There is a particular irony in that destination. A regulation written to protect children would arrive at the bench having protected no one in the interim, its hardest question answered not by the parliament that debated it for four years but by judges who never stood for election. Europe is about to discover whether it legislates its values or merely litigates them.