Brussels: Few files have divided European policymakers as bitterly as the regulation meant to combat child sexual abuse online, and the spring of 2026 has forced the argument to a head. With the interim rules that let platforms voluntarily scan for abuse material due to expire on 3 April, the Commission proposed extending them to 2028, buying time for negotiators still deadlocked over the permanent law that is supposed to replace them.
The stakes are wrenching on both sides. The proposed regulation would oblige online services to detect, report and remove child sexual abuse material, and would create a new EU Centre on Child Sexual Abuse to coordinate the effort and support investigators. Child-protection groups argue that voluntary scanning catches millions of images a year and that letting the legal basis lapse would blind investigators overnight.
The fear on the other side is what critics have dubbed chat control: the possibility that detection obligations could extend to private and encrypted messages, requiring providers to scan communications before they are sealed. The European Data Protection Supervisor has warned repeatedly that indiscriminate scanning of everyone’s messages to find the guilty few is incompatible with the Union’s privacy guarantees, and member states remain split, with several blocking the Council’s harder-edged versions.
The Council reached a negotiating position late last year that preserved the voluntary-scanning exemption, but the gap with a Parliament determined to ringfence encryption has proved hard to bridge. The extension of the interim rules is essentially a holding action, an admission that the institutions cannot yet agree on the permanent architecture and would rather freeze the status quo than let the tools disappear. Data-protection authorities convened again in June to scrutinise how the file interacts with the bloc’s broader digital rulebook.
Beneath the technical dispute lies a genuine clash of fundamental rights, not a contest between good and bad faith. One side weighs the duty to protect children from abuse; the other weighs the right of every citizen to private correspondence and the structural danger of building scanning infrastructure that a future government could repurpose. Europe has spent years insisting it need not choose between the two. The unresolved regulation is the standing evidence that, so far, it has not found the formula that lets it avoid choosing. Whichever way the file resolves, it will set a precedent far beyond child protection, defining how far the Union is willing to let detection duties reach into private communication, a line that every future content-moderation law will be measured against.




