The Regulation to Prevent and Combat Child Sexual Abuse (also known as the Child Sexual Abuse Regulation, or CSAR) is proposed European Union legislation designed to compel digital platforms to assess and mitigate risks related to the dissemination of abuse material and online grooming. The draft law also aims to enable authorities to remove or block illegal content while establishing a specialized center for regional coordination and victim assistance. In public and political discourse, the initiative is widely criticized and referred to by detractors as Chat Control 2.0 or simply Chat Control.
While the framework is strongly supported by child advocacy groups and most EU member states, the legislative process has been gridlocked by disagreement over the scope and legal safeguards of automated monitoring. Although inter-institutional compromises have been achieved on a majority of the provisions, there remains an ongoing deadlock regarding controversial mandatory detection orders. Civil society organizations and privacy activists contend that requiring social media companies and messaging apps to proactively scan communications would compromise the right to privacy and data protection by introducing indiscriminate surveillance.
Background The European Union's historical approach to child sexual abuse was fragmented, divided between a 2011 criminal-law directive implemented unevenly by member states, voluntary industry practices by digital platforms, and disconnected law enforcement and victim support initiatives. Official reviews of the 2011 directive identified significant implementation gaps, prompting the Council and the Parliament to call for a more coordinated EU-wide framework in late 2019.
The onset of the COVID-19 pandemic intensified these vulnerabilities by shifting schooling and social interactions online, which increased the digital exposure of children to offenders while simultaneously reducing the operational capacity of hotlines and law enforcement bodies. In response, the European Commission integrated the issue into its 2020 Security Union programme, and formally adopted its strategy for "a more effective fight against child sexual abuse" on 24 July 2020. This comprehensive strategy consolidated prevention, enforcement, and victim support under a single initiative, proposing temporary and permanent legislative measures to harmonize and expand voluntary platform detection mechanism practices.
In October 2022, Article 18 of the Digital Services Act introduced emergency reporting mandates for specific online businesses to flag imminent threats to life or safety. While these mechanisms are broadly compatible with the objectives of the CSAR, the regulation explicitly stopped short of imposing general or proactive content monitoring obligations.
Industry practice
Voluntary detection of child sexual abuse material (CSAM) by digital platforms dates back at least to the mid-1990s, when AOL manually reviewed suspected abuse material and subsequently developed automated detection processes. By 2015, the Internet Watch Foundation (IWF) was distributing a database of digital fingerprints, or hashes, derived from confirmed abuse material. The database included material identified through the IWF's own investigations, reports from the public and internet companies, and the UK's Child Abuse Image Database. Facebook, Google, Microsoft, Twitter and Yahoo participated in trials and implementation of the service, comparing hashes generated from newly uploaded images with those in the IWF database.
The use of automated detection and reporting systems has since become widespread, but their implementation and coverage vary substantially between services. A 2022 analysis submitted in the context of the proposed regulation argued that the voluntary system of detection and reporting by companies had proven insufficient to adequately protect children.: "It is submitted that the current system based on voluntary detection and reporting by companies has proven insufficient to adequately protect children" The number of reports submitted to the National Center for Missing & Exploited Children (NCMEC) also varies considerably between platforms. In 2020, Facebook submitted 20.3 million reports, compared with 546,704 from Google, 144,095 from Snapchat, 96,776 from Microsoft, and 265 from Apple.
The extent to which these systems can be evaluated is limited by differences in transparency and reporting practices. A 2023 survey of 50 online services found that only 20 published transparency reports on child sexual exploitation and abuse, while only 10 defined such material in sufficient detail to establish what was prohibited on their services. A separate study likewise found substantial differences in the metrics and reporting methods used by online services, making it difficult to assess the effectiveness of their measures.
Automated detection
Existing industry practice relies primarily on automated detection technologies. Perceptual hashing is widely used to identify previously known material, while some providers use machine learning to detect previously unknown images and videos, and machine-learning-based analysis of text to identify potential online grooming.
One of the most widely used perceptual hashing systems is PhotoDNA, developed by Microsoft and Dartmouth College in 2009. In an analysis published by Ofcom in 2024, a PhotoDNA threshold selected to provide greater resistance to image alterations produced a false-positive rate of 0.3% under the conditions of the study. Published independent performance data for other commercial classifiers and systems designed to detect grooming have generally been limited. Child Rights International Network noted that claims about the accuracy of PhotoDNA and other detection tools were not supported by sufficient independent evaluation, while the European Commission's impact assessment did not provide specific false-positive rates for some of the classifiers it considered.
The accuracy and implications of automated detection can vary depending on the prevalence of the material being sought and the characteristics of the detection system. Of 4,192 reports assessed by the Irish police in 2020, 852 were confirmed to contain child sexual abuse material and 471 were classified as false positives. The figures have been cited as an illustration of the base rate fallacy in the context of large-scale detection systems. However, these figures describe reports received and assessed by law enforcement and should not be interpreted as a general estimate of the accuracy of automated detection systems. In contrast, a 2025 European Commission review reported that the automated detections examined in its assessment were "overwhelmingly confirmed" as child sexual abuse material following human review.
ePrivacy derogation
The ePrivacy Directive was adopted in 2002 to regulate the processing of personal data and the protection of privacy in the electronic communications sector. The European Electronic Communications Code (EECC), adopted in 2018, included interpersonal communications services within the EU electronic communications regulatory framework. Member States were required to apply the EECC from 21 December 2020.
The change in the legal framework affected the use of technologies by providers of number-independent interpersonal communications services to detect child sexual abuse material (CSAM) and the solicitation of children in private communications. In September 2020, the European Commission proposed a temporary derogation from certain provisions of the ePrivacy Directive to permit such technologies to continue to be used under specified conditions. The legal uncertainty surrounding the change was associated with a reduction in reports of suspected child sexual abuse material from services operating in the European Union to the National Center for Missing & Exploited Children (NCMEC); the Internet Watch Foundation reported a 58% decrease over an 18-week period in late 2020 and early 2021.
Regulation (EU) 2021/1232 established the temporary derogation in July 2021. It allowed providers of number-independent interpersonal communications services to voluntarily use specified technologies to detect, report and remove online child sexual abuse material and to detect and report the solicitation of children, subject to conditions and safeguards. The regulation entered into force on 2 August 2021 and, following an extension in 2024, remained applicable until 3 April 2026. The derogation was sometimes referred to as "Chat Control 1.0", particularly by organisations opposing the voluntary detection measures.
During 2023, Meta reported that its services had actioned approximately 3.6 million pieces of CSAM detected using its media-matching technology in message threads involving an EU user. Users appealed approximately 7% of these actions, and 4.6% of the appealed items were restored after review.
In March 2026, the European Parliament rejected a proposal to extend the application of Regulation (EU) 2021/1232. On 26 March, Parliament voted by 228 votes to 311, with 92 abstentions, against the proposed extension. Parliament had supported a shorter extension, until August 2027, with a narrower scope, while the Commission proposal would have extended the derogation until 3 April 2028. No agreement was reached with the Council, and Regulation (EU) 2021/1232 consequently ceased to apply on 3 April 2026.
A new temporary derogation was subsequently adopted as Regulation (EU) 2026/1881. Adopted by the European Parliament and the Council on 24 July 2026, it again permits providers of number-independent interpersonal communications services to voluntarily use specified technologies to detect, report and remove online child sexual abuse material and to detect and report the solicitation of children, subject to conditions and safeguards. The regulation was published in the Official Journal of the European Union on 28 July 2026 and is currently in force. It applies until 3 April 2028.
Provisions
In furtherance of its 2020 strategy for a more effective fight against child sexual abuse, the European Commission proposed a regulation in May 2022 to lay down rules for preventing and combating child sexual abuse online. The proposal would establish obligations for online service providers to assess and mitigate the risk that their services could be misused for the dissemination of child sexual abuse material (CSAM) or the solicitation of children. It would also establish procedures for the detection, reporting and removal of CSAM, provide measures to assist victims in removing material depicting them, and establish an EU Centre on Child Sexual Abuse.
Under the Commission proposal, providers would be required to carry out risk assessments covering the possibility that their services could be misused for the dissemination of CSAM or the solicitation of children. Providers would then be required to take proportionate measures to mitigate identified risks, including measures relating to the design and operation of their services, reporting mechanisms and user safety.
The Commission proposal also provides for detection orders, which could require a provider to detect known or new CSAM or the solicitation of children under specified conditions. Detection orders would be issued by judicial or independent administrative authorities and would be subject to requirements concerning necessity, proportionality and safeguards. The proposal also provides for measures to prevent general monitoring and for the protection of users' fundamental rights.