EU CSAM Scanning Derogation Expires, Leaving Providers in Legal Uncertainty
Summary
The EU's temporary ePrivacy derogation for voluntary CSAM scanning expired April 3, 2026. Authorities warn reports to Europol and NCMEC may fall, while Google, Meta, Microsoft and Snap say they will continue detection.
Key points
- The temporary ePrivacy derogation allowing providers to voluntarily scan private communications for CSAM expired on April 3, 2026, without an agreed extension.
- The framework allowed platforms to use hash matching to identify known CSAM.
- Google, Meta, Microsoft and Snap said they would continue voluntary detection efforts despite legal uncertainty.
- Authorities warn the lapse could reduce reports to Europol and NCMEC. Europol processed about 1.1 million NCMEC CyberTips in 2025, relevant to investigations across 24 European countries.
- The article says a similar lapse in 2021 was followed by a noticeable decline in reporting.
Article Details
- Event Type
- Expiry of the temporary EU ePrivacy derogation that allowed providers to voluntarily scan private communications for CSAM.
- Impact
- The lapse on April 3, 2026 created legal uncertainty for providers continuing voluntary CSAM detection. Authorities warn that reports to Europol and NCMEC could decline, potentially hampering investigations, victim identification, and rescues.
People
Vendors
Googlethat allowed providers to scan private messages has left hash-matching detection used by firms such as Google, Meta, Microsoft and Snap in legal limbo, risking a sharp decline in reports to Europol and NCMEC.Metaallowed providers to scan private messages has left hash-matching detection used by firms such as Google, Meta, Microsoft and Snap in legal limbo, risking a sharp decline in reports to Europol and NCMEC.Microsoftproviders to scan private messages has left hash-matching detection used by firms such as Google, Meta, Microsoft and Snap in legal limbo, risking a sharp decline in reports to Europol and NCMEC.Snapscan private messages has left hash-matching detection used by firms such as Google, Meta, Microsoft and Snap in legal limbo, risking a sharp decline in reports to Europol and NCMEC.