Category: Software

Key Takeaways

1. The revised Danish proposal for the EU’s Child Sexual Abuse Regulation (CSAR) removes mandatory detection orders but introduces Article 4 duties for high-risk services to apply “risk-mitigation measures.”

2. Critics argue that the “voluntary” detection framework could lead to mandatory scanning, particularly affecting end-to-end encrypted services, raising concerns about privacy and security.

3. Ongoing debates highlight the conflict between the Council’s approach and the Parliament’s stance on encryption and mass scanning, with fears that Article 4 could pressure providers into client-side scanning.

4. Privacy advocates warn that the “voluntary plus risk-mitigation” strategy may coerce platforms into compliance that undermines encryption, despite no automatic EU-wide scanning being established without a formal law.

5. Key negotiating points for the upcoming trilogue discussions include encryption protections, the extent of scanning, and the role of the EU Centre, with a tight timeline as Denmark’s presidency ends in December.

---

National officials from the Council’s Law Enforcement Working Party convened on November 12. Based on various policy briefings and media reports, they showed considerable support for a revised compromise put forth by Denmark regarding the EU’s Child Sexual Abuse Regulation, often referred to as “Chat Control.” The new draft eliminates the earlier requirement for mandatory detection orders but introduces Article 4 duties for “risk-mitigation measures.” This revised draft is now anticipated to advance to COREPER, the Committee of Permanent Representatives comprised of ambassadors from EU countries, for further evaluation.

Changes in Detection Mandates

The updated Danish proposal removes the previous hard requirement to monitor private communications and redefines detection as “voluntary.” However, it requires high-risk services to apply “all appropriate risk-mitigation measures” under Article 4. Critics argue this could effectively lead to mandatory scanning, even for end-to-end encrypted services. Policy experts also point out review processes and enforcement mechanisms that may create strong incentives for adopting scanning tools, despite the “voluntary” designation.

Concerns About Encryption

End-to-end encryption is created so only the sender and receiver can access messages. Scanning generally involves reviewing content before it is encrypted on user devices, which advocates for security claim could compromise privacy and overall system security. The Parliament’s previous stance opposes broad, indiscriminate scanning and aims to safeguard encryption. This may result in a potential conflict if the Council’s approach uses Article 4 to pressure providers towards client-side scanning. Moreover, a leaked draft from April 2024, reported by Contexte, indicated that EU interior ministries were pursuing exemptions for professional accounts and “confidential information” from any mass-scanning measures, which attracted criticism from MEP Patrick Breyer and various rights organizations for a perceived double standard.

Ongoing Debates and Future Implications

The Commission introduced the CSAR in May 2022 to establish a lasting framework for identifying, reporting, and removing child-abuse content, which included an EU Centre. From the beginning, controversies have revolved around mass scanning and risks to encryption. Throughout 2023 and 2024, multiple discussions within the Council and Parliament could not bridge the gap in differing opinions. A push for stricter mandates faltered in October 2025 when a qualified majority was not achieved, prompting Denmark to propose the current compromise.

Article 4 and Its Impact

Reviews of the new draft indicate that Article 4 requires providers marked as high-risk to adopt “all appropriate risk-mitigation measures,” which could mean on-device scanning for known and new material. Advocates argue this effectively equates to “de facto” detection without explicitly stating so. Concerns are also being raised that identity and age-verification requirements could undermine anonymity, potentially endangering journalists, activists, and whistleblowers.

If COREPER approves the text, ministers may adopt a Council stance and enter trilogue negotiations with the European Parliament to seek a final agreement. The timeline is quite tight, as Denmark’s presidency is set to conclude in December, with Poland slated to take over in January. Observers are predicting that encryption protections, the extent of any scanning, and the role of the EU Centre will be key negotiating points in potential discussions.

Warnings from Privacy Advocates

Privacy and digital rights organizations are cautioning that the “voluntary plus risk-mitigation” approach could coerce platforms into scanning as a means of compliance, which might undermine encryption even in the absence of explicit mandates. According to more impartial voices, there will not be any automatic EU-wide scanning of everyone’s messages unless a singular, agreed-upon law is formally enacted. Under the Parliament’s framework, any scanning would only be permitted through specific, time-limited orders that require court or independent authority approval on a case-by-case basis. In any scenario, any future scanning system will ideally have to respect EU Charter rights, particularly Article 7 concerning private life and communications, as well as Article 8 on personal data and independent oversight.

 

Source:
Link

---