The European Union’s proposed Child Sexual Abuse Regulation (CSAR), commonly referred to as “Chat Control,” is a legislative effort to address the rapid growth of online child sexual abuse material (CSAM) and grooming. Introduced by the European Commission in May 2022, the proposal builds on the EU’s 2020 Strategy for a More Effective Fight Against Child Sexual Abuse and aims to harmonize obligations for online service providers across the EU. These obligations include risk assessments, mitigation measures, detection of CSAM, reporting to authorities, and victim support, coordinated through a newly established EU Centre.
One of the challenges of the proposal concerns end-to-end encryption (E2EE). While encryption protects users’ privacy and data security, it also limits platforms’ ability to detect illegal content. The Commission’s original proposal sought to resolve this tension by allowing authorities to order mandatory scanning of private communications, including encrypted messages via client-side scanning. This approach sparked intense opposition from privacy advocates, technologists, and several Member States, who warned it would undermine encryption, violate fundamental rights, and turn private devices into surveillance tools.
Between 2022 and 2025, the proposal underwent substantial revision. Political resistance, particularly within the European Parliament and the Council, led to the removal of mandatory scanning orders. In November 2025, the Council agreed on a revised text that abandoned compulsory detection. Instead, the current draft establishes a permanent framework for “voluntary” CSAM scanning, supported by a three-tier risk classification system (low, medium, high risk). High-risk services must adopt “risk-mitigation measures,” with scanning listed as one possible option. Providers that voluntarily scan may benefit from legal certainty, financial support, and improved risk classification.
Despite the removal of formal mandates, critics argue that the system creates strong indirect pressure to scan communications. Platforms may feel compelled to participate in scanning to avoid high-risk labeling, regulatory scrutiny, fines, or reputational harm. As a result, “voluntary” scanning may function as mandatory in practice. The regulation also introduces a permanent exception to the ePrivacy Directive, extending what was previously a temporary derogation.
Additional controversial elements remain. Potential mass scanning of private communications, raises concerns about false positives and algorithmic bias in automated detection systems, and reintroduces age and identity verification requirements that could undermine anonymity and may potentially conflict with GDPR data-minimization principles. Critics warn these measures can disproportionately affect vulnerable groups, weaken trust in digital services, and normalize mass surveillance
As of December 2025, the regulation is in trilogue negotiations, with a final agreement expected in 2026. While the EU’s commitment to child protection is widely supported, significant legal, ethical, and technical concerns persist. The core debate remains unresolved: how to effectively combat online child sexual abuse without eroding privacy and fundamental rights.
For the full report, click the link here and learn more.