A stalemate that keeps its own default in place
At the sixth political trilogue on the Child Sexual Abuse (CSA) Regulation, held in Brussels on a Tuesday in late September 2026, negotiators again failed to agree on scanning private chats. Netzpolitik reports that the only agreement concerned the tasks of the EU Centre on child sexual abuse, as Parliament rapporteur Javier Zarzalejos announced. Netzpolitik says no date has been set for the next political round, though technical talks continue.
The pattern matters more than any single round. The Commission tabled the proposal on 11 May 2022 as COM(2022) 209. Parliament adopted its position in November 2023. Four-plus years on, the permanent law does not exist, and what fills the vacuum is a temporary exception that was never meant to be the main regime.
The strongest case for mandatory detection
The case for compulsion deserves a fair statement. Voluntary scanning depends on companies choosing to look. Some will not, and the volume of abuse material that circulates through private channels is not something regulators can see directly. A mandatory order, issued by a court or authority against a specific service, gives investigators a lever that does not rely on corporate goodwill. Netzpolitik notes that the Council itself worries narrower targeting could detect fewer cases than today's voluntary scanning. Child-protection advocates are right that this is a real trade-off, not a rhetorical one.
Where the two institutions actually stand
According to Netzpolitik's account, the Council wants to delete detection orders from the law and rely on voluntary scanning. Parliament wants to keep mandatory orders but make them as targeted as possible, and has not settled whether they should aim at individual users, groups of users or parts of a service. Open questions include whether courts or administrative authorities issue orders. Parliament would also restrict providers that scan on their own initiative to known material already in the EU Centre's database, and require them to connect to it.
A new term, "search plans", also surfaced. Netzpolitik reports that providers would describe their detection technology and error safeguards in such plans, which would be required for scanning non-public content whether voluntary or ordered. Council-side German negotiators reportedly rejected the term beforehand as unclear. That is a fair complaint: a safeguard that nobody can define is not yet a safeguard.
The oddity is that both sides have moved toward each other in structure. Parliament's mandatory orders are narrow; the Council's voluntary regime is to be made permanent "in an adapted form", per the Irish Presidency's proposal. The remaining gap is whether the state can compel scanning at all.
The stopgap has become the policy
The interim ePrivacy derogation lapsed on 3 April 2026 after Parliament voted 228 to 311, with 92 abstentions, to reject the Commission's extension. Parliament's stated aim was proportionate, targeted measures, and it had backed a shorter extension to August 2027 with narrower scope. The gap was closed by Regulation (EU) 2026/1881, which entered into force on 31 July 2026 and runs until 3 April 2028, per that tracker.
This matters for the trilogue. With voluntary scanning legally secure for roughly 18 more months, the Council has little pressure to concede mandatory orders, and Parliament has little pressure to abandon them. Deadlines drive deals in Brussels; a deadline pushed to 2028 removes the incentive to compromise now.
What a proportionate outcome looks like
Our view is that Parliament's narrow approach and the Council's voluntary approach are closer to a workable compromise than the headlines suggest, provided three conditions hold.
- Encryption stays outside scope. Netzpolitik notes both institutions rejected client-side scanning of end-to-end encrypted content, a feature of the original 2022 draft. That should be written into the final text explicitly, not left to later interpretation, because a scanning obligation that cannot work without weakening encryption is a security risk for every user, including children.
- Known-material matching first. Hash-matching against a curated database is the least error-prone tool and the least invasive. Parliament's proposal to confine voluntary scanning to that database is a defensible guardrail, and it is the part of the debate with the best evidence behind it. Detection of new material and grooming relies on classifiers whose false positives land on innocent people's private messages.
- Judicial authorisation and measured reporting. If orders survive, a court should issue them, against defined service components, with published statistics on accuracy. Without error data, no one can tell whether scanning protects children or only generates reports.
The EU Centre agreement is the genuinely useful part. Netzpolitik reports the Centre may search publicly accessible spaces, such as public cloud storage and social media, for known and new material, a largely uncontested task. Public-space detection is where the proportionality problem is smallest.
The risk of drift
The danger is not that the talks fail loudly but that they fail quietly. Each interim extension normalises scanning of private communications under a temporary exception, with weaker safeguards than a purpose-built law would carry. Innovation and speech both suffer when the rules for private communications rest on a derogation that must be renewed every couple of years. Legislators should use the time to settle the real question, whether compulsion is justified at all, rather than to negotiate around it.