Chat control: the EU proposal to scan messages for abuse material
On 11 May 2022, the European Commission presented a regulation to tackle child sexual abuse material online (COM(2022) 209). The proposal obliges online services to map out risks, gives authorities the power to have material removed or blocked, and sets up a European centre for coordination and victim support. Its most debated part are the detection orders: mandatory detection of abuse material in communications. Member states and the European Parliament do not yet agree on whether that power should exist, and with which safeguards.
What the proposal covers¶
- Risk assessment. Providers of hosting services, messaging services and app stores must assess how their service could be used to spread abuse material or to approach children, and take measures against it.
- Removal and blocking orders. National authorities can order a service to remove material or to block access to it.
- A European centre. A new agency for coordination, expertise, research and victim support.
- Detection orders. A judge or an independent authority can oblige a provider to search a specific service for known and new abuse material. This part touches on encrypted communication and on the confidentiality of communications, and is the most contested point in the debate.
The temporary arrangement already in force¶
Since 2021 a temporary exception to the European privacy rules for electronic communications (ePrivacy) has applied. It allows platforms to scan messages voluntarily; the exception was extended afterwards and is known in the debate as "chat control 1.0". The proposal is meant to replace it with a permanent framework, with requirements on accuracy, reporting and oversight.
Where opinions diverge¶
Privacy and civil rights organisations, including EDRi, point to the consequences of scanning messages: pressure on end-to-end encryption, loss of anonymity in communication, and the risk that automatic detection marks files as abuse material when they are not, with consequences for the people affected. They argue for dropping the detection orders and for focusing on targeted detection by law enforcement.
On the other side stands the aim of the proposal: child protection organisations and the European Commission point to the volume of material circulating online and note that voluntary detection does not happen everywhere, so part of the material stays out of sight. In their reading, a common framework with independent oversight is more effective than the current patchwork of voluntary arrangements per platform.
To what extent detection works technically is part of the dispute. With automatic file comparison, outcomes depend on the technique used and on human review afterwards; figures on the number of findings and on the number of errors that follow from them are presented differently by different parties.
What is still uncertain¶
- Whether the detection orders will remain in the final text, and if so, with which safeguards (judicial review, restriction to known files, exceptions).
- How effectiveness will be measured and who reports on it.
- When the negotiations between the European Parliament and the Council will be concluded. As long as there is no agreement, the proposal remains under consideration and the temporary arrangement stays in force.
