The European parliament has allowed a law that allows tech firms to scan their platforms for child sexual exploitation to lapse, as concerns of the proliferation of child exploitation material and privacy continues to collide.

Meta, Google, Snap, and Microsoft have slammed the EU for not extending the temporary allowance, which was put in place in 2021 as an add on to the EU Privacy Act. The measure allowed big tech firms to employ automated detection to scan message for certain harms, such as child sexual abuse material (CSAM), as well as sextortion and grooming.

Amid privacy concerns from lawmakers in the parliament, the EU Parliament voted to not extend the order, which expired on 3 April. The lapse of the temporary law was noted as a positive for privacy campaigners, who voiced concerns that encrypted messages and data were being viewed in the scans, infringing people’s right to privacy.

Now, scanning for such harms by big tech firms would be illegal under the EU Privacy Act, but large platforms are still liable for any illegal content hosted on their platforms under the Digital Services Act, creating a legal no-mans-land.

Scanning for CSAM was an easier line of defence for tech firms, though CSAM, grooming, and sextortion still run rampant on the internet. Further, allowing tech firms to pre-emptively scan messages that would otherwise be encrypted negates the promises of privacy that should be guaranteed with end-to-end encryption.

In response, large tech companies have written a joint statement that they will continue to voluntarily scan content on their platforms for CSAM and similar illegal content.

“While EU institutions rightly expect technology companies to take action on child safety, the April 3 expiry of the derogation clouds the legal certainty that has helped responsible platforms try to protect our communities, safeguard child victims, and preserve the integrity of our services. We are disappointed by this irresponsible failure to reach an agreement to maintain established efforts to protect children online,” the statement, signed by Google, Meta, Microsoft, and Snap, read.

Recommended reading

• Meta Exec Called Encryption Plans “So Irresponsible,” Court Doc Reveals
• Meta To Remove Encryption From Instagram DMs
• Apple Backdoor Encryption Appeal Case Dismissed

The EU is looking to formalise particular laws regarding CSAM scanning whilst affirming personal privacy, a consistently tenuous balancing act for regulators across the globe. While the EU is looking at measures to prevent the creation and proliferation of CSAM and the child exploitation inherent in its production, the new legal gap could lead to a surge of the material across social platforms.

The signatory platforms have said that they “will continue to take voluntary action on our relevant Interpersonal Communication Services.”

The EU’s proposed chat control, which lapsed, temporarily ushered in a new level of mass scanning that privacy advocated deemed “surveillance”, creating a backdoor to encryption. The proposal is still being debated , though conversations are now focusing on age verification and voluntary measures rather than mandated scanning practices.