I.   INTRODUCTION

1.

Voluntary detection activities by providers of number-independent interpersonal communications services have played a valuable role in enabling the identification and rescue of victims of online child sexual abuse. Until 20 December 2020, the processing of personal data by providers by means of voluntary measures for the purpose of detecting online child sexual abuse on their services and reporting it and removing online child sexual abuse material from their services was governed solely by Regulation (EU) 2016/679 (1). Directive (EU) 2018/1972 (2), which was to be transposed by 20 December 2020, brought providers within the scope of Directive 2002/58/EC (3) (‘ePrivacy Directive’). In the absence of Union or national legislation restricting the scope of the rights and obligations under the ePrivacy Directive, providers could therefore no longer rely on Regulation (EU) 2016/679 to continue to carry out voluntary measures to detect and report online child sexual abuse on their services and to remove online child sexual abuse material from their services beyond 20 December 2020.

2.

To address this issue pending the adoption of a long-term legal framework addressing the prevention of and combating online child sexual abuse, the co-legislators adopted Regulation (EU) 2021/1232 (4) (‘the CSA Interim Regulation’), which started to apply on 3 August 2021 and provided for a temporary derogation from certain provisions of the ePrivacy Directive for certain providers as regards the use of technologies for the purpose of combating online child sexual abuse. The CSA Interim Regulation did not provide a legal ground for the processing of personal data for these activities but laid down additional safeguards to be respected by providers if they wish to rely on it.

3.

On 11 May 2022, the Commission proposed a Regulation of the European Parliament and of the Council laying down rules to prevent and combat child sexual abuse (‘the long-term legal framework’) (5) which aims to provide a long-term legal framework for preventing and combating child sexual abuse online. The interinstitutional negotiations on that proposal are still ongoing.

4.

In April 2024, the CSA Interim Regulation was amended by Regulation (EU) 2024/1307 (6), that extended the period of application to 3 April 2026, pending the conclusion of the negotiations on the long-term legal framework.

5.

On 19 December 2025, the Commission proposed a Regulation amending Regulation (EU) 2021/1232 as regards the extension of its period of application to extend the period of application of the CSA Interim Regulation by two years (‘the extension proposal’).

6.

The draft Regulation is based on Articles 16(2), in conjunction with Article 114(1) of the Treaty on the Functioning of the European Union (TFEU) (ordinary legislative procedure).

7.

The opinion of the European Economic and Social Committee was delivered on 21 January 2026.

8.

The Permanent Representatives Committee reached a mandate for negotiations with the European Parliament on 28 January 2026 (7), essentially accepting the Commission’s proposal to extend the period of application of the CSA Interim Regulation for a period of two years until 3 April 2028.

9.

In the European Parliament, the Committee on Civil Liberties, Justice and Home Affairs (LIBE) has the lead responsibility. Birgit Sippel (S&D, DE) was appointed rapporteur. On 11 March 2026, the plenary of the European Parliament approved a mandate for interinstitutional negotiations, which introduced amendments to the Commission’s proposal which significantly limited the scope of the derogation.

10.

Following interinstitutional negotiations in two trilogues (on 12 March 2026 and 16 March 2026), the co-legislators were not able to reach an agreement on the extension proposal.

11.

On 26 March 2026, the plenary of the European Parliament rejected the extension proposal at first reading (8). The CSA Interim Regulation therefore expired on 3 April 2026, with the consequence that, as of that date, providers can no longer rely on Regulation (EU) 2016/679 to continue carrying out voluntary measures to detect and report online child sexual abuse on their services and to remove online child sexual abuse material from their services.

12.

On 18 June 2026, the President of the European Parliament said in her address to the European Council that it was time to move on with the proposal for the CSA Interim Regulation and to look at how to find political agreement at second reading.

13.

On 25 June 2026, the European Parliament’s rapporteur of the file sent a letter to the Presidency of the Council emphasising the temporary nature of the derogation under the CSA Interim Regulation and urging the Council to direct the efforts toward the development of the long-term legal framework.

14.

On 26 June 2026, the Permanent Representatives Committee provided guidance to the Presidency and agreed to proceed with the adoption of a Council position at first reading as a matter of urgency.

15.

Following legal/linguistic revision, the Council adopted its position at first reading on 2 July 2026.

II.   REASONS FOR THE COUNCIL'S POSITION AT FIRST READING

16.

The Council regrets that it was not possible to reach political agreement with the European Parliament on the extension of the CSA Interim Regulation at first reading. However, given the importance of avoiding a prolonged legal gap in the fight against online child sexual abuse and the fact that the interinstitutional negotiations on the long-term legal framework are still ongoing, the Council decided to adopt a position at first reading under Article 294(5) TFEU and to communicate it to the European Parliament together with the present statement of reasons.

17.

Since the Commission proposal for a Regulation amending Regulation (EU) 2021/1232 as regards the extension of its period of application provided for an extension of a regulation that has expired and therefore cannot be extended anymore, the Council intends to adopt the entire text of the expired CSA Interim Regulation in its most recent version as a new self-standing Regulation, with adaptations of dates and deletions of irrelevant provisions under the title ‘Regulation of the European Parliament and the Council on a temporary derogation from certain provisions of Directive 2002/58/EC as regards the use of technologies by providers of number-independent interpersonal communications services for the processing of personal and other data for the purpose of combating online child sexual abuse.’

18.

Given the importance of effectively combatting child sexual abuse online and pending the adoption and application of the long-term legal framework, it is necessary to allow for a temporary derogation from Articles 5(1) and 6(1) of Directive 2002/58/EC in compliance with the conditions set out in this Regulation. Given the particular circumstances, the period of application of this Regulation should be limited until 3 April 2028 to allow for the necessary time for the long-term legal framework to be adopted and to enter into application.

19.

Considering the need to ensure, in a timely manner, legal certainty given the expiration of the CSA Interim Regulation, it is appropriate to provide that this Regulation should enter into force as soon as possible.

20.

The Council's position at first reading follows the main objective of the Commission’s extension proposal to continue effectively combatting child sexual abuse online pending the adoption and application of the long-term legal framework.

III.   CONCLUSION

21.

The Council’s position at first reading aims at the swift closing of the legal gap created by the expiry of the CSA Interim Regulation, by allowing for a temporary and conditional derogation from Directive 2002/58/EC of certain voluntary measures for the detection of online child sexual abuse. The Council’s position aims at ensuring that these voluntary measures that are taken for the protection of children online can continue until a long-term framework for such protection is implemented.

---

(1)  Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), OJ L 119, 4.5.2016, pp. 1–88.

(2)  Directive (EU) 2018/1972 of the European Parliament and of the Council of 11 December 2018 establishing the European Electronic Communications Code (Recast), OJ L 321, 17.12.2018, pp. 36–214.

(3)  Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications), OJ L 201, 31.7.2002, pp. 37–47.

(4)  Regulation (EU) 2021/1232 of the European Parliament and of the Council of 14 July 2021 on a temporary derogation from certain provisions of Directive 2002/58/EC as regards the use of technologies by providers of number-independent interpersonal communications services for the processing of personal and other data for the purpose of combating online child sexual abuse, OJ L 274, 30.7.2021, pp. 41–51.

(5)  9068/22.

(6)  Regulation (EU) 2024/1307 of the European Parliament and of the Council of 29 April 2024 amending Regulation (EU) 2021/1232 on a temporary derogation from certain provisions of Directive 2002/58/EC as regards the use of technologies by providers of number-independent interpersonal communications services for the processing of personal and other data for the purpose of combating online child sexual abuse, OJ L, 2024/1307, 14.5.2024.

(7)  5761/26.

(8)  7630/26.