Regulation (EU) 2026/1881 of the European Parliament and of the Council of 24 July 2026 on a temporary derogation from certain provisions of Directive 2002/58/EC as regards the use of technologies by providers of number-independent interpersonal communications services for the processing of personal and other data for the purpose of combating online child sexual abuse (Text with EEA relevance)

Official Journal EN of the European Union L series 2026/1881 28.7.2026 REGULATION (EU) 2026/1881 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 24 July 2026 on a temporary derogation from certain provisions of Directive 2002/58/EC as regards the use of technologies by providers of number-independent interpersonal communications services for the processing of personal and other data for the purpose of combating online child sexual abuse (Text with EEA relevance) THE EUROPEAN PARLIAMENT AND THE COUNCIL OF THE EUROPEAN UNION, Having regard to the Treaty on the Functioning of the European Union, and in particular Article 16(2), in conjunction with Article 114(1) thereof, Having regard to the proposal from the European Commission, After transmission of the draft legislative act to the national parliaments, Having regard to the opinion of the European Economic and Social Committee(1), Acting in accordance with the ordinary legislative procedure(2),

Whereas:

(1) Directive 2002/58/EC of the European Parliament and of the Council(3) lays down rules ensuring the right to privacy and confidentiality with respect to the processing of personal data in exchanges of data in the electronic communication sector. That Directive particularises and complements Regulation (EU) 2016/679 of the European Parliament and of the Council(4).

(2) Directive 2002/58/EC applies to the processing of personal data in connection with the provision of publicly available electronic communication services. Until 21 December 2020, the definition of ‘electronic communication service’ set out in Article 2, point (c), of Directive 2002/21/EC of the European Parliament and of the Council(5) applied. On that date, Directive (EU) 2018/1972 of the European Parliament and of the Council(6)repealed Directive 2002/21/EC. The definition of ‘electronic communications service’ in Article 2, point (4), of Directive (EU) 2018/1972 includes number-independent interpersonal communications services as defined in Article 2, point (7), of that Directive. Number-independent interpersonal communications services, which include, for example, Voice over internet Protocol, messaging and web-based email services, were therefore brought within the scope of Directive 2002/58/EC on 21 December 2020.

(1) OJ C, C/2026/2546, 22.5.2026, ELI: http://data.europa.eu/eli/C/2026/2546/oj.

(2) Position of the European Parliament of 26 March 2026 (not yet published in the Official Journal) and position of the Council at first reading of 2 July 2026 (not yet published in the Official Journal). Position of the European Parliament of 9 July 2026 (not yet published in the Official Journal) and decision of the Council of 22 July 2026 (not yet published in the Official Journal).

(3) Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications) (OJ L 201, 31.7.2002, p. 37, ELI: http://data.europa.eu/eli/dir/2002/58/oj).

(4) Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119, 4.5.2016, p. 1, ELI: http://data.europa.eu/eli/reg/2016/679/oj).

(5) Directive 2002/21/EC of the European Parliament and of the Council of 7 March 2002 on a common regulatory framework for electronic communications networks and services (Framework Directive) (OJ L 108, 24.4.2002, p. 33, ELI: http://data.europa.eu/eli/ dir/2002/21/oj).

(6) Directive (EU) 2018/1972 of the European Parliament and of the Council of 11 December 2018 establishing the European Electronic Communications Code (OJ L 321, 17.12.2018, p. 36, ELI: http://data.europa.eu/eli/dir/2018/1972/oj).

ELI: http://data.europa.eu/eli/reg/2026/1881/oj 1/15EN OJ L, 28.7.2026

(3) In accordance with Article 6(1) of the Treaty on European Union (TEU), the Union recognises the rights, freedoms and principles set out in the Charter of Fundamental Rights of the European Union (the ‘Charter’). Article 7 of the Charter protects the fundamental right of everyone to respect for private and family life, home and communications, which includes the confidentiality of communications. Article 8 of the Charter contains the right to the protection of personal data.

(4) Article 3(1) of the 1989 United Nations Convention on the Rights of the Child (UNCRC) and Article 24(2) of the Charter provide that, in all actions relating to children, whether taken by public authorities or private institutions, the child’s best interests must be a primary consideration. Article 3(2) UNCRC and Article 24(1) of the Charter furthermore evoke the right of children to such protection and care as is necessary for their well-being.

(5) The protection of children, both offline and online, is one of the Union’s priorities. Sexual abuse and sexual exploitation of children constitute serious violations of human and fundamental rights, in particular of the rights of children to be protected from all forms of violence, abuse and neglect, maltreatment or exploitation, including sexual abuse, as provided for by the UNCRC and by the Charter. Digitalisation has brought about many benefits for society and the economy, but it has also brought about challenges, including an increase of online child sexual abuse. On 24 July 2020, the Commission adopted a communication entitled ‘EU strategy for a more effective fight against child sexual abuse’ (the ‘Strategy’). The Strategy aims to provide an effective response, at Union level, to the crime of child sexual abuse.

(6) In line with Directive 2011/93/EU of the European Parliament and of the Council(7), this Regulation does not govern Member States’ policies with regard to consensual sexual activities in which children may be involved and which can be regarded as the normal discovery of sexuality in the course of human development, taking into account the different cultural and legal traditions and of new forms of establishing and maintaining relations among children and adolescents, including through information and communication technologies.

(7) Some providers of certain number-independent interpersonal communications services (‘providers’), such as webmail and messaging services, use specific technologies on a voluntary basis to detect online child sexual abuse on their services and report it to law enforcement authorities and to organisations acting in the public interest against child sexual abuse, by scanning either the content, such as images and text, or the traffic data of communications using, in some instances, historical data. The technology used for those activities could be hashing technology for images and videos and classifiers and artificial intelligence for analysing text or traffic data. When using hashing technology, online child sexual abuse material is reported when a positive hit is returned, which means a match resulting from a comparison between an image or a video and a unique, non-reconvertible digital signature (‘hash’) from a database maintained by an organisation acting in the public interest against child sexual abuse that contains verified online child sexual abuse material. Those providers refer to national hotlines for reporting online child sexual abuse material and to organisations, located both within the Union and in third countries, whose purpose is to identify children, reduce child sexual exploitation and sexual abuse and prevent child victimisation. Such organisations might not fall within the scope of Regulation (EU) 2016/679. Collectively, such voluntary activities play a valuable role in enabling the identification and rescue of victims, whose fundamental rights to human dignity and to physical and mental integrity are severely violated. Such voluntary activities are also important in reducing the further dissemination of online child sexual abuse material and in contributing to the identification and investigation of offenders and to the prevention, detection, investigation and prosecution of child sexual abuse offences.

(7) Directive 2011/93/EU of the European Parliament and of the Council of 13 December 2011 on combating the sexual abuse and sexual exploitation of children and child pornography, and replacing Council Framework Decision 2004/68/JHA (OJ L 335,

17.12.2011, p. 1, ELI: http://data.europa.eu/eli/dir/2011/93/oj).

2/15 ELI: http://data.europa.eu/eli/reg/2026/1881/ojEN OJ L, 28.7.2026

(8) Notwithstanding their legitimate objective, voluntary activities by providers to detect online child sexual abuse on their services and report it constitute an interference with the fundamental rights to respect for private and family life and to the protection of personal data of all users of number-independent interpersonal communications services (‘users’). Any limitation to the exercise of the fundamental right to respect for private and family life, including the confidentiality of communications, cannot be justified merely on the grounds that providers were using certain technologies at a time when number-independent interpersonal communications services did not fall within the definition of ‘electronic communications services’. Such limitations are only possible under certain conditions.

Pursuant to Article 52(1) of the Charter, such limitations are to be provided for by law and are to respect the essence of the rights to private and family life and to the protection of personal data and, subject to the principle of proportionality, they are to be necessary and to genuinely meet objectives of general interest recognised by the Union or the need to protect the rights and freedoms of others. Where such limitations permanently involve a general and indiscriminate monitoring and analysis of the communications of all users, they interfere with the right to confidentiality of communications.

(9) Until 20 December 2020, the processing of personal data by providers by means of voluntary measures for the purpose of detecting online child sexual abuse on their services and reporting it and removing online child sexual abuse material from their services was governed solely by Regulation (EU) 2016/679. Directive (EU) 2018/1972, which was to be transposed by 20 December 2020, brought providers within the scope of Directive 2002/58/EC.

(10) Regulation (EU) 2021/1232 of the European Parliament and of the Council(8) provided for a temporary regime as regards of the use of technologies by providers of publicly available number-independent interpersonal communications services for the purpose of combating online child sexual abuse, pending the adoption of a long-term legal framework addressing the prevention of and combating online child sexual abuse (the ‘long-term legal framework’). Regulation (EU) 2021/1232 was amended by Regulation (EU) 2024/1307 of the European Parliament and of the Council(9), extending the period of application of that Regulation until 3 April 2026.

(11) The proposal for a Regulation of the European Parliament and of the Council laying down rules to prevent and combat child sexual abuse, which the Commission adopted on 11 May 2022, aims to provide the long-term legal framework. The interinstitutional negotiations on that proposal are still ongoing.

(12) On 19 December 2025 the Commission proposed to extend the period of application of Regulation (EU) 2021/1232, by two years until 3 April 2028. As the co-legislators were not able to reach an agreement on that proposal by 3 April 2026, Regulation (EU) 2021/1232 has expired.

(13) Given the importance of effectively combatting child sexual abuse online and pending the adoption and application of the long-term legal framework, it is necessary to allow for a temporary derogation from Article 5(1) and Article 6(1) of Directive 2002/58/EC in compliance with the conditions set out in this Regulation. Given the particular circumstances, the period of application of this Regulation should be limited to the time necessary to allow the long-term legal framework to be adopted and to be applied.

(8) Regulation (EU) 2021/1232 of the European Parliament and of the Council of 14 July 2021 on a temporary derogation from certain provisions of Directive 2002/58/EC as regards the use of technologies by providers of number-independent interpersonal communications services for the processing of personal and other data for the purpose of combating online child sexual abuse (OJ L 274, 30.7.2021, p. 41, ELI: http://data.europa.eu/eli/reg/2021/1232/oj).

(9) Regulation (EU) 2024/1307 of the European Parliament and of the Council of 29 April 2024 amending Regulation (EU) 2021/1232 on a temporary derogation from certain provisions of Directive 2002/58/EC as regards the use of technologies by providers of number-independent interpersonal communications services for the processing of personal and other data for the purpose of combating online child sexual abuse (OJ L, 2024/1307, 14.5.2024, ELI: http://data.europa.eu/eli/reg/2024/1307/oj).

ELI: http://data.europa.eu/eli/reg/2026/1881/oj 3/15EN OJ L, 28.7.2026

(14) Directive 2002/58/EC does not contain any specific provisions concerning the processing of personal data by providers in connection with the provision of electronic communication services for the purpose of detecting online child sexual abuse on their services and reporting it and removing online child sexual abuse material from their services. However, pursuant to Article 15(1) of Directive 2002/58/EC, Member States can adopt legislative measures to restrict the scope of the rights and obligations provided for in, inter alia, Articles 5 and 6 of that Directive, which concern the confidentiality of communications and traffic data, for the purposes of the prevention, detection, investigation and prosecution of criminal offences linked to child sexual abuse. In the absence of such national legislative measures and pending the adoption of a longer-term legal framework to tackle child sexual abuse at Union level, providers can no longer rely on Regulation (EU) 2016/679 to continue to use voluntary measures to detect online child sexual abuse on their services and report it and to remove online child sexual abuse material from their services beyond 21 December 2020. While this Regulation does not provide for a legal ground for the processing of personal data by providers for the sole purpose of detecting online child sexual abuse on their services and reporting it and removing online child sexual abuse material from their services, it provides for a derogation from certain provisions of Directive 2002/58/EC. This Regulation lays down additional safeguards which are to be respected by providers if they wish to rely on it.

(15) Processing of data for the purposes of this Regulation could entail the processing of special categories of personal data as set out in Regulation (EU) 2016/679. Processing of images and videos by specific technical means which allow for the unique identification or authentication of a natural person is considered processing of special categories of personal data.

(16) This Regulation provides for a temporary derogation from Article 5(1) and Article 6(1) of Directive 2002/58/EC, which protect the confidentiality of communications and traffic data. The voluntary use by providers of technologies for the processing of personal and other data to the extent necessary to detect online child sexual abuse on their services and report it and to remove online child sexual abuse material from their services falls within the scope of the derogation provided for by this Regulation provided that such use complies with the conditions set out in this Regulation and is therefore subject to the safeguards and conditions set out in Regulation (EU) 2016/679.

(17) Directive 2002/58/EC was adopted on the basis of Article 114 of the Treaty on the Functioning of the European Union (TFEU). Moreover, not all Member States have adopted legislative measures in accordance with Directive 2002/58/EC to restrict the scope of the rights and obligations related to the confidentiality of communications and traffic data as set out in that Directive, and the adoption of such measures involves a significant risk of fragmentation likely to negatively affect the internal market. Consequently, this Regulation should be based on Article 114 TFEU.

(18) Given that data related to electronic communications involving natural persons usually qualify as personal data, this Regulation should also be based on Article 16 TFEU, which provides a specific legal basis for the adoption of rules relating to the protection of individuals with regard to the processing of personal data by Union institutions, bodies, offices and agencies, and by the Member States when carrying out activities which fall within the scope of Union law, and rules relating to the free movement of such data.

(19) Regulation (EU) 2016/679 applies to the processing of personal data in connection with the provision of electronic communications services by providers for the sole purpose of detecting online child sexual abuse on their services and reporting it and removing online child sexual abuse material from their services to the extent that that processing falls within the scope of the derogation provided for by this Regulation.

4/15 ELI: http://data.europa.eu/eli/reg/2026/1881/ojEN OJ L, 28.7.2026

(20) The types of technologies used for the purposes of this Regulation should be the least privacy-intrusive in accordance with the state of the art in the industry. Those technologies should not be used to systematically filter and scan text in communications unless it is solely to detect patterns which point to possible concrete reasons for suspecting online child sexual abuse, and they should not be able to deduce the substance of the content of the communications. In the case of technology used for identifying solicitation of children, such concrete reasons for suspicion should be based on objectively identified risk factors such as age difference and the likely involvement of a child in the scanned communication.

(21) Appropriate procedures and redress mechanisms should be put in place to ensure that individuals can lodge complaints with providers. Such procedures and mechanisms are, in particular, relevant where content that does not constitute online child sexual abuse has been removed or reported to law enforcement authorities or to an organisation acting in the public interest against child sexual abuse.

(22) In order to ensure accuracy and reliability as much as possible, technology used for the purposes of this Regulation should, in accordance with the state of the art in the industry, limit the numbers and ratios of errors (false positives) to the maximum extent possible and should, where necessary, rectify without delay any such errors that might nonetheless occur.

(23) The content data and traffic data processed and the personal data generated when carrying out the activities covered by this Regulation, and the period during which the data are subsequently stored in the event of the identification of suspected online child sexual abuse, should remain limited to what is strictly necessary to carry out those activities.

Any data should be immediately and permanently deleted as soon as they are no longer strictly necessary for one of the purposes specified in this Regulation, including where no suspected online child sexual abuse is identified, and in any event no later than 12 months from the date of the detection of suspected online child sexual abuse. This should be without prejudice to the possibility to store relevant content data and traffic data in accordance with Directive 2002/58/EC. This Regulation does not affect the application of any legal obligation under Union or national law to preserve data that applies to providers.

(24) This Regulation does not prevent a provider that has reported online child sexual abuse to law enforcement authorities from requesting those authorities to acknowledge receipt of the report.

(25) In order to ensure transparency and accountability in respect of the activities undertaken pursuant to the derogation

provided for by this Regulation, providers should, by six months from the date of its entry into force, and by 31 January every year thereafter, publish and submit reports to the competent supervisory authority designated pursuant to Regulation (EU) 2016/679 (‘supervisory authority’) and to the Commission. Such reports should cover processing falling within the scope of this Regulation, including the type and volumes of data processed, the specific grounds relied on for the processing of personal data pursuant to Regulation (EU) 2016/679, the grounds relied on for transfers of personal data outside the Union pursuant to Chapter V of Regulation (EU) 2016/679, where applicable, the number of cases of online child sexual abuse identified, differentiating between online child sexual abuse material and solicitation of children, the number of cases in which a user has lodged a complaint with the internal redress mechanism or sought a judicial remedy and the outcome of such complaints and judicial proceedings, the numbers and ratios of errors (false positives) of the different technologies used, the measures applied to limit the error rate and the error rate achieved, the retention policy and the data protection safeguards applied pursuant to Regulation (EU) 2016/679, and the names of the organisations acting in the public interest against child sexual abuse with which data have been shared pursuant to this Regulation.

ELI: http://data.europa.eu/eli/reg/2026/1881/oj 5/15EN OJ L, 28.7.2026

(26) It is necessary to ensure reporting to the Commission both from the Member States and from providers of number-independent interpersonal communication services. It is also important to stress that the Commission should report on the implementation of this Regulation in a timely manner.

(27) In order to facilitate reporting by providers of number-independent interpersonal communications services, in particular to ensure that their reports are machine readable and easily accessible, a common reporting format for those reports should be established.

(28) In order to ensure uniform conditions for the implementation of Article 3(1), point (g)(vii), of this Regulation, implementing powers should be conferred on the Commission. Those powers should be exercised in accordance with Regulation (EU) No 182/2011 of the European Parliament and of the Council(10).

(29) In order to support the supervisory authorities with their tasks, the Commission should request the European Data Protection Board to issue guidelines on the compliance of processing falling within the scope of the derogation laid down in this Regulation with Regulation (EU) 2016/679. When the supervisory authorities assess whether an established or new technology to be used is in accordance with the state of the art in the industry, the least privacy-intrusive and operating on an adequate legal basis under Regulation (EU) 2016/679, those guidelines should, in particular, assist the supervisory authorities in providing advice in the framework of the prior consultation procedure set out in that Regulation.

(30) This Regulation restricts the right to protection of the confidentiality of communications and derogates from the decision taken under Directive (EU) 2018/1972 to subject number-independent interpersonal communications services to the same rules that apply to all other electronic communications services as regards privacy for the sole purpose of detecting online child sexual abuse on those services and reporting it to law enforcement authorities or to organisations acting in the public interest against child sexual abuse and removing online child sexual abuse material from those services.

(31) With regard to all other activities that fall within the scope of Directive 2002/58/EC, providers should be subject to the specific obligations set out in that Directive and, consequently, to the monitoring and investigative powers of the competent authorities designated pursuant to that Directive.

(32) End-to-end encryption is an important tool to guarantee the security and confidentiality of the communications of users, including those of children. Any weakening of encryption could potentially be abused by malicious third parties. Nothing in this Regulation should therefore be interpreted as prohibiting or weakening end-to-end encryption.

(33) The right to respect for private and family life, including the confidentiality of communications, is a fundamental right guaranteed under Article 7 of the Charter. It is thus also a prerequisite for secure communications between victims of child sexual abuse and a trusted adult or organisations active in the fight against child sexual abuse and for communications between victims and their lawyers.

(10) Regulation (EU) No 182/2011 of the European Parliament and of the Council of 16 February 2011 laying down the rules and general principles concerning mechanisms for control by Member States of the Commission’s exercise of implementing powers (OJ L 55, 28.2.2011, p. 13, ELI: http://data.europa.eu/eli/reg/2011/182/oj).

6/15 ELI: http://data.europa.eu/eli/reg/2026/1881/ojEN OJ L, 28.7.2026

(34) This Regulation should be without prejudice to the rules on professional secrecy under national law, such as rules on the protection of professional communications, between doctors and their patients, between journalists and their sources, or between lawyers and their clients, in particular since the confidentiality of communications between lawyers and their clients is key to ensuring the effective exercise of the rights of the defence as an essential part of the right to a fair trial. This Regulation should also be without prejudice to national rules on registers of public authorities or organisations which offer counselling to individuals in distress.

(35) Providers should communicate to the Commission the names of the organisations acting in the public interest against child sexual abuse to which they report potential online child sexual abuse under this Regulation. While it is the sole responsibility of the providers acting as controllers to assess with which third party they can share personal data under Regulation (EU) 2016/679, the Commission should ensure transparency regarding the transfer of potential cases of online child sexual abuse by making public on its website a list of the organisations acting in the public interest against child sexual abuse communicated to it. That public list should be easily accessible. It should also be possible for providers to use that list in order to identify relevant organisations in the global fight against online child sexual abuse. That list should be without prejudice to the obligations of the providers acting as controllers under Regulation (EU) 2016/679, including with regard to their obligation to conduct any transfer of personal data outside the Union, pursuant to Chapter V thereof, and their obligation to fulfil all of the obligations, pursuant to Chapter IV thereof.

(36) The statistics to be provided by Member States under this Regulation are important indicators for the evaluation of policy, including legislative measures. In addition, it is important to recognise the impact of secondary victimisation inherent in the sharing of images and videos of victims of child sexual abuse that might have been circulating for years and which is not fully reflected in such statistics.

(37) In line with the requirements laid down in Regulation (EU) 2016/679, in particular the requirement that Member States ensure that supervisory authorities are provided with the human, technical and financial resources necessary for the effective performance of their tasks and exercise of their powers, Member States should ensure that supervisory authorities have such sufficient resources for the effective performance of their tasks and exercise of their powers under this Regulation.

(38) Where a provider has conducted a data protection impact assessment and consulted the supervisory authorities with regard to a technology in accordance with Regulation (EU) 2016/679 prior to the entry into force of this Regulation, that provider should not be obliged under this Regulation to carry out an additional data protection impact assessment or consultation provided that the supervisory authorities have indicated that the processing of data by that technology would not result in a high risk to the rights and freedoms of natural persons or that measures have been taken by the controller to mitigate such a risk.

(39) Users should have the right to an effective judicial remedy where their rights have been infringed as a result of the processing of personal and other data for the purpose of detecting online child sexual abuse on number-independent interpersonal communications services and reporting it and removing online child sexual abuse material from those services, for instance where a user’s content or identity have been reported to an organisation acting in the public interest against child sexual abuse or to law enforcement authorities or where a user’s content has been removed or a user’s account has been blocked or a service offered to a user has been suspended.

(40) In line with Directive 2002/58/EC and the principle of data minimisation, the processing of personal and other data should be limited to content data and related traffic data, in as far as strictly necessary to achieve the purpose of this Regulation.

ELI: http://data.europa.eu/eli/reg/2026/1881/oj 7/15EN OJ L, 28.7.2026

(41) The derogation provided for by this Regulation should extend to the categories of data referred to in Article 5(1) and Article 6(1) of Directive 2002/58/EC, which are applicable to the processing of both personal and non-personal data processed in the context of the provision of a number-independent interpersonal communications service.

(42) The objective of this Regulation is to create a temporary derogation from certain provisions of Directive 2002/58/EC without creating fragmentation in the internal market. In addition, it is unlikely that all Member States could adopt national legislative measures in time. Since the objective of this Regulation cannot be sufficiently achieved by the Member States but can rather be better achieved at Union level, the Union may adopt measures, in accordance with the principle of subsidiarity as set out in Article 5 TEU. In accordance with the principle of proportionality as set out in that Article, this Regulation does not go beyond what is necessary in order to achieve that objective. It introduces a temporary and strictly limited derogation from the applicability of Article 5(1) and Article 6(1) of Directive 2002/58/EC, with a series of safeguards to ensure that it does not go beyond what is necessary for the achievement of the set objective.

(43) Considering the need to ensure, in a timely manner, legal certainty given the expiration of Regulation (EU) 2021/1232, this Regulation should enter into force as soon as possible.

(44) The European Data Protection Supervisor was consulted in accordance with Article 42(1) of Regulation (EU) 2018/1725 of the European Parliament and of the Council(11) and delivered its opinion on 16 February 2026,

HAVE ADOPTED THIS REGULATION:

Article 1 Subject matter and scope

1. This Regulation lays down temporary and strictly limited rules derogating from certain obligations laid down in Directive 2002/58/EC, with the sole objective of enabling providers of certain number-independent interpersonal communications services (‘providers’) to use, without prejudice to Regulation (EU) 2016/679, specific technologies for the processing of personal and other data to the extent strictly necessary to detect online child sexual abuse on their services and report it and to remove online child sexual abuse material from their services.

2. This Regulation does not apply to the scanning of audio communications.

3. This Regulation does not apply to interpersonal communications to which end-to-end encryption is, has been or will be applied.

(11) Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39,

ELI: http://data.europa.eu/eli/reg/2018/1725/oj).

8/15 ELI: http://data.europa.eu/eli/reg/2026/1881/ojEN OJ L, 28.7.2026 Article 2 Definitions For the purposes of this Regulation, the following definitions apply:

(1) ‘number-independent interpersonal communications service’ means a number-independent interpersonal communica- tions service as defined in Article 2, point (7), of Directive (EU) 2018/1972;

(2) ‘online child sexual abuse material’ means:

(a) child pornography as defined in Article 2, point (c), of Directive 2011/93/EU;

(b) pornographic performance as defined in Article 2, point (e), of Directive 2011/93/EU;

(3) ‘solicitation of children’ means any intentional conduct constituting a criminal offence under Article 6 of Directive 2011/93/EU;

(4) ‘online child sexual abuse’ means online child sexual abuse material and solicitation of children.

Article 3 Scope of the derogation

1. Article 5(1) and Article 6(1) of Directive 2002/58/EC shall not apply to the confidentiality of communications involving the processing by providers of personal and other data in connection with the provision of number-independent

interpersonal communications services provided that:

(a) the processing is:

(i) strictly necessary for the use of specific technology for the sole purpose of detecting and removing online child sexual abuse material and reporting it to law enforcement authorities and to organisations acting in the public interest against child sexual abuse and of detecting solicitation of children and reporting it to law enforcement authorities or organisations acting in the public interest against child sexual abuse;

(ii) not applied to interpersonal communications to which end-to-end encryption is, has been or will be applied;

(iii) proportionate and limited to technologies used by providers for the purposes set out in point (i);

(iv) limited to content data and related traffic data that are strictly necessary for the purposes set out in point (i);

(v) limited to what is strictly necessary for the purposes set out in point (i);

ELI: http://data.europa.eu/eli/reg/2026/1881/oj 9/15EN OJ L, 28.7.2026

(b) the technologies used for the purposes set out in point (a)(i) of this paragraph are in accordance with the state of the art in the industry and are the least privacy-intrusive, including with regard to the principle of data protection by design and by default laid down in Article 25 of Regulation (EU) 2016/679 and, to the extent that they are used to scan text in communications, they are not able to deduce the substance of the content of the communications but are solely able to detect patterns which point to possible online child sexual abuse;

(c) in respect of any specific technology used for the purposes set out in point (a)(i) of this paragraph, a prior data protection impact assessment as referred to in Article 35 of Regulation (EU) 2016/679 and a prior consultation procedure as referred to in Article 36 of that Regulation have been conducted;

(d) with regard to new technology, meaning technology used for the purpose of detecting online child sexual abuse material that has not been used by any provider in relation to services provided to users of number-independent interpersonal communications services (‘users’) in the Union before 31 July 2026, and with regard to technology used for the purpose of identifying possible solicitation of children, the provider reports back to the competent authority on the measures taken to demonstrate compliance with written advice issued in accordance with Article 36(2) of Regulation

(EU) 2016/679 by the competent supervisory authority designated pursuant to Chapter VI, Section 1, of that Regulation (‘supervisory authority’) in the course of the prior consultation procedure;

(e) the technologies used are sufficiently reliable in that they limit to the maximum extent possible the rate of errors regarding the detection of content representing online child sexual abuse and, where such occasional errors occur, their consequences are rectified without delay;

(f) the technologies used to detect patterns of possible solicitation of children are limited to the use of relevant key indicators and objectively identified risk factors such as age difference and the likely involvement of a child in the scanned communication, without prejudice to the right to human review;

(g) the providers:

(i) have established internal procedures to prevent abuse of, unauthorised access to, and unauthorised transfers of, personal and other data;

(ii) ensure human oversight of and, where necessary, human intervention in the processing of personal and other data using technologies falling under this Regulation;

(iii) ensure that material not previously identified as online child sexual abuse material, or solicitation of children, is not reported to law enforcement authorities or organisations acting in the public interest against child sexual abuse without prior human confirmation;

(iv) have established appropriate procedures and redress mechanisms to ensure that users can lodge complaints with them within a reasonable timeframe for the purpose of presenting their views;

10/15 ELI: http://data.europa.eu/eli/reg/2026/1881/ojEN OJ L, 28.7.2026

(v) inform users in a clear, prominent and comprehensible way of the fact that they have invoked, in accordance with this Regulation, the derogation from Article 5(1) and Article 6(1) of Directive 2002/58/EC concerning the confidentiality of users’ communications solely for the purposes set out in point (a)(i) of this paragraph, the logic behind the measures they have taken under the derogation and the impact on the confidentiality of users’ communications, including the possibility that personal data are shared with law enforcement authorities and organisations acting in the public interest against child sexual abuse;

(vi) inform users of the following, where their content has been removed or their account has been blocked or a service

offered to them has been suspended:

(1) the avenues for seeking redress from them;

(2) the possibility of lodging a complaint with a supervisory authority; and

(3) the right to a judicial remedy;

(vii) by 1 February 2027 and by 31 January every year thereafter, publish and submit to the competent supervisory authority and to the Commission a report on the processing of personal data under this Regulation, including on:

(1) the type and volumes of data processed;

(2) the specific ground relied on for the processing pursuant to Regulation (EU) 2016/679;

(3) the ground relied on for transfers of personal data outside the Union pursuant to Chapter V of Regulation (EU) 2016/679, where applicable;

(4) the number of cases of online child sexual abuse identified, differentiating between online child sexual abuse material and solicitation of children;

(5) the number of cases in which a user has lodged a complaint with the internal redress mechanism or with a judicial authority and the outcome of such complaints;

(6) the numbers and ratios of errors (false positives) of the different technologies used;

(7) the measures applied to limit the error rate and the error rate achieved;

(8) the retention policy and the data protection safeguards applied pursuant to Regulation (EU) 2016/679;

(9) the names of the organisations acting in the public interest against child sexual abuse with which data has been shared pursuant to this Regulation;

ELI: http://data.europa.eu/eli/reg/2026/1881/oj 11/15EN OJ L, 28.7.2026

(h) where suspected online child sexual abuse has been identified, the content data and related traffic data processed for the purposes set out in point (a)(i), and personal data generated through such processing are stored in a secure manner,

solely for the purposes of:

(i) reporting, without delay, the suspected online child sexual abuse to the competent law enforcement and judicial authorities or organisations acting in the public interest against child sexual abuse;

(ii) blocking the account of, or suspending or terminating the provision of the service to, the user concerned;

(iii) creating a unique, non-reconvertible digital signature (‘hash’) of data reliably identified as online child sexual abuse material;

(iv) enabling the user concerned to seek redress from the provider or pursue administrative review or judicial remedies on matters related to the suspected online child sexual abuse; or

(v) responding to requests issued by competent law enforcement and judicial authorities in accordance with the applicable law to provide them with the necessary data for the prevention, detection, investigation or prosecution of criminal offences as set out in Directive 2011/93/EU;

(i) the data are stored no longer than strictly necessary for the relevant purposes set out in point (h) and, in any event, no longer than 12 months from the date of the identification of the suspected online child sexual abuse;

(j) every case of a reasoned and verified suspicion of online child sexual abuse is reported without delay to the competent national law enforcement authorities or to organisations acting in the public interest against child sexual abuse.

2. Until 1 April 2027, the condition set out in paragraph 1, point (c), shall not apply to providers that:

(a) were using a specific technology before 31 July 2026 for the purposes set out in paragraph 1, point (a)(i), without having completed a prior consultation procedure in respect of that technology;

(b) start a prior consultation procedure before 1 September 2026; and

(c) duly cooperate with the competent supervisory authority in connection with the prior consultation procedure referred to in point (b).

3. Until 1 April 2027, the condition set out in paragraph 1, point (d), shall not apply to providers that:

(a) were using a technology as referred to in paragraph 1, point (d), before 31 July 2026 without having completed a prior consultation procedure in respect of that technology;

12/15 ELI: http://data.europa.eu/eli/reg/2026/1881/ojEN OJ L, 28.7.2026

(b) start a procedure as referred to in paragraph 1, point (d), before 1 September 2026; and

(c) duly cooperate with the competent supervisory authority in connection with the procedure referred to in paragraph 1, point (d).

The data included in the report referred to in paragraph 1, point (g)(vii), shall be provided in writing by means of a standard form. By 1 November 2026, the Commission shall determine the content and presentation of that form by means of implementing acts. In doing so, the Commission may divide the data categories listed in paragraph 1, point (g)(vii), into subcategories.

Those implementing acts shall be adopted in accordance with the advisory procedure referred to in Article 10(2).

Article 4 European Data Protection Board guidelines By 1 September 2026, and pursuant to Article 70 of Regulation (EU) 2016/679, the Commission shall request the European Data Protection Board to issue guidelines for the purpose of assisting the supervisory authorities in assessing whether processing falling within the scope of this Regulation, for existing and new technologies used for the purposes set out in Article 3(1), point (a)(i), of this Regulation, complies with Regulation (EU) 2016/679.

Article 5 Effective judicial remedies In accordance with Article 79 of Regulation (EU) 2016/679 and Article 15(2) of Directive 2002/58/EC, users shall have the right to an effective judicial remedy where they consider that their rights have been infringed as a result of the processing of personal and other data for the purposes set out in Article 3(1), point (a)(i), of this Regulation.

Article 6 Supervisory authorities The supervisory authorities designated pursuant to Chapter VI, Section 1, of Regulation (EU) 2016/679 shall monitor processing falling within the scope of this Regulation in accordance with their competences and powers under that Chapter.

Article 7 Public list of organisations acting in the public interest against child sexual abuse

1. By 1 September 2026, providers shall communicate to the Commission a list of the names of organisations acting in the public interest against child sexual abuse to which they report online child sexual abuse under this Regulation. Providers shall communicate any changes to that list to the Commission on a regular basis.

2. By 1 October 2026, the Commission shall make public a list of the names of organisations acting in the public interest against child sexual abuse communicated to it under the paragraph 1. The Commission shall keep that public list up to date.

ELI: http://data.europa.eu/eli/reg/2026/1881/oj 13/15EN OJ L, 28.7.2026 Article 8 Statistics

1. By 1 August 2027, and on an annual basis thereafter, the Member States shall make publicly available and submit to

the Commission reports with statistics on the following:

(a) the total number of reports of detected online child sexual abuse that have been submitted by providers and organisations acting in the public interest against child sexual abuse to the competent national law enforcement authorities, differentiating, where such information is available, between the absolute number of cases and those cases reported several times and the type of provider on whose service the online child sexual abuse was detected;

(b) the number of children identified through actions pursuant to Article 3, differentiated by gender;

(c) the number of perpetrators convicted.

2. The Commission shall aggregate the statistics referred to in paragraph 1 of this Article and shall take them into account when preparing the implementation report pursuant to Article 9.

Article 9 Implementation report

1. On the basis of the reports submitted pursuant to Article 3(1), point (g)(vii), and the statistics provided pursuant to Article 8, the Commission shall, by 1 February 2028, prepare a report on the implementation of this Regulation and submit and present it to the European Parliament and to the Council.

2. In the implementation report, the Commission shall consider, in particular:

(a) the conditions for the processing of personal data and other data set out in Article 3(1), point (a)(iii), and points (b), (c) and (d);

(b) the proportionality of the derogation provided for by this Regulation, including an assessment of the statistics submitted by the Member States pursuant to Article 8;

(c) developments in technological progress regarding the activities covered by this Regulation, and the extent to which such developments improve accuracy and reduce the numbers and ratios of errors (false positives).

Article 10 Committee procedure

1. The Commission shall be assisted by a committee. That committee shall be a Committee within the meaning of Regulation (EU) No 182/2011.

2. Where reference is made to this paragraph, Article 4 of Regulation (EU) No 182/2011 shall apply.

14/15 ELI: http://data.europa.eu/eli/reg/2026/1881/ojEN OJ L, 28.7.2026 Article 11 Entry into force and application This Regulation shall enter into force on the third day following that of its publication in the Official Journal of the European Union.

It shall apply until 3 April 2028.

This Regulation shall be binding in its entirety and directly applicable in all Member States.

Done at Brussels, 24 July 2026.

For the European Parliament For the Council The President The President R. METSOLA T. BYRNE

ELI: http://data.europa.eu/eli/reg/2026/1881/oj 15/15