"Every year, millions of files are shared that depict the sexual abuse of children… This is completely unacceptable. Therefore, I'm glad that the member states have finally agreed on a way forward that includes a number of obligations for providers of communication services," said Danish Minister for Justice, Peter Hummelgaard.

The deal, which follows years of division and deadlock among member states and privacy groups, allows the legislative file to move into final talks with the European Parliament on when and how platforms can be required to scan user content for suspected child sexual abuse and grooming.

The existing CSAM framework is set to expire on April 3, 2026, and is on track to be replaced by the new legislation, pending detailed negotiations with European Parliament lawmakers.

EU Chat Control laws: What's in and what's out

The EU's efforts to make scanning of private messages compulsory suffered a setback earlier this month, when mandated client-side scanning was removed from the latest proposal draft. Wording was also added to ensure that providers were not unduly burdened with detection obligations:

"Nothing in this Regulation should be understood as imposing any detection obligations on providers."

In its latest draft, the EU Council keeps the core CSAM framework intact, but service providers would also have to cooperate with a newly established EU Centre on Child Sexual Abuse to support the implementation of the regulation.

While the latest EU Council text removes the explicit obligation of mandatory scanning of all private messages, the legal basis for "voluntary" CSAM detection is extended indefinitely.

A compromise that satisfies neither side

To end the Chat Control stalemate, a team of Danish negotiators in the Council had worked to remove the most contentious element: the blanket mandatory scanning requirement. Under previous provisions, end-to-end encrypted services like Signal and WhatsApp would have been required to systematically search users' messages for illegal material.