Skip to content
REPORT (COM(2022)0209 – C90174/2022 – 2022/0155(COD))

On the proposal for a regulation of the European Parliament and of the Council laying down rules to prevent and combat child sexual abuse

A-9-2023-0364

Committee on Civil Liberties, Justice and Home Affairs · Rapporteur: Javier Zarzalejos

Official HTML ↗ PDF DOCX
✦ In shortFull textProcedure & committee votes
✦ In short · AI summary of this text, generated 25 Sept 2026

Written by a language model from the full text only; every figure comes from the text. The paragraph links open the paragraph a statement rests on — check the text itself before relying on it.

Parliament's amended version of the Commission proposal for a regulation laying down rules to prevent and combat child sexual abuse. It sets risk assessment and mitigation duties for hosting, interpersonal communications, gaming and app store providers, and rules for detection, removal and blocking orders issued by judicial authorities. It creates an EU Centre for child protection to generate indicators, run databases, support victims and make detection technologies available, and it bans weakening end-to-end encryption and general monitoring. It gives victims rights to information, assistance and redress, requires penalties of up to 6% of worldwide turnover, and repeals Regulation (EU) 2021/1232 nine months after entry into force.

Committee position. The committee proposes to amend the Commission proposal by strengthening risk assessment and mitigation duties, making detection orders a judicial last resort that excludes end-to-end encrypted communications, creating an EU Centre for child protection with victim support structures, and adding safeguards for fundamental rights.

Key points

  1. Providers of hosting services and number-independent interpersonal communications services must assess the risk of their services being used for online child sexual abuse, with simplified assessment for small and micro enterprises.
  2. Providers must put in place reasonable, proportionate, targeted and effective mitigation measures, including safety by design, parental controls, flagging mechanisms and awareness raising.
  3. Providers of online games with in-game communications, platforms mainly used for pornography and services targeting children must take additional mitigation measures.
  4. Providers of software application stores considered as gatekeepers must indicate applications that do not permit use by children or have an age rating, and verify parental consent where required.
  5. Detection orders are a last resort, issued by a judicial authority, targeted at individual users or specific groups with reasonable grounds of suspicion, and must not apply to end-to-end encrypted communications.
  6. Detection orders for known or new child sexual abuse material last no more than 24 months; orders concerning solicitation of children are deleted from the amended text.
  7. Providers must execute detection orders using audited, state-of-the-art technologies that minimise error rates and protect privacy, with human oversight and redress mechanisms.
  8. Providers must report potential child sexual abuse to the EU Centre, remove or disable access, and inform users, with reporting mechanisms allowing anonymous notification.
  9. Removal orders must be executed within 24 hours, or up to 3 working days for micro and small enterprises, and blocking orders last up to five years and can be renewed.
  10. Victims have the right to information about reported material depicting them, to assistance from hosting providers and the EU Centre, and to support in a confidential, age-appropriate manner.
  11. An EU Centre for child protection is established with tasks including generating indicators, maintaining databases, conducting searches, making detection technologies available and supporting victims.
  12. Penalties for infringements must not exceed 6% of worldwide turnover, and periodic penalty payments must not exceed 5% of average daily worldwide turnover.

Who is affected

  • Providers of hosting services and number-independent interpersonal communications services: must assess risks, mitigate, report and execute orders.
  • Providers of online games with in-game communications and platforms mainly used for pornography: additional mitigation measures.
  • Providers of software application stores considered as gatekeepers: must indicate age restrictions and verify parental consent.
  • Victims of child sexual abuse: rights to information, assistance and support from authorities and the EU Centre.
  • Member States: must designate Coordinating Authorities with sufficient resources and provide penalties.

Figures and deadlines

  • Detection orders for known or new child sexual abuse material: maximum 24 months.
  • Removal orders: executed within 24 hours, or up to 3 working days for micro and small enterprises.
  • Blocking orders: maximum five years, renewable.
  • Penalties: maximum 6% of worldwide turnover.
  • Periodic penalty payments: maximum 5% of average daily worldwide turnover.
  • Regulation (EU) 2021/1232 repealed 9 months after entry into force.
  • Articles 7 to 18, 20 to 21 and Chapter IV apply 9 months after entry into force.

Legal basis: Article 294(2) and Article 114 of the Treaty on the Functioning of the European Union.