Sittings · Document

Draft report (COM(2025)0797 – 2025/0429(COD)) 2026-02-10

Amending Regulation (EU) 2021/1232 as regards the extension of its period of application

Committee on Civil Liberties, Justice and Home Affairs

Official HTML ↗ PDF DOCX

AM_Com_LegReport

Amendment 19

Isabel Serra Sánchez

Proposal for a regulation

–

Proposal for rejection

The European Parliament rejects the Commission proposal.

Or. en

Amendment 20

Sibylle Berg, Martin Sonneborn

Proposal for a regulation

Title 1

Text proposed by the Commission

Amendment

Proposal for a REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL amending Regulation (EU) 2021/1232 as regards the extension of its period of application (Text with EEA relevance)

deleted

Or. en

Justification

Continuing voluntary scanning, which would be extended by this measure, is what the Council is calling for in the "long-term legal framework" currently being negotiated in trilogue. Parliament has voted almost unanimously against this and is calling for targeted scanning of suspects. Approval of this Regulation would weaken Parliament’s position in the trilogue. Furthermore, this regulation should not be extended in order to finally close the legal loophole that made mass surveillance of private communication possible by the suspension of existing rights.

Amendment 21

António Tânger Corrêa, Jorge Buxadé Villalba

Proposal for a regulation

Recital 1

Text proposed by the Commission

Amendment

(1) Regulation (EU) 2021/1232 of the European Parliament and of the Council2 provides for a temporary regime as regards of the use of technologies by certain providers of publicly available interpersonal communications services for the purpose of combating online child sexual abuse, pending the adoption of a long-term legal framework addressing the prevention of and combating online child sexual abuse (the ‘long-term legal framework’). That Regulation, as amended by Regulation (EU) 2024/1307, applies until 3 April 2026.

(1) Regulation (EU) 2021/1232 of the European Parliament and of the Council2 provides for a temporary and strictly limited regime as regards of the voluntary use of technologies by certain providers of publicly available interpersonal communications services for the purpose of combating online child sexual abuse, pending the adoption of a long-term legal framework addressing the prevention of and combating online child sexual abuse (the ‘long-term legal framework’). It does not entail an obligation of general detection, monitoring or filtering of communications. That Regulation, as amended by Regulation (EU) 2024/1307, applies until 3 April 2026.

_________________

2 Regulation (EU) 2021/1232 of the European Parliament and of the Council of 14 July 2021 on a temporary derogation from certain provisions of Directive 2002/58/EC as regards the use of technologies by providers of number-independent interpersonal communications services for the processing of personal and other data for the purpose of combating online child sexual abuse (OJ L 274, 30.7.2021, p. 41, ELI: http://data.europa.eu/eli/reg/2021/1232/oj).

Or. en

Amendment 22

António Tânger Corrêa, Jorge Buxadé Villalba

Proposal for a regulation

Recital 3

Text proposed by the Commission

Amendment

(3) It is important that child sexual abuse online can be combated effectively, in accordance with the applicable rules of Union law, including the conditions set out in Regulation (EU) 2021/1232, and without interruption, pending the adoption and application of the long-term legal framework.

(3) It is important that child sexual abuse online can be combated effectively, in full compliance with Union law and the Charter of Fundamental Rights, including the principles of necessity and proportionality, the confidentiality of communications and the protection of personal data, as well as the conditions set out in Regulation (EU) 2021/1232, pending the adoption and application of a long-term legal framework.

Or. en

Amendment 23

Markéta Gregorová

on behalf of the Verts/ALE Group

Proposal for a regulation

Recital 3

Text proposed by the Commission

Amendment

Or. en

Amendment 24

Georgiana Teodorescu

Proposal for a regulation

Recital 3 a (new)

Text proposed by the Commission

Amendment

(3a) The application of this Regulation should be strictly limited to technologies that do not weaken or bypass end-to-end encryption. Any measures taken under this derogation must respect the essence of the right to privacy and the confidentiality of communications as enshrined in the Charter of Fundamental Rights.

Or. en

Amendment 25

António Tânger Corrêa, Jorge Buxadé Villalba

Proposal for a regulation

Recital 3 a (new)

Text proposed by the Commission

Amendment

(3a) The derogation provided for in Regulation (EU) 2021/1232 is based on a voluntary regime. This extension does not create, and may not be interpreted as creating, additional obligations for providers, nor duties whose non-compliance could trigger sanctions, fines or liability for not deploying such technologies.

Or. en

Amendment 26

Sebastian Tynkkynen

Proposal for a regulation

Recital 3 a (new)

Text proposed by the Commission

Amendment

(3a) Protecting children is a vital part of Western society. In order to ensure internet security, it is however crucial that all measures to protect children are taken on the basis of technological solutions that do not unreasonably undermine the protection of privacy.

Or. fi

Amendment 27

António Tânger Corrêa, Jorge Buxadé Villalba

Proposal for a regulation

Recital 3 b (new)

Text proposed by the Commission

Amendment

(3b) The extension of the application period of Regulation (EU) 2021/1232 should not lead to the outsourcing of law-enforcement functions to private entities, nor turn providers into private watchdogs of a bureaucratic system. The investigation, prosecution and enforcement of criminal law remain the responsibility of the competent authorities.

Or. en

Amendment 28

António Tânger Corrêa, Jorge Buxadé Villalba

Proposal for a regulation

Recital 3 c (new)

Text proposed by the Commission

Amendment

(3c) The mere existence of voluntary detection measures by the providers does not relieve the co-legislators from ensuring that any temporary derogation fully respects the prohibition of general monitoring under Union law and the requirements of articles 7 and 8 of the Charter.

Or. en

Amendment 29

Markéta Gregorová

on behalf of the Verts/ALE Group

Proposal for a regulation

Recital 4

Text proposed by the Commission

Amendment

(4) The Commission has failed to deliver evidence of the effectiveness and the proportionality of the derogation in both of its implementation reports. The reports underline that the services are misused by a narrow minority of users that cannot, in itself, justify the indiscriminate processing of content data and related traffic data of communications of all users. The reports also fail to deliver evidence on the necessity and to prove the effectiveness of the derogation in detecting and removing new online child sexual abuse material or the solicitation of children. Therefore, new material and solicitation of children should be removed from the scope.

Or. en

Amendment 30

Irena Joveva, Nikola Minchev

Proposal for a regulation

Recital 4

Text proposed by the Commission

Amendment

(4) Given these circumstances, and to address the significant shortcoming in the data collection and reporting identified in the 2025 implementation report (COM(2025) 740 final), Regulation (EU) 2021/1232 should be amended, including to extend its period of application for a period of time until 3 January 2027. Such extension should be exceptional and limited to what is strictly necessary for the long-term legal framework to be adopted and start to apply.

Or. en

Amendment 31

António Tânger Corrêa, Jorge Buxadé Villalba

Proposal for a regulation

Recital 4

Text proposed by the Commission

Amendment

(4) Given these circumstances, Regulation (EU) 2021/1232 should be amended to extend its period of application for a period of time limited to that which is strictly necessary for a long-term legal framework to be adopted and start to apply, without expanding the material scope of the derogation, without introducing new obligations, and without altering the voluntary nature of any measures providers may choose to take.

Or. en

Amendment 32

Irena Joveva, Nikola Minchev

Proposal for a regulation

Recital 4 a (new)

Text proposed by the Commission

Amendment

(4a) The temporary regime provided in the Regulation (EU) 2021/1232 of the European Parliament and of the Council should be limited to well-established, least privacy-intrusive technologies that are operating on an adequate legal basis under Regulation (EU) 2016/679, and do not require the systematic decryption of communications or the creation of vulnerabilities in the end-to-end encryption. Detection should be limited to technologies that are content-oblivious or operate on a local level before encryption occurs. Such technologies deployed should not include systematic filtering or scanning of communications containing text, but only look into specific communications in case of concrete elements of suspicion. Furthermore, to ensure the state of the art in reliability, providers should not deploy any detection tools unless they can demonstrate that error rate of false positives for such tools does not exceed 0,1%.

Or. en

Amendment 33

Irena Joveva, Nikola Minchev

Proposal for a regulation

Recital 4 b (new)

Text proposed by the Commission

Amendment

(4b) Nothing is this Regulation should be interpreted as allowing or requiring the weakening of end-to-end encryption, while detection technologies should be designed to respect the integrity of such encryption without requiring the creation of backdoor. Any possible scanning should only concern videos and images in order to detect known child sexual abuse material.

Or. en

Amendment 34

Irena Joveva, Nikola Minchev

Proposal for a regulation

Recital 4 c (new)

Text proposed by the Commission

Amendment

(4c) Reports on the 1325% increase in generative AI produced child sexual material requires voluntary detection to be calibrated to distinguish artificial material and avoid diverting resources from victims in immediate danger. Such measures should prevent the revictimization of children through AI models, while ensuring that this technological development does not justify general monitoring, a relaxation of privacy standards, or the weakening of end-to-end encryption.

Or. en

Amendment 35

Markéta Gregorová

on behalf of the Verts/ALE Group

Proposal for a regulation

Recital 5

Text proposed by the Commission

Amendment

(5) Considering the need to ensure legal certainty in a timely manner, and considering the limited nature of the amendment provided for in this Regulation, namely the extension of its period of application, it is appropriate to provide that this Regulation should enter into force as soon as possible.

(5) Substantial changes should be made to the original framework laid down in Regulation (EU) 2021/1232. New limits and safeguards should be introduced. Processing should only be allowed by a judicial authority and only after a diligent and objective assessment leading to the finding of reasonable grounds of suspicion for a link, at least an indirect one, of the service concerned being misused by individual users, or a specific group of users, either as such or as subscribers to a specific channel of communication for child sexual abuse material. Reasonable grounds are those resulting from any information reliable and legally acquired that suggest that individual users, or a specific group of users, either as such or as subscribers to a specific channel of communication might have a link, even an indirect or remote one, with child sexual abuse material. A link with child sexual abuse material should be deemed to exist where on the basis of objective evidence there is a reasonable suspicion that such material will be detected in the use of a service by a user. Where a channel is operated specifically for the purpose of distributing child sexual abuse material, the subscribers to that channel should be considered linked to child sexual abuse material. Conduct which is legal according to Directive 2011/93/EU or national law transposing it should not be deemed a reasonable ground of suspicion. In order to conduct such an assessment, effective communication needs to be established between the Coordinating Authority and the provider.

Or. en

Amendment 36

António Tânger Corrêa, Jorge Buxadé Villalba

Proposal for a regulation

Recital 5

Text proposed by the Commission

Amendment

(5) Considering the need to ensure legal certainty in a timely manner, and considering the limited nature of the amendment provided for in this Regulation, it should not be interpreted as altering the enforcement architecture of Regulation (EU 2021/1232) or as conferring new enforcement powers vis-à-vis providers.

Or. en

Amendment 37

Markéta Gregorová

on behalf of the Verts/ALE Group

Proposal for a regulation

Recital 5 a (new)

Text proposed by the Commission

Amendment

(5a) The definition of child sexual abuse material provided in Article 2 of Regulation (EU) 2021/1232 has to be interpreted taking into account Directive 2011/93/EU. Therefore, personal communication between consenting peers as well as children over the age of sexual consent and their partners are out of the scope of the definition insofar as those images do not involve any abuse or exploitation or payment or remuneration for pornographic performance and the images have not been disseminated without the consent of the parties involved. Likewise, images produced for medical or scientific purposes, strictly verifiable as such, should remain out of the scope of the definition of child sexual abuse material.

Or. en

Amendment 38

Sebastian Tynkkynen

Proposal for a regulation

Recital 5 a (new)

Text proposed by the Commission

Amendment

(5a) The current approach, based on Regulation (EU) 2021/1232, whereby providers of certain number-independent interpersonal communications services use technology on a voluntary basis to detect online child sexual abuse on their services and report it to the authorities, is proportionate in terms of child protection and privacy protection. This approach should also be applied in a permanent legislative framework.

Or. fi

Amendment 39

António Tânger Corrêa, Jorge Buxadé Villalba

Proposal for a regulation

Recital 5 a (new)

Text proposed by the Commission

Amendment

(5a) Nothing in this Regulation should prohibit, weaken, undermine or circumvent end-to-end encryption, and providers shall not be prevented nor discouraged for offering end-to-end encrypted services.

Or. en

Amendment 40

Markéta Gregorová

on behalf of the Verts/ALE Group

Proposal for a regulation

Recital 5 b (new)

Text proposed by the Commission

Amendment

(5b) Furthermore, providers should duly take into account that technologies scanning text messages or metadata are no longer permitted. The scanning should only concern videos and images in order to detect known child sexual abuse material. Technologies used for such scanning should have an error rate of 1 in 50 billion and should implement the state of the art. They should build upon the existing technologies, notably the use of hashes of known online child sexual abuse.

Or. en

Amendment 41

António Tânger Corrêa, Jorge Buxadé Villalba

Proposal for a regulation

Recital 5 b (new)

Text proposed by the Commission

Amendment

(5b) Any statistical reporting related to the application of this temporary regime shall respect subsidiarity, avoid centralization, and should not require the collection or reporting of sensitive categories of data concerning children, including 'gender'; it should ensure that any publication or transmission of aggregated information follows a necessity and proportionality approach, and does not impose undue burdens and obligations to the Member States.

Or. en

Amendment 42

Markéta Gregorová

on behalf of the Verts/ALE Group

Proposal for a regulation

Recital 5 c (new)

Text proposed by the Commission

Amendment

(5c) Nothing in this Regulation should be interpreted as prohibiting, weakening or undermining end-to-end encryption. The derogation for the scanning should not apply to encrypted electronic communications services.

Or. en

Amendment 43

António Tânger Corrêa, Jorge Buxadé Villalba

Proposal for a regulation

Recital 7 a (new)

Text proposed by the Commission

Amendment

(7a) The Commission’s implementing reports of 19 December 2023 and 27 November 2025 (the “2023 and 2025 implementing reports”) do not provide conclusive evidence regarding the proportionality of this derogation, nor do they contain sufficiently detailed information on the different categories of CSAM detected or on whether the reported detections resulted from voluntary measures by service providers or from reports by helplines or users. This lack of clarity raises serious questions as to the necessity and added value of establishing a costly EU agency in the future, particularly given that the vast majority of detection activities by providers appear to rely primarily on obligations stemming from United States law.

Or. en

Amendment 44

Irena Joveva, Nikola Minchev

Proposal for a regulation

Article 1 – paragraph 1

Regulation (EU) 2021/1232

In Article 10, the second subparagraph is replaced by the following:

Text proposed by the Commission

Amendment

It shall apply until 3 April 2028.

It shall apply until 3 January 2027. By October 2026, the Commission shall submit an independent assessment specifically evaluating the impact of the technologies used on the security and integrity of end-to-end encrypted communications.

Or. en

Amendment 45

Javier Zarzalejos

Proposal for a regulation

Article 1 – paragraph 1

Regulation (EU) 2021/1232.

Article 10 – paragraph 2.

Text proposed by the Commission

Amendment

It shall apply until 3 April 2028.

It shall apply until 3 October 2027

("This amendment applies throughout the text. Adopting it will necessitate corresponding changes throughout.")

Or. en

Justification

Sufficient period of time to allow the interinstitutional negotiations of the long-term Regulation to conclude, legal-linguistic finalization, translation into all official languages, formal adoption, publication in the Official Journal, entry into force.

Amendment 46

Markéta Gregorová

on behalf of the Verts/ALE Group

Proposal for a regulation

Article 1 a (new)

Regulation (EU) 2021/1232

Article 3 – point 1 (a)

Text proposed by the Commission

Amendment

Article 1a

Article -1a

In Regulation (EU) 2021/1232, point 1(a) of Article 3 is replaced with the following:

(a) the processing is:

(i) strictly necessary for the use of specific technology for the sole purpose of detecting and removing known online child sexual abuse material and reporting it to law enforcement authorities and to organisations acting in the public interest against child sexual abuse;

(ii) proportionate and limited to technologies used by providers for the purpose set out in point (i);

(iii) limited to content data that are strictly necessary for the purpose set out in point (i);

(iv) limited to what is strictly necessary for the purpose set out in point (i);

(v) targeted, specified and limited to individual users, a specific group of users, either as such or as subscribers to a specific channel of communication, in respect of whom there are reasonable grounds of suspicion for a link, even an indirect one, with child sexual abuse material, and which have been identified by the competent judicial authority;

(vi) interpersonal communications to which end-to-end encryption is, has been or will be applied is not subject to the processing;

Or. en

Amendment 47

Irena Joveva, Nikola Minchev

Proposal for a regulation

Article 1 a (new)

Regulation (EU) 2021/1232

In Article 3, the following paragraph 1 a is added

Text proposed by the Commission

Amendment

Article 1a

In Article 3, the following paragraph 1a is added

(1a) “The technologies used shall not require systematic decryptions of communications or the creation of vulnerabilities in end-to-end encryption. Detections shall be limited to technologies that are content-oblivious or operate on a local level. These shall not include systematic text scanning and technologies used must maintain a documented accuracy rate of at least 99.9% to be considered sufficiently reliable.”

Or. en

Amendment 48

Markéta Gregorová

on behalf of the Verts/ALE Group

Proposal for a regulation

Article 1 b (new)

Regulation (EU) 2021/1232

Article 3 – point 1 (b)

Text proposed by the Commission

Amendment

Article 1b

Article -1b

In Regulation (EU) 2021/1232, point 1(b) of Article 3 is replaced with the following:

(b) the technologies used for the purpose set out in point (a)(i) of this paragraph are in accordance with the state of the art in the industry and are the least privacy-intrusive, including with regard to the principle of data protection by design and by default laid down in article 25 of Regulation (EU) 2016/679 and they are solely used to detect known images and videos constituting child sexual abuse material in communications without being able to deduce the substance of the content of the communications;

Or. en

Amendment 49

Markéta Gregorová

on behalf of the Verts/ALE Group

Proposal for a regulation

Article 1 c (new)

Regulation (EU) 2021/1232

Article 3 – point 1 (d)

Text proposed by the Commission

Amendment

Article 1c

Article -1c

In Regulation (EU) 2021/1232, point 1(d) of Article 3 is replaced with the following:

(d) with regard to new technology, meaning technology used for the purpose of detecting online child sexual abuse material that has not been used by any provider in relation to services provided to users of number-independent interpersonal communications services (‘users’) in the Union before 2 august 2021, the provider reports back to the competent authority on the measures taken to demonstrate compliance with written advice issued in accordance with article 36(2) of Regulation (EU) 2016/679 by the competent supervisory authority designated pursuant to Chapter VI, Section 1, of that Regulation (‘supervisory authority’) in the course of the prior consultation procedure;

Or. en

Amendment 50

Markéta Gregorová

on behalf of the Verts/ALE Group

Proposal for a regulation

Article 1 d (new)

Regulation (EU) 2021/1232

Article 3 – point 1 (f)

Text proposed by the Commission

Amendment

Article 1d

Article -1d

In Regulation (EU) 2021/1232, point 1(f) of Article 3 is deleted.

Or. en

Amendment 51

Markéta Gregorová

on behalf of the Verts/ALE Group

Proposal for a regulation

Article 1 e (new)

Regulation (EU) 2021/1232

Article 3 – point 1 (g) (iii)

Text proposed by the Commission

Amendment

Article 1e

Article -1e

In Regulation (EU) 2021/1232, point 1(g)(iii) of Article 3 is replaced with the following:

(iii) ensure that material not previously identified as online child sexual abuse material through other means than the use of the derogation is not reported to law enforcement authorities or organisations acting in the public interest against child sexual abuse without prior human confirmation;

Or. en

Amendment 52

Markéta Gregorová

on behalf of the Verts/ALE Group

Proposal for a regulation

Article 1 f (new)

Regulation (EU) 2021/1232

Article 3 – point 1 (g) (vii) (4)

Text proposed by the Commission

Amendment

Article 1f

Article -1f

In Regulation (EU) 2021/1232, point 1(g)(vii)(4) of Article 3 is replaced with the following:

(4) the number of known online child sexual abuse material identified;

Or. en

Amendment 53

Markéta Gregorová

on behalf of the Verts/ALE Group

Proposal for a regulation

Article 1 g (new)

Regulation (EU) 2021/1232

Article 9 – point 1

Text proposed by the Commission

Amendment

Article 1g

Article -1g

In Regulation (EU) 2021/1232, point 1 of Article 9 is replaced with the following:

1. On the basis of the reports submitted pursuant to article 3(1), point (g)(vii), and the statistics provided pursuant to article 8, the Commission shall, by 3 August 2023, and every 1 February for every year thereafter, prepare a report on the implementation of this Regulation and submit and present it to the European Parliament and to the Council.

Or. en