Skip to content
Adopted text

Temporary derogation from the ePrivacy directive

TA-10-2026-0266 · P10_TA(2026)0266 · PE790.735

Official HTML ↗ PDF DOCX
✦ In shortFull text
✦ In short · AI summary of this text, generated 4 Sept 2026

Written by a language model from the full text only; every figure comes from the text. The paragraph links open the paragraph a statement rests on — check the text itself before relying on it.

Parliament's amended version of a regulation temporarily derogating from the ePrivacy directive to let providers of number-independent interpersonal communications services process personal and other data to detect and report online child sexual abuse. The derogation applies only to non-end-to-end-encrypted communications, excludes audio scanning, and requires compliance with conditions such as least privacy-intrusive technologies, prior data protection impact assessments, human oversight, and reporting. Data must be stored no longer than 12 months, and providers must report annually to supervisory authorities and the Commission. The regulation applies until 3 April 2028.

Key points

  1. The regulation derogates from Article 5(1) and Article 6(1) of Directive 2002/58/EC to allow processing of personal and other data for detecting, reporting, and removing online child sexual abuse material and detecting solicitation of children.
  2. The derogation does not apply to scanning of audio communications or to communications with end-to-end encryption.
  3. Technologies used must be in accordance with the state of the art, least privacy-intrusive, and not able to deduce the substance of text content, only detect patterns pointing to possible abuse.
  4. Providers must conduct a prior data protection impact assessment and consultation, and for new technologies or solicitation detection, report back on compliance with written advice.
  5. Providers must ensure human oversight, not report material without prior human confirmation, and establish procedures for users to lodge complaints.
  6. Providers must inform users about the derogation, its impact, and avenues for redress, including lodging complaints with supervisory authorities and judicial remedies.
  7. Providers must publish and submit annual reports to supervisory authorities and the Commission, covering data types, volumes, errors, retention, and organisations shared with.
  8. Data must be stored securely and no longer than 12 months from identification of suspected abuse, and every reasoned suspicion must be reported without delay.
  9. Providers using technology before entry into force have up to eight months to complete prior consultations, provided they start within one month.
  10. The Commission must establish a standard form for reports, request European Data Protection Board guidelines, and publish a list of organisations acting in the public interest.
  11. Member States must annually report statistics on reports, identified children, and convicted perpetrators; the Commission must report on implementation after 18 months.
  12. Users have the right to an effective judicial remedy for infringements resulting from processing under this regulation.

Who is affected

  • Providers of number-independent interpersonal communications services (e.g., webmail, messaging) may use technologies to detect and report online child sexual abuse under conditions.
  • Users of such services may have their communications scanned (except encrypted or audio) and must be informed and given redress mechanisms.
  • Supervisory authorities monitor processing and receive reports; they may be consulted by providers.
  • Organisations acting in the public interest against child sexual abuse may receive reports and be listed publicly.
  • Law enforcement authorities receive reports of suspected abuse and may request data.

Figures and deadlines

  • Data stored no longer than 12 months from identification of suspected online child sexual abuse.
  • Reports due by six months after entry into force and by 31 January each year thereafter.
  • Regulation applies until 3 April 2028.
  • Transitional period of eight months for prior consultation, starting within one month of entry into force.
  • Commission to determine standard form within three months of entry into force.
  • Commission to request guidelines within one month of entry into force.
  • Member States to report statistics within one year of entry into force and annually thereafter.
  • Commission implementation report due within 18 months of entry into force.

Legal basis: Article 16(2) and Article 114(1) of the Treaty on the Functioning of the European Union