EDPS Opinion 7/2026 on the Proposal for a Regulation extending the application of Regulation (EU) 2021/1232

Opinion 7/2026

on the Proposal for a Regulation extending the application of Regulation (EU) 2021/1232

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. The selection procedure for a new EDPS mandate for a term of five years is still ongoing.

Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to the Proposal for a Regulation of the European Parliament and of the Council amending Regulation (EU) 2021/1232 as regards the extension of its period of application . This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725.

This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

Executive Summary

On 19 December 2025, the European Commission issued the Proposal for a Regulation of the European Parliament and of the Council amending Regulation (EU) 2021/1232 as regards the extension of its period of application.

The objective of the Proposal is to ensure that child sexual abuse online can be effectively and lawfully combated on the basis of Regulation (EU) 2021/1232 (the Interim Regulation) without interruptions until a longer-term legal framework, to be created by the Proposal for a Regulation laying down rules to prevent and combat child sexual abuse, is agreed. The inter-institutional negotiations on the proposed long-term Regulation have not concluded and, despite the previous extension of the application period of the temporary regime by Regulation (EU) 2024/1307, it is uncertain that they will conclude in time for the long-term Regulation to enter into force and to apply before the Interim Regulation is set to expire. Against this background, the Proposal aims to further extend the period of application of the Interim Regulation until 3 April 2028.

The EDPS recognises that child sexual abuse is a particularly serious and heinous crime and that the objective of enabling effective action to combat it amounts to an objective of general interest recognised by the Union. The EDPS recalls his previous Opinions on the Interim Regulation as well as the EDPS-EDPB Joint Opinion on the matter and provides additional recommendations on how to ensure greater legal certainty, in particular on how to ensure lawfulness of processing within the meaning of Regulation 2016/679.

The EDPS considers that the Proposal presents the right time and opportunity for the co-legislators to address some of the key shortcomings of the Interim Regulation, namely the lack of a clear legal basis for the processing of personal data and the need of effective safeguards against general and indiscriminate scanning, in line with the principles of necessity and proportionality.

2

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 19 December 2025, the European Commission issued the Proposal for a Regulation of the European Parliament and of the Council amending Regulation (EU) 2021/1232 as regards the extension of its period of application (‘the Proposal’).

2. Regulation (EU) 2021/1232 (“Interim Regulation”) lays down temporary rules derogating from certain confidentiality obligations laid down in Directive 2002/58/EC (‘the ePrivacy Directive’), with the sole objective of enabling providers of certain number-independent interpersonal communications services to use specific technologies for the processing of personal and other data to the extent strictly necessary to detect online child sexual abuse on their services and report it and to remove online child sexual abuse material from their services .

3. As explained in its Recital 10, the Interim Regulation is intended to provide a temporary solution pending the adoption of a longer-term legal framework to tackle child sexual abuse at Union level. To this end, it contains a sunset clause in Article 10 providing for the end of its application by 3 August 2024. The period of application has already been extended once by Regulation (EU) 2024/1307 to 3 April 2026.

4. The objective of the Proposal is to ensure that child sexual abuse online can be effectively and lawfully combated without interruptions until a long-term regime, to be created by the Proposal for a Regulation laying down rules to prevent and combat child sexual abuse , is agreed . The inter-institutional negotiations on the proposed long-term Regulation have not concluded and, despite the extension of the application period of the temporary regime by Regulation (EU) 2024/1307, it is uncertain that they will conclude in time for the longterm Regulation to enter into force and to apply before the Interim Regulation is set to expire . Therefore, the Proposal aims to further extend the period of application of the Interim Regulation until 3 April 2028.

5. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 19 December 2025, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 6 of the Proposal.

2. General remarks

6. Child sexual abuse is a particularly serious and heinous crime and the objective of enabling effective action to combat it amounts to an objective of general interest recognised by the Union and seeks to protect the rights and freedoms of victims . At the same time, any limitations of the rights guaranteed by the Charter, such as the ones that are envisaged by the Interim Regulation, must comply with the requirements set out in Article 52(1) of the Charter.

7. The EDPS issued an Opinion on the Proposal for the Interim Regulation in November 2020 , in which the EDPS addressed, among many others, the need to clarify the legal basis for the processing within the meaning of the GDPR . He also expressed his concerns regarding the necessity and proportionality of the proposal, particularly as regards the failure to effectively safeguard against general and indiscriminate analysis of all text-based communications .

8. The EDPS further issued an Opinion on the Proposal for Regulation (EU) 2024/1307 (the first extension to the sunset clause) in January 2024 , in which he recalled the EDPS views expressed in his 2020 Opinion and addressed some aspects in greater detail than before .

9. The EDPS has also issued, together with the European Data Protection Board (EDPB), a Joint Opinion on the Proposal for a Regulation of the European Parliament and of the Council laying down rules to prevent and combat child sexual abuse .

10. On 23 October 2023, the EDPS organised a seminar dedicated to the ongoing legislative works on the Proposal for a Regulation , where different stakeholders expressed a wide range of concerns regarding the effectiveness and the risks of the proposed long-term Regulation.

11. On 22 November 2023, the European Parliament issued its Report on the proposed longterm Regulation .

12. In February 2024, the EDPB issued a Statement on legislative developments regarding the Proposal for a Regulation laying down rules to prevent and combat child sexual abuse

13. In November 2025, the Council adopted its general approach for the trilogue negotiations, which includes the deletion of the sunset clause of the Interim Regulation, thus making it permanent . The EDPS furthermore notes that the Council’s general approach does not envisage any substantial amendments to or strengthening of the safeguards in the Interim Regulation.

14. In light of the above, the EDPS considers it appropriate to address again two of the main shortcomings of the Interim Regulation that are particularly important from a data protection perspective, namely the lack of a clear legal basis for the processing of personal data and the need for effective safeguards against general and indiscriminate scanning, in line with the principles of necessity and proportionality.

3. Legal basis under the GDPR

15. In both his 2020 and 2024 Opinions, the EDPS recommended clarifying which legal basis of the GDPR would be applicable for the voluntary processing of content or traffic data by providers of publicly available interpersonal communications services for the purpose of detecting child sexual abuse online. The Interim Regulation does not contain such clarification , resulting in divergent legal practices among providers, as evidenced by the latest Commission report on the implementation of Regulation (EU) 2021/1232 .

16. The EDPS underlines that identifying an appropriate legal basis under the GDPR is not merely a formality, but an important guarantee to ensure the lawfulness of the processing of personal data. Legal certainty in this respect would benefit all parties involved in or otherwise affected by the voluntary scanning measures, including the victims, users and providers of interpersonal communications services.

17. The Commission implementation report reveals that in practice providers rely on at least three different legal grounds: Article 6(1)(d) GDPR ‘processing is necessary in order to protect the vital interests of the data subject or of another natural person’; Article 6(1)(e) GDPR ‘processing is necessary for the performance of a task carried out in the public interest [...]’; and Article 6(1)(f) GDPR ‘processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party [...]’ .

18. Regarding Article 6(1)(d) GDPR, the Court of Justice of the EU (CJEU) recently made it clear that it should be given a strict interpretation, especially in the context of the services provided by operators of online social networks, whose activities are essentially economic and commercial in nature, and that operators ‘cannot rely on the protection of an interest which is essential for the life of its users or of another person in order to justify, absolutely and in a purely abstract and preventive manner, the lawfulness of data processing’ .

19. In the same judgment, the CJEU found that the objective of collecting and sharing personal data with law enforcement authorities in order to prevent, detect and prosecute criminal offences, in principle is not an objective that is capable of constituting a legitimate interest, within the meaning of Article 6(1)(f) GDPR, for a private business operator whose activity is essentially economic and commercial in nature. Consequently, such an operator would generally be unable to rely on such a legitimate interest, which is unrelated to its economic and commercial activity .

20. The EDPS recalls that the legal basis for the processing cannot be found in Article 6(1)c GDPR (processing necessary for compliance with a legal obligation to which the controller is subject) as the Proposal concerns the voluntary processing of content or traffic data for the purpose of detecting child sexual abuse online and would not oblige providers of number-independent interpersonal communications services to carry out any processing .

21. In light of these considerations, the EDPS considers that the most suitable legal basis under the GDPR for the voluntary processing by private business operators of content or traffic data for the purpose of detecting of child sexual abuse online would be Article 6(1)(e) GDPR. As already explained in this Opinion, combatting child sexual abuse constitutes ‘an objective of general interest recognised by the Union’ and therefore the voluntary processing of content or traffic data by providers of publicly available interpersonal communications services for the purpose of detecting child sexual abuse online could potentially be qualified as necessary for the performance of a task carried out in the public interest. Nevertheless, in order to serve as a basis for the processing in application of Article 6(1)(e) of the GDPR, the Interim Regulation must satisfy the requirements of Article 6(3) GDPR and effectively bestow a task in the public interest. For example, the Interim Regulation could provide for a task to appropriately mitigate risks of child sexual abuse through their services, without, however, necessarily prescribing any specific measure to achieve this mitigation.

22. Therefore, to satisfy the requirements of legal certainty, the EDPS recommends the colegislator to amend the Proposal with the aim of providing a legal basis for processing of content or traffic data by providers of publicly available interpersonal communications services for the purpose of voluntary detection of child sexual abuse online, in line with Article 6(1)(e) GDPR. The EDPS also recommends adapting the text of the Interim Regulation and in particular Recital 10 thereof, accordingly .

4. Necessity and proportionality of voluntary detection measures

23. The EDPS reminds that, to satisfy the requirement of proportionality, the legislation must lay down clear and precise rules governing the scope and application of the measures in question and imposing minimum safeguards, so that the persons whose personal data is affected have sufficient guarantees that data will be effectively protected against the risk of abuse . That legislation must be legally binding and, in particular, must indicate in what circumstances and under which conditions a measure providing for the processing of such data may be adopted, thereby ensuring that the interference is limited to what is strictly necessary . As clarified by the CJEU, the need for such safeguards is all the greater where personal data is subjected to automated processing and where the protection of the particular category of personal data that is sensitive data is at stake.

24. One of the main concerns of the EDPS in his 2020 and 2024 Opinions was related to the necessity and proportionality of the voluntary detection measures. In fact, currently the providers, including those whose services are very extensively used by the European users, have a very broad discretion whether and how to monitor the traffic on their networks for CSAM, using a variety of detection technologies and processes. In this regard, the EDPS has already pointed out in the past that the Interim Regulation, while generally referring to strict necessity and proportionality, in reality does not provide for specific and effective safeguards against general and indiscriminate monitoring.

25. In his 2024 Opinion , the EDPS had provided examples how general and indiscriminate monitoring could be prevented, e.g. by requiring the providers to limit the deployment of detection technologies to a specific subset of communications, and by providing the criteria for selection of such subsets. These recommendations remain fully valid.

26. Additionally, the EDPS observed that the Interim Regulation refers to ‘content data and related traffic data’ in very general terms and does not specify which data categories may be processed for which purpose . This is of high practical relevance in the effort to prevent general and indiscriminate monitoring, as providers could be required to use less intrusive technologies, e.g. based on certain data categories of traffic data, to preselect data with a higher likelihood of containing incriminatory content data, before detection technologies are applied to process content data. Measures to further reduce the amount of monitored communications, is one of several potential safeguards against general and indiscriminate scanning, that have neither been explored nor explicitly mandated in the Interim Regulation. The EDPS recommends using this opportunity to provide for such safeguards.

27. The EDPS notes with serious concern that the Commission report on the implementation of the Interim Regulation from November 2025 admits that the available data are insufficient to provide a definitive answer to the question whether the Regulation achieves the balance sought between, on the one hand, achieving the general interest objective of effectively combating the extremely serious crimes at issue and the need to protect the fundamental rights of children, and, on the other hand, safeguarding the fundamental rights of the users of the services covered . Moreover, there is no information by the providers on whether the technologies were deployed in line with the state of the art and in the least privacy-intrusive way, or on whether a prior data protection impact assessment, as referred to in Article 35 GDPR, and a prior consultation procedure, as referred to in Article 36 GDPR, had been conducted .

28. The EDPS stresses the importance of the requirements of the Interim Regulation to be strictly observed by the providers. Any mere extension without steps and measures to ensure the effectiveness of existing and new safeguards remains highly problematic.

29. Should the co-legislators follow the path of the Council's general approach for a permanent Regulation regarding combatting the dissemination of CSAM online, including the removal of the sunset clause from the Interim Regulation, it would be of paramount importance that all necessary safeguards, including safeguards against prohibiting or weakening encryption, are provided for and fully implemented by providers. In this regard, the EDPS further recalls that client-side scanning contains a risk of substantial degradation of confidentiality and the need to ensure both legal and technical protection of information stored on the terminal equipment of end-users.

30. Finally, the EDPS remains of the opinion that the general, indiscriminate and automated analysis of all text-based communications transmitted through number-independent interpersonal communications services with a view of identifying solicitation of children (‘grooming’) does not respect the principle of necessity and proportionality. Even if the technology is limited to the use of ‘relevant key indicators’, the EDPS considers the deployment of such probabilistic analysis as excessive . He shares similar concerns also about the measures to identify unknown CSAM because of potential granting of access to content of communications on a generalised basis, their probabilistic nature and the error rates associated with such technologies .

5. Conclusions

31. In light of the above, the EDPS makes the following recommendations: (1) to amend the Interim Regulation so that it would provide for a legal basis for the processing of content or traffic data by providers of publicly available interpersonal communications services for the purpose of voluntary detection of child sexual abuse online, in line with Article 6(1)(e) and Article 6(3) GDPR, taking into account the requirements of Article 52 of the Charter of Fundamental Right of the European Union; (2) to provide for specific and effective safeguards, in particular against general and indiscriminate monitoring, taking into account the EDPS recommendations in his 2020 and 2024 Opinion on the Interim Regulation, as well as the EDPB-EDPS Joint Opinion on the Proposal for a Regulation of the European Parliament and of the Council laying down rules to prevent and combat child sexual abuse; (4) to take fully into account the concerns and the additional risk stemming from measures to detect CSAM in interpersonal communications, identified during the discussions on the Proposal for a long-term CSAM Regulation. Brussels, 16 February 2026 (e-signed) Wojciech Rafał WIEWIÓROWSKI 10