1. Regulatory focus
Regulation (EU) 2026/1881 creates a temporary derogation from the confidentiality rules in the ePrivacy Directive for certain number-independent interpersonal communications services. Providers may voluntarily detect, report, and remove online child sexual abuse material and detect child solicitation, but audio scanning is excluded and communications using, or scheduled to use, end-to-end encryption are outside scope. Processing must remain necessary, proportionate, and compliant with the GDPR.
2. Business impact
Content scanning can no longer be treated as an isolated trust-and-safety feature. Providers need an auditable legal basis, documented detection logic, human review and redress processes, and deletion controls. Within six months of entry into force and every 31 January thereafter, providers must report processing volumes, GDPR legal grounds, international transfers, identified cases, complaints and remedies, false-positive rates, retention periods, and safeguards to the competent supervisory authority and the Commission.
3. Operating recommendations
Create a communications-processing inventory segmented by product, EU market, encryption status, and data type, identifying which chats, attachments, or traffic data may enter a detection workflow. Track false-positive rates, correction times, escalation evidence, and retention separately for hash matching, text classifiers, and human review. Before enabling detection for EU users, prepare the reporting schema, transfer assessment, user complaint channel, and permanent deletion workflow for data that is no longer strictly necessary.