European Parliament adopts amendments on lapsed ePrivacy CSAM detection rules

The European Parliament has announced that it will vote on whether to reactivate an exemption to the ePrivacy Directive allowing internet service providers to voluntarily detect child sexual abuse material (CSAM) in private communications. The derogation expired on 3 April 2026 after the Parliament and Council failed to reach an agreement to extend it.

On 2 July, the Council adopted the original Commission proposal, triggering a second reading. Parliament now has three months to reject, amend, or adopt the position, with any amendments. If the urgent procedure is approved, a vote on the substance of the proposal will take place later in the week. 

Additional reporting by Politico.

On Thursday, 9 July, MEPs adopted amendments to the proposed ePrivacy derogation. The amendments exclude messages using end-to-end encryption from the scope of the law. The Council now has three months to reject or approve the amended directive. 

Training Announcement: The IAPP Certified Information Privacy Technologist (CIPT) is a privacy-focused IT professional certification from the IAPP that addresses data protection requirements and controls in complex technical environments. It explores the data lifecycle, privacy risk models and frameworks, the principles of Privacy by Design, and the role of privacy-enhancing technologies within the organisation. Find out more.