EU Extends Voluntary Child‑Abuse Scan Rule to 2028, Exempting Encrypted Apps

EU member states have approved a temporary extension of the derogation from the e‑Privacy Directive that allows online platforms to voluntarily scan private communications for material depicting child sexual abuse. The measure, first introduced in 2021, is now valid until 3 April 2028. Scanning is limited to non‑encrypted content and must be followed by human verification before any report is made to authorities. End‑to‑end encrypted messaging services such as WhatsApp, Signal and Telegram are expressly excluded.

The extension restores legal certainty after the previous interim rule lapsed in April 2026 and is intended to bridge the gap while a permanent EU framework on child‑online safety is negotiated. Child‑protection groups have welcomed the continuation, whereas privacy advocates warn it could set a precedent for broader surveillance of private messages.