How the new EU law to tackle child sexual abuse will make a difference

The European Union (EU) is working on measures to prevent and combat child sexual abuse. On 3 August 2024, the EU law that allows service providers to continue voluntary detection, reporting and removal of online child sexual abuse material will expire.

At present, services are not always designed with child safety in mind, and many tech firms do not check for child sexual abuse material and do not report it when they find it. This is because the decision is left to each individual firm. To effectively address the misuse of online services for the purposes of child sexual abuse, clear rules are needed. Now, the EU intends to make prevention, detection, reporting and removal mandatory. This will help the police to find more evidence of child sexual abuse and ensure that it is removed quickly.

Who needs to carry out checks?

In short, any online provider will carry out checks to see if the risk of child sexual abuse on their systems is sufficiently high. With the proposed law, this process will follow strict legal steps.

If a high risk is detected, tech firms will first reduce the risk of harm through mitigation. To do this, they must submit a risk assessment for the coordinating authority (e.g. the national government) to check if the risk of child abuse is significant in their services. If the risk is sufficiently high, the coordinating authority will draft a request for a detection order, which requires the firm to prepare a plan to introduce measures that would detect child sexual abuse while respecting users’ privacy to the greatest extent possible.

Next, the tech firm will create a plan to implement the order, which requires them to conduct a data protection impact assessment. This must be reviewed by both the national Data Protection Authority and a competent authority. Finally, a judicial authority will decide on the detection order. The decision must take into account the necessity of the order (the level of risk of child sexual abuse on a given platform), and the effectiveness of safeguards to limit the invasiveness of the measures.

How is child sexual abuse detected?

Tech firms will carry out detection themselves using specialist technology, access to which could be facilitated by the EU Centre. The Centre will also have a role in assessing any future technology and ensuring that it is safe to use. The technology works in the same way a sniffer dog identifies drugs or explosives by recognising a particular smell. In this case, technology recognises particular ‘hashes’ and ‘AI indicators’ to identify instances of child sexual abuse.

How is it reported?

At present, the United States National Centre for Missing and Exploited Children (a private, non-profit organisation) receives and checks the reports. With the new law, there will be a new EU Centre to do this. When tech companies find abusive material, they will need to report it to the EU Centre. The EU Centre will check these reports and filter out any material that is not illegal, so that only confirmed reports reach police.

Who defines what must be taken down, and how quickly?

Currently, removing content can be a lengthy process and often depends on the willingness of individual tech firms. In the future, if such content is not removed voluntarily, a judicial authority will issue a removal order for the tech firm to remove illegal material within 24 hours.

What can I do?

The law is a crucial step towards further protecting children from the dangers of child sexual abuse. It will help protect children, support victims, and save lives. The mandatory requirement for tech firms to actively identify, report and remove content has already been welcomed by a range of children’s rights organisations. Stand with them – spread the word about how the new legislation will make a difference