EUROPEAN COMMISSION Brussels, 11.5.2022 SWD(2022) 209 final COMMISSION STAFF WORKING DOCUMENT



IMPACT ASSESSMENT REPORT

Accompanying the document Proposal for a REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL laying down rules to prevent and combat child sexual abuse {COM(2022) 209 final} - {SEC(2022) 209 final} - {SWD(2022) 210 final}



Contents 1.Introduction: political and legal context4 2.Problem definition 2.1What is the problem?7 2.2What are the problem drivers?5 2.3How likely is the problem to persist?8 3.Why should the EU act?0 3.1Legal basis0 3.2Subsidiarity: necessity of EU action1 3.3Subsidiarity: added value of EU action1 4.Objectives: What is to be achieved?3 4.1General objective3 4.2Specific objectives3 5.What are the available policy options?4 5.1What is the baseline from which options are assessed?4 5.2Description of the policy options1 5.3Measures discarded at an early stage3 6.What are the impacts of the policy options? 6.1Qualitative assessment

6.2Quantitative assessment0 7.How do the options compare?4 7.1Qualitative comparison4 7.2Quantitative comparison1 8.Preferred option2 8.1Main advantages3 8.2Main disadvantages4 8.3Trade-Offs4 8.4Application of the ‘one in, one out’ approach5 9.How will actual impacts be monitored and evaluated?5 ANNEXES………………………………………………………………………………………118 Term/Acronym Definition AI Artificial Intelligence API Application Programming Interfaces Classifiers A form of artificial intelligence, an algorithm that sorts data into labelled classes or categories CSA Child Sexual Abuse CSA online CSA content refers to text-based exchanges, photos, videos and other material illegal under EU law (CSA Directive). In this document it refers to the three main types of abuse: known CSAM, new CSAM and grooming CSA Directive Directive 2011/93/EU of 13 December 2011 on combating the sexual abuse and sexual exploitation of children and child pornography CSAM Child Sexual Abuse Material, e.g. images and videos CSEA Child Sexual Exploitation and Abuse Darkweb Websites not indexed by conventional search engines, making use of masked IP addresses, which are only accessible with a special web browser DSA Digital Services Act Proposal for a Regulation on a Single Market for Digital Services and amending Directive 2000/31/EC, COM(2020) 825 final E2EE End-to-end Encryption EECC Directive 2018/1972/EU of 11 December 2018 establishing the European Electronic Communications Code E-evidence Electronic evidence: electronically stored data such as subscriber information, metadata or content data Encryption Process of changing electronic information or signals into a secret code or cipher Grooming Offenders building trust and a relationship with a child in an effort to gain access to the minor for sexual exploitation or abuse. Also known as solicitation Hash A unique digital code created by a mathematical algorithm (“hashing”) that becomes this file’s signature, or its hash value Hotline Child sexual abuse hotlines deal with questions about or reports of child sexual abuse. They can report content to law enforcement, take action for CSAM to be removed from the internet and act as interest groups IP address Internet Protocol address: a unique identifier allowing a device to send and receive packets of information; a basis for connecting to the Internet ISCO International Standard Classification of Occupations Malware Any type of software designed to disrupt the normal functioning of a computer, server, or computer network NCMEC National Centre for Missing and Exploited Children (US private, non-profit organisation) to which online service providers are required to report under US law instances of potential child sexual abuse that they find in their networks OTTs Over-the-Top communications services enable direct interpersonal and interactive exchange of information via electronic communications (i.e. the Internet), without connecting to the public telephone network P2P Peer-to-peer sharing describes networks in which each computer can act as a server, allowing files to be shared directly without the need for a central server PhotoDNA The most widely used tool based on hashing technology, available free of charge, based on a licensing agreement tailored to avoid abuse and use for any other purpose than the detection of CSA Safety-by-design The embedding of the rights and safety of users into the design and functionality of online products and services from the outset SDGs Sustainable Development Goals, a set of 17 interlinked goals established by the UN in 2015 as "a blueprint to achieve a better and more sustainable future for all people and the world by 2030" SMEs Enterprises that do not exceed a staff headcount of 250 people, a turnover of EUR 50M and an annual balance sheet total of EUR 43M Trusted flagger program A program under which an organisation designates certain persons or organisations whose reports of online CSA are trusted to meet sufficiently high standards, and may be treated differently, for example by being given higher priority for review URL Uniform Resource Locator, i.e. the address of an internet object (e.g. an image, a video, or an entire website) 1.Introduction: political and legal context Children face a number of risks in their daily lives, both online and offline, from which they cannot fully protect themselves. One of these risks is that of being sexually abused during childhood. The initiative assessed here aims to complement the existing EU framework by defining the responsibilities of certain online service providers to protect children against sexual abuse. In the absence of harmonised rules at EU level, providers of social media platforms, gaming services, and other hosting and online communications services find themselves faced with divergent rules across the internal market. The proliferation of rules is increasing, with recent legislative changes in the Netherlands and Germany, and at the same time there is evidence that current efforts at national level are insufficient to successfully address the underlying problem. Children have the fundamental right to such protection and care as is necessary for their well-being, and their best interests must be a primary consideration in all actions relating to them. Consequently, the fight against child sexual abuse (CSA) is a priority for the EU. In the July 2020 EU strategy for a more effective fight against child sexual abuse, the Commission set out eight concrete actions, implementing and developing the right legal framework and catalysing multi-stakeholder efforts in relation to prevention and investigation of these crimes and assistance to victims and survivors. The legislative proposal that this impact assessment accompanies responds to the commitment undertaken in the strategy to propose the necessary legislation to tackle child sexual abuse effectively, online and offline. In particular, this initiative: 1.sets out obligations to detect, report and remove child sexual abuse online to bring more clarity and certainty to the work of both law enforcement and relevant actors in the private sector to tackle online abuse; and 2.establishes an EU Centre to prevent and counter child sexual abuse to provide comprehensive support for the implementation of the proposed Regulation by service providers and to Member States, in the fight against child sexual abuse. The commitment and this initiative respond to the calls for action from the Council, the European Parliament, and the European Economic and Social Committee, and globally in multiple forums, including by online service providers and in the media, as it has become evident that current measures are falling short of effectively protecting the right of children to live free from sexual violence. This initiative is therefore expected, as the need to better prevent and combat child sexual abuse through additional legislation was already clear during the preparation of the 2020 strategy, and also during the inter-institutional negotiations of the Interim Regulation (see below).

The initiative aims to build on and complement the existing policy instruments in the fight against CSA, which can be grouped into legislation, coordination and funding. 1.Legislation The existing legal framework consists of measures in the areas of criminal law, protection of privacy and personal data, and the internal market, regulating online and telecommunications services and content moderation. It includes: ·horizontal instruments in the area of data protection and online privacy (e.g. GDPR and e-Privacy Directive and its proposed revision), and of the single market for digital services (e.g. e-Commerce Directive and the proposed Digital Services Act ), ·sector-specific legislation, such as the Child Sexual Abuse Directive , the Europol Regulation and its proposed revision, the Interim Regulation derogating from the application of certain rights and obligations under the ePrivacy Directive, and the Victims’ Rights Directive . Horizontal instruments The General Data Protection Regulation (GDPR) ·What it does: the GDPR sets out rules on the processing of personal data relating to individuals, specifying the fundamental right to protection of personal data. ·How CSA-related responsibilities are distributed between EU and Member States: as a horizontal instrument, the GDPR does not contain CSA-specific provisions, but it applies to all activities of processing personal data, including those related to CSA, except for those carried out by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, which are covered by Directive 2016/680/EU. Member States are notably responsible for enforcement through their data protection authorities, and the European Data Protection Board (EDPB) is tasked with the consistent application of the GDPR. ·How the proposed legislation builds on and interacts with the GDPR: the proposed legislation builds on the GDPR, including its Article 6 which allows, e.g., processing of personal data to comply with a legal obligation (Art. 6(1)(c)), or when processing is necessary for the purpose of legitimate interest (Art. 6(1)(f)). The ePrivacy Directive and its proposed revision ·What it does: the ePrivacy Directive and the proposed Regulation for its revision harmonise national rules to ensure an equivalent level of protection of fundamental rights and freedoms, and in particular the right to privacy and confidentiality of communications, with respect to the processing of personal data in electronic communications services. These ePrivacy rules particularise and complement the GDPR. ·How CSA-related responsibilities are distributed between EU and Member States: as horizontal instruments, the ePrivacy Directive and the proposed successor Regulation do not contain CSA-specific provisions; they apply to any processing of specified data categories in electronic communications. Member States are responsible for enforcement through their competent national authorities. ·How the proposed legislation builds on and interacts with the ePrivacy Directive and its proposed revision: the proposed legislation would limit the scope of certain rights and obligations which are currently in the ePrivacy Directive, notably those on the confidentiality of communications and related data in order to enable companies to identify child sexual abuse taking place on their systems after the issuance of a detection order, subject to strict safeguards. The eCommerce Directive ·What it does: the eCommerce Directive sets out a framework for the provision of information society services in the internal market. One of its key principles is a conditional liability exemption framework for providers of specific categories of information society services. In principle, providers may not be held liable for information (including illegal content) that they host (store), cache (temporarily store) or transmit during the provision of their services, subject to the conditions laid down in the Directive. For example, this means that providers of hosting services may not be held liable for information they host, unless they gain actual knowledge or awareness of the illegality and fail to act expeditiously. The Directive also prohibits Member States from imposing general obligations to monitor their services or to actively seek facts or circumstances indicating illegal activity. The eCommerce Directive does not establish a legal basis for any processing of personal data. ·How CSA-related responsibilities are distributed between EU and Member States: as a horizontal instrument, the eCommerce Directive does not contain CSA-specific provisions. It governs activities of relevant service providers. Member States are responsible for enforcement through their national authorities. ·How the proposed legislation builds on and interacts with the eCommerce Directive: the proposed legislation imposes narrowly targeted obligations to detect, report and remove child sexual abuse online, based on specific indicators and requirements to ensure compatibility with the eCommerce Directive (see box 9). The Digital Services Act proposal

·What it does: the Digital Services Act (DSA) proposal, if adopted as proposed, and building upon the eCommerce Directive’s framework, would provide a horizontal standard for content moderation by providers of intermediary services. It would remove a number of disincentives for providers’ voluntary efforts to detect, remove or disable access to illegal content (including child sexual abuse material, CSAM) and would create obligations for them to provide information on their content moderation efforts when requested by national authorities. The DSA would also create additional due diligence obligations tailored to specific categories of providers of intermediary services (e.g. hosting services, online platforms, very large online platforms) as well as transparency reporting obligations. For instance, it would require hosting services to put in place notice and action mechanisms enabling any user or entity to notify them of the presence of suspected illegal content. Furthermore, the DSA would oblige very large online platforms to implement risk mitigation measures on their services. The DSA would also establish rules on its implementation and enforcement, including as regards the cooperation of and coordination between the competent authorities. The DSA would not establish a legal basis for any processing of personal data. ·How CSA-related responsibilities are distributed between EU and Member States: as a horizontal instrument covering all types of illegal content, the DSA does not contain CSA-specific provisions. The DSA would create a framework at EU level for the notification of materials noticed by users to companies, with obligations for companies to respond to orders issued by public authorities in Member States, as well as additional due diligence requirements for very large platforms. For the very large platforms, a stronger role for the Commission in the enforcement process is also being considered during the ongoing inter-institutional negotiations at the time of writing. ·How the proposed legislation builds on and interacts with the DSA as proposed: the proposed legislation complements the DSA notably by specifying mandatory removal of CSAM when ordered and a comprehensive reporting obligation tailored to the specificities of CSA online, which often takes place hidden from public view and demands specific follow-up where identified. These specificities require a different approach from the horizontal one of the DSA. Finally, as the DSA aims to maintain some of the main principles of the eCommerce Directive, including the prohibition of general monitoring obligation and the unavailability of the liability exemption for hosting services if failing to act after obtaining actual knowledge or aware of the illegality of the content, the considerations above made for the eCommerce Directive also apply to the DSA. The Victims’ Rights Directive ·What it does: the Victims’ Rights Directive establishes minimum standards on the rights of, support for and protection of victims of crime and ensures that they are recognised and treated with respect. They must also be granted access to justice. ·How CSA-related responsibilities are distributed between the EU and Member States: as a horizontal instrument, the Victims’ Rights Directive, applicable to all victims of crime, does not contain CSA-specific provisions. The EU adopted specific rules for victims of child sexual abuse and sexual exploitation under the Child Sexual Abuse Directive (see below), to respond more directly to the specific needs of those victims. ·How the proposed legislation builds on and interacts with the Victims’ Rights Directive: whilst the proposed legislation focuses on strengthening the functioning of the internal market by setting common rules aimed at preventing and combating the misuse of online services for CSA-related purposes, it could also help support and facilitate the work of Member States on assistance to victims of CSA, notably through the creation of the EU Centre to prevent and counter CSA, which would facilitate research and the exchange of best practices among Member States. The proposed legislation does not create new obligations for Member States in this respect. Sector-specific legislation The Child Sexual Abuse Directive ·What it does: the Child Sexual Abuse (CSA) Directive’s main objective is to harmonise minimum criminal law rules at EU level concerning the definitions of child sexual abuse and exploitation offences and corresponding sanctions and to require the establishment of prevention measures in this area. It also requires Member States to ensure the provision of assistance and support to victims before, during and after the conclusion of criminal proceedings. In terms of websites disseminating CSAM, the Directive requires Member States to take necessary measures to ensure the prompt removal of webpages hosted in their territory and to endeavour to obtain the removal of such pages hosted outside their territory. It also enables Member States to take voluntary measures to block access to web pages containing or disseminating CSAM within their territory, while providing safeguards (restriction is limited to what is necessary and proportionate; users are informed of the reason for the restriction and of the possibility of judicial redress). The Child Sexual Abuse Directive does not establish a legal basis for any processing of personal data. ·How CSA-related responsibilities are distributed between EU and Member States: the Directive defines a minimum set of standards at EU level to define and sanction these crimes, prevent them and assist victims. Member States are required to comply with these minimum rules and may go beyond them if they consider it necessary. Similarly, the Directive defines the responsibilities of Member States but leaves to national authorities to comply with those responsibilities in the way that suits best the national specificities (e.g. on prevention programmes). ·How the proposed legislation builds on and interacts with the Child Sexual Abuse Directive: the former is intended to reinforce and complement the latter without creating unnecessary overlaps. Whereas the Directive focuses on defining the roles and responsibilities of Member States’ authorities in the fight against CSA using the tools of criminal law, the proposed legislation focuses, from an internal market angle, on defining the roles and responsibilities of private companies offering their services in the Single Market, notably concerning the detection, reporting and removal of CSA online. Nonetheless, the proposed legislation could help support and facilitate the efforts by Member States to meet the obligations defined in the CSA Directive relating to prevention and assistance to victims, notably through the creation of the EU Centre to prevent and combat CSA. The proposed initiative cannot address remaining implementation issues with the Directive. A study has been launched to prepare the evaluation of the CSA Directive and at the moment there are ongoing infringement procedures against 21 Member States. The majority of the challenges Member States face in the implementation concern offline prevention measures (in particular prevention programmes for offenders and for people who fear that they might offend) and criminal law definitions. Exchanges between the Commission and Member States are ongoing to ensure that they swiftly address these remaining issues. The Commission has also organised dedicated expert workshops with Member States to facilitate the exchange of lessons learned and of best practices in national experiences in the implementation of the CSA Directive. That said, the present legislative initiative could indirectly have a positive effect on the implementation of the Directive, in particular through the EU Centre as an expert hub and facilitator of exchanges of knowledge and best practices. The “Interim Regulation” ·What it does: voluntary detection of CSAM and grooming in certain online communication services like instant messenger and email has been made subject, as of 21 December 2020, to comply with the ePrivacy Directive’s rules on confidentiality of communications, due to changes in the definitions of the European Electronic Communications Code becoming effective and those services consequently fell under the ePrivacy Directive. To address this issue, the Commission proposed a temporary derogation from the application of certain rights and obligations under the ePrivacy Directive, for the sole purpose of detecting and reporting CSA and removing CSAM. The Interim Regulation, which entered into force on 2 August 2021, enables those services to continue such practices on a voluntary basis, provided those practices are lawful and, in particular, meet a range of conditions. The Regulation ceases to apply three years after its entry into force. The Interim Regulation does not establish a legal basis for any processing of personal data. ·How CSA-related responsibilities are distributed between EU and Member States: the Commission is responsible for making a list of names and organisations acting in the public interest against CSA to which providers report CSA online, for requesting the European Data Protection Board (EDPB) to issue guidelines for the purpose of assisting the supervisory authorities in assessing whether processing falling within the scope of the Regulation complies with the GDPR, and for preparing a report on the implementation of the Regulation. Member States are notably responsible for enforcing the Regulation and for statistics related to the detection, reporting and follow up of the CSA reports.

·How the proposed legislation builds on and interacts with the Interim Regulation: the proposed legislation replaces the Interim Regulation, and uses it as a reference to present a long-term framework that maintains some of its elements and covers a wider range of services, including private communications. The Europol Regulation and its proposed revision ·What it does: the Europol Regulation sets out the mandate of the European Union’s law enforcement agency, which is to support and strengthen action by competent authorities of the Member States and their mutual cooperation including in preventing and combating serious forms of crime, such as sexual abuse and sexual exploitation. Among other tasks, Europol’s current mandate allows the agency to collect, store, process, analyse and exchange information, including criminal intelligence; to notify the Member States of any information and connections between criminal offences concerning them and to coordinate, organise and implement investigative and operational actions to support and strengthen actions by the competent authorities of the Member States. The proposed revision of Europol’s mandate would notably allow it to receive data from private parties directly, subject to certain conditions. ·How CSA-related responsibilities are distributed between EU and Member States. Europol can support Member States' actions in preventing and combating CSA crimes. In particular, Europol receives reports from online service providers via the US National Centre for Missing and Exploited Children (NCMEC) for 19 Member States, completes these reports with its own information (if any) and forwards them to the Member States’ authorities. ·How the proposed legislation builds on and interacts with the Europol Regulation and its proposed revision. The proposed legislation creates an EU Centre to prevent and counter CSA, which will work closely with Europol. The Centre will receive the reports from online service providers, check that they are likely to be actionable, i.e. they are not manifestly unfounded and can thus in principle be acted upon, and forward them to Europol so that it can enrich the reports with additional criminal intelligence, as well as to national law enforcement agencies. This would ensure that Europol and national law enforcement resources are focused on key investigative tasks such as swiftly rescuing victims from ongoing abuse, rather than on e.g. filtering out the reports that are not relevant. The revised Europol mandate would complement the proposed legislation in particular on the ability for Europol to receive and process reports from the EU Centre originating from online service providers. 2.Coordination The existing legal framework is complemented by practical efforts at EU level to step up the fight against CSA in all areas: investigations, prevention, and assistance to victims. EU level cooperation in investigations ·What it does: Europol provides EU level coordination for investigation of cross-border cases. In addition, the EU policy cycle (EMPACT) serves to coordinate the operational priorities of Member States’ law enforcement authorities in the area of combating CSA, to organise joint operations and strategic approaches to specific phenomena from a law enforcement perspective. Europol also helps coordinate investigations involving law enforcement agencies in third countries and in the Member States. ·How CSA-related responsibilities are distributed between EU and Member States: Europol supports operational action by law enforcement agencies in Member States at their request. Europol does not have executive powers (i.e. it is not a “European FBI”). ·How the proposed legislation builds on and interacts with existing EU level cooperation in investigations: the proposed legislation aims to support the existing cooperation in investigations by ensuring that the reports from online service providers that reach Europol and national law enforcement agencies are actionable and relevant. The EU Centre would not have any operational capability on investigations, but would support them indirectly by facilitating the process of detection, reporting and removal of CSA online by service providers. EU level cooperation in prevention ·What it does: at the moment, EU level cooperation in prevention of CSA is fragmented and limited to ad hoc expert meetings organised by the Commission to support Member States in the implementation of the CSA Directive, initiatives on awareness raising under EMPACT and Europol. The 2020 CSA Strategy aimed to boost EU level efforts on prevention by making it one of its pillars. Specifically, the Strategy included the EU Centre to prevent and counter CSA, which will also carry out certain tasks relating to prevention. The Strategy also announced the launch of a prevention network of practitioners and researchers to support the EU Member States in putting in place usable, rigorously evaluated and effective prevention measures to decrease prevalence of child sexual abuse in the EU. The network will aim to give structure and regularity to exchanges of knowledge and best practices between Member States. ·How CSA-related responsibilities are distributed between EU and Member States. The CSA Directive requires Member States to implement provisions while leaving it to them to determine exactly what these measures or programmes are. The degree to which the requirements of the Directive are fulfilled vary among the Member States (see section 2.2.3.). ·How the proposed legislation builds on and interacts with existing EU level cooperation in prevention. The proposed legislation will establish the EU Centre, which will be the driving force of the work relating to preventing and combating CSA at EU level. Whilst the Centre would principally focus on its tasks set out in the envisaged legislation connected to the common rules for online service providers to combat CSA online, the Centre could also contribute to and facilitate Member States’ work relating to prevention, for instance through the involvement of multiple stakeholders and the sharing of best practices and lessons learned across Member States. The proposed legislation will not create new obligations for Member States on prevention. EU level cooperation in assistance to victims

·What it does: EU level cooperation in assistance to victims takes place currently through the Victims’ Rights Platform, which deals with horizontal issues relevant for victims’ rights. The platform brings together representatives of EU level networks, agencies, bodies and civil society organisations relevant for the implementation of the EU Strategy on victims’ rights. ·How CSA-related responsibilities are distributed between EU and Member States: the platform facilitates the implementation of the EU strategy on victims’ rights, which details key actions for the European Commission and for Member States. Also, the CSA Directive requires Member States to implement provisions related to assistance to victims, while leaving it to them to determine exactly what these measures are. The degree to which the requirements of the Directive are fulfilled varies among the Member States (see section 2.2.3.). ·How the proposed legislation builds on and interacts with existing EU level cooperation in assistance to victims: apart from its main tasks in the process of combating CSA online, the EU Centre could also facilitate and support Member States action in assistance to victims of CSA, specifically by serving as a hub of expertise to support evidence-based policy development, help develop research on assistance to victims, including victims’ needs and the effectiveness of short-term and long-term assistance programmes. The Centre will also support victims, at their request, in having their images and videos taken down by assisting them in exchanges with the relevant online service providers. The EU Centre could participate in the Victims’ Rights Platform to contribute to the discussion of horizontal issues concerning victims and to the implementation of the EU strategy on victims’ rights. The proposed legislation will not create new obligations for Member States on assistance to victims. Multi-stakeholder cooperation at EU and global level ·What it does: at EU level, the Commission facilitates multi-stakeholder cooperation between service providers and national authorities in the fight against CSA online through the EU Internet Forum, which brings together online service providers and ministers of interior of all Member States. At global level, the Commission continues to contribute to increasing voluntary standards for the protection of children against sexual abuse by promoting multi-stakeholder cooperation, through the WeProtect Global Alliance to End Child Sexual Exploitation Online (WPGA) . ·How CSA-related responsibilities are distributed between EU and Member States: at EU level, the Commission organises the EU Internet Forum, in which Member States participate at ministerial level (once a year), and at various levels in the technical discussions. Depending on the initiative, Member States and/or the Commission may be responsible for the execution. At global level, the Commission participates in the policy board of the WPGA, as one of its founding members. Member States are WPGA members and notably participate in its biannual global summit (the next one will take place in Brussels in June 2022 and will be co-hosted by the Commission and the French Presidency of the Council of the EU). ·How the proposed legislation builds on and interacts with existing multi-stakeholder cooperation at EU and global level: the proposed legislation builds on the experience of the EU Internet Forum and the WPGA and aims to boost multi-stakeholder cooperation in the EU and globally in the fight against CSA, through the EU Centre. The Centre will be an independent facilitator that will bring together all the relevant actors in the EU and beyond in any aspect of the fight against CSA, including investigations, prevention and assistance to victims, to ultimately facilitate and support Member States’ action in those areas. The Centre will have a more operational focus than the EU Internet Forum and the WPGA, which are centred on policy and are not designed to play a role in facilitating day-to-day efforts on the ground. 3.Funding ·What it does: the 2020 strategy includes a commitment to continue providing funding for fighting child sexual abuse, e.g. to support the development of national capacities to keep up with technological developments. The Commission has organised regular calls for project proposals to fight the online and offline aspects of child sexual abuse, with a total value of 61 million euro in the last 10 years (funded under Horizon2020 and Internal Security Fund). Notable examples of EU-funded projects include: oThe INHOPE network of hotlines, where users can report child sexual abuse materials they encounter online (formerly funded through the Connecting Europe Facility programme, and currently under the DIGITAL Europe programme). The content is analysed, and if assessed as illegal, hotlines notify the relevant online service providers requesting the swift removal of the content, and report the case to the relevant law enforcement agency for victim identification purposes. National hotlines are an important element of implementation of Article 25 of the CSA Directive, as a majority of Member States has chosen to implement most of this article through the hotlines. As of January 2022, the INHOPE network consists of 46 hotlines in 42 countries (including all Member States except Slovakia); oThe International Child Sexual Exploitation (ICSE) database at Interpol, which is an important tool enabling law enforcement to identify victims globally. The database has helped identify 23,564 victims worldwide at the time of writing. The Commission has also financially supported the adoption of the Barnahus model of child-friendly, multidisciplinary protection of child victims during criminal proceedings, which includes limiting the number of interviews of child victims and conducting them by trained experts, as a standard in the EU. ·How CSA-related responsibilities are distributed between EU and Member States: the Commission manages the funding instruments mentioned above. That said, part of the Internal Security Fund is managed by Member States under the supervision of the Commission, and Member States also contribute own funding to the efforts, to a varying extent. ·How the proposed legislation builds on and interacts with existing funding mechanisms: the creation of the EU Centre requires dedicated EU funding, and no changes will be made to existing funding mechanisms. However, increased coordination and cooperation in prevention efforts facilitated by the EU Centre may also result in more targeted and higher-quality proposals during future funding rounds.

Relevant Sustainable Development Goals (SDGs) The most relevant SDGs for this initiative are 5.2., eliminate all forms of violence against women and girls, and 16.2., end abuse, exploitation, trafficking and all forms of violence against children. Other SDGs of particular relevance are those that address risk factors of CSA, such as SDG 1 on poverty (e.g. children forced by their parents to be sexually abused online), SDG 3 on health (e.g. given the short and long-term negative health consequences of CSA on children), SDG 4 on education (e.g. prevention campaigns to raise awareness of CSA online risks), and SDG 9 on industry, innovation and infrastructure (e.g. as the initiative aims to support service providers efforts to fight against CSA online, including through the EU Centre). 2.Problem definition Table 1 shows the intervention logic (problem, drivers, objectives and options) that will be described and analysed in the impact assessment: Table 1: problem, problem drivers, objectives and options (intervention logic) Problem Problem drivers General objective Specific objectives Options Non-legislative Legislative A B C D E Some child sexual abuse crimes are not adequately addressed in the EU due to challenges in their detection, reporting and action by relevant services providers, as well as insufficient prevention and assistance to victims. Diverging national responses negatively affect the Internal Market 1.Voluntary action by online service providers to detect online child sexual abuse has proven insufficient 2.Inefficiencies in public-private cooperation between online service providers, civil society organisations and public authorities hamper an effective fight against child sexual abuse 3.Member States’ efforts to prevent child sexual abuse and to assist victims are limited, divergent and lack coordination and are of unclear effectiveness Improve the functioning of the Internal Market by introducing clear, uniform and balanced EU rules to prevent and combat child sexual abuse 1.Ensure the effective detection, removal and reporting of online child sexual abuse where they are currently missing 2.Improve legal certainty, transparency and accountability and ensure protection of fundamental rights 3.Reduce the proliferation and effects of child sexual abuse through harmonisation of rules and increased coordination of efforts Practical measures to enhance prevention, detection, reporting and removal, and assistance to victims, and establishing an EU Centre on prevention and assistance to victims Option A + legislation 1)specifying the conditions for voluntary detection, 2)requiring mandatory reporting and removal of online child sexual abuse, 3)expanding the EU Centre to also support detection, reporting and removal Option B + mandatory detection of known child sexual abuse material Option C + mandatory detection of new child sexual abuse material Option D + mandatory detection of ‘grooming’ (solicitation of children) 2.1. What is the problem? 2.1.1. Definition and magnitude The problem that this initiative tackles is that providers of certain online services offered in the EU face divergent rules at national level when it comes to their responsibility for preventing and combating child sexual abuse on their services. At the same time, the existing responses at national level to some child sexual abuse crimes are proving insufficient. Challenges persist in detection, reporting and action by relevant service providers, as well as insufficient prevention, assistance to victims and cooperation. The divergence of national responses to the problem creates legal fragmentation which negatively affects the Internal Market. Prevalence At least one in five children falls victim to sexual violence during childhood. A global study of childhood experiences in 2021 found that than one in three respondents (34%) had been asked to do something sexually explicit online during their childhood, and more than half (54%) had experience a form of child sexual abuse online. A recent survey in Spain concluded that two out five Spanish adults suffered sexual abuse when they were children. The majority of victims are girls, who are more than twice as likely to be abused than boys. Vulnerable children are more likely to fall victims of CSA online. In a recent survey about childhood experiences: ·59% of respondents who identified as transgender and non-binary experienced online sexual harm, compared to 47% of cisgender respondents; ·65% of respondents who identified as LGBQ+ experienced online sexual harm, compared to 46% non-LGBQ+ people; ·57% of disabled respondents experienced online sexual harm, compared to 48% of non-disabled respondents. “Offline” and online CSA The sexual abuse of children can take multiple forms, both offline (e.g. engaging in sexual activities with a child or exploiting a child for prostitution) and online (e.g. forcing a child to engage in sexual activities via live streaming, or viewing or distributing online child sexual abuse images and videos). The offline and online aspects of the crimes have become increasingly intertwined, and most CSA cases today contain an online component. For example, an offender may abuse a child offline, record the abuse, and share it online. Or the offender may establish a first contact with children online and then lure them to meet offline and sexually abuse them. It is therefore not possible to separate categorically between online and offline.

That said, this initiative focuses on the online aspects of the crime with relation to detection, reporting and removal efforts, in particular by the providers of the services used. This is because the internet has become the main medium for sharing CSAM, as well as for contacting children with the aim of abusing them. The internet facilitates the creation of communities in which offenders share materials and experiences. The volume of CSAM shared online has grown exponentially in the last years, while sharing of such material offline, e.g. via mail services, remains at a very low level and was not signalled as a common issue encountered by law enforcement in CSA investigations during stakeholder consultations. The Member States have sought to address this growing phenomenon through rules at the national level, reinforcing existing legislation or adopting new rules to improve the detection and follow-up on online child sexual abuse. This has inadvertently created a fragmentation of the internal market which negatively impacts the provision of certain online services, while at the same time failing to stem the proliferation of this particularly harmful content. Therefore, this initiative addresses the detection, reporting and removal in the online sphere, which enables and fuels offline and online abuse, as well as on prevention and assistance to victims, where the online and offline aspects are also closely related. Interlinkages between detection, reporting and action, prevention, and assistance to victims In addition to the online-offline interlinkages, all the different areas of the problem are also closely related: detection, reporting and action (i.e. follow up to the reports, including removal by service providers and action by law enforcement), prevention, and assistance to victims. In general, for public authorities to be able to act and assist the victim, the crime has to be detected and reported, which in turn may prevent future crimes from happening (e.g. if the offender is arrested and the victim is rescued). This also applies to detecting grooming and to stopping the circulation of CSAM (known and new), which are both criminal behaviours. In addition, the continued circulation of CSAM has a particularly harmful societal impact: the distribution of CSAM is a form of re-victimisation that occurs every time the images and videos are seen. The knowledge that the images and videos are being distributed is a continuous source of distress for victims. In addition, viewing of CSAM can lead to hands-on abuse as it supports potential offenders in normalising and rationalising their behaviour; recent surveys even indicate that this may often be the case . When CSAM is detected by service providers and investigated by law enforcement, it frequently leads to stopping ongoing or future abuse of child victims by the offenders caught distributing CSAM and/or grooming the child (see box 1 below). Box 1: importance of detection, reporting and action in prevention and assistance to victims The distribution of CSAM is closely linked to its production, and therefore physical sexual abuse of children. The detection and reporting of CSAM is therefore a key prevention tool and an important way to assist victims by also preventing re-victimisation. The detection of CSA online frequently leads to stopping ongoing or future physical sexual abuse. This is clearly the case for new CSAM and grooming, which often reveals ongoing and/or imminent physical sexual abuse. But it is also the case for known CSAM, as viewing it often leads to hands-on abuse. In an anonymous online survey in the Darkweb, 37% of individuals who viewed CSAM had sought direct contact with a child after viewing the material. Also, half of the offenders sentenced in the US in 2019 for CSAM related offences (non-production) engaged in aggravating sexual conduct prior to, or concurrently with, the CSAM charge. The detection of CSAM also stops its distribution, which fuels demand for more and new material and therefore new abuses. Offenders not only exchange CSAM bilaterally but are typically required to contribute with new material to join online communities trading it. 44% of offenders convicted in the US for CSAM-related offences (non-production) participated in an online community, 77% required sentencing enhancements for possession of 600 or more images. The material demanded has become more and more extreme. In the same 2019 US data, 52% of cases included images or videos of infants or toddlers and 84% of cases required sentencing enhancements for images depicting sadistic or masochistic conduct or abuse of an infant or toddler. Detection, reporting and action The proportion of cases where CSA is discovered in a timely manner and prevented or stopped is very limited. Oftentimes, children do not manage to seek help themselves, and those in their ‘circle of trust’ (i.e. family and other close contacts), in charge to provide protection and care, are often the abusers. One in three victims will never tell anyone and at least four in five CSA cases are not reported to public authorities. There are indications that the COVID-19 crisis has exacerbated the problem, especially for children who live with their abusers. In this context, online service providers and in particular ‘online intermediaries’ such as messaging services, online forums, and online platforms (such as video-sharing and media-sharing platforms, social networks, etc.) have acquired an important role. First, online intermediaries are often the only ones to have any possibility to detect the ongoing abuse. Frequently, the abuse is only discovered thanks to the efforts of online service providers to detect CSAM on their services, and to protect children from being approached by predators online. The key role of these reports is evidenced by the fact that in some Member States, up to 80% of investigations are launched due to reports from service providers. This is particularly the case in electronic (private individual or group) communications, which offenders frequently use to exchange CSAM and approach children, where the service provider is the only one that can detect the abuse. It is reflected in recent statistics showing that the vast majority of reports (more than 80% in 2020, up from 69% in 2019) originate in interpersonal communication services (e.g. messenger applications and email), and surveys. In a recent one, two-thirds of respondents who received sexually explicit material online as children from an adult they knew or someone they did not know, received it through a private messaging service (68%), most commonly on their own personal mobile device (62%). Secondly, the internet has also given offenders a new way of approaching children. They contact children on social media, gaming platforms and chats and lure them into producing compromising images of themselves or into offline meetings. In addition, children are spending more time online than ever before, increasing the risk of coming into contact with online predators. Third, offenders frequently record the sexual abuse for repeat viewing and sharing. Where CSAM is shared online, the harm is perpetuated. The exponential development of the digital world has facilitated the global sharing of materials and the creation of networks of offenders via online intermediaries. The images and videos of CSA continue to circulate long after the abuse itself, and survivors often find themselves powerless to ensure removal of online content depicting their abuse. In some cases, offenders continue to traumatise victims long after the abuse has taken place by creating fake accounts with the actual names of the victims. These accounts typically do not contain illegal content but they attract offenders familiar with the CSAM depicting those victims, who discuss the past abuse and the current personal information of the victims (e.g. where they live, work or family situation). It is estimated that, at any given moment, across the world there are more than 750 000 individuals online exchanging CSAM, streaming live abuse of children, extorting children to produce sexual material or grooming children for future sexual abuse. The problem and problem drivers considered in the impact assessment apply to the three main types of abuse: known CSAM, new CSAM and grooming, also referred to as a whole as CSA online. Box 2: current system to detect and report CSA online in the EU The CSA detection efforts of online service providers fall into three categories: first, the detection of ‘known’ CSAM, that is, images and videos that have been reported or detected before and that have already been verified as constituting CSAM; secondly, the detection of ‘new’ CSAM, i.e. images and videos that have not previously been detected and verified; and third, the detection of ‘grooming’ (also referred to as solicitation of children), where offenders trick or threaten children into sharing compromising images or meeting them offline for the purposes of sexual abuse. Currently, EU legislation allows certain online communication services like instant messenger and email to continue voluntary measures to detect and report child sexual abuse online, provided that their activities are lawful and, in particular, meet a set of specific conditions. In general, the measures that providers take vary widely and proactive detection of CSA online is still a rarity among service providers active in the EU. The vast majority of CSA reports from service providers reaches law enforcement authorities in the EU through the US National Centre for Missing and Exploited Children (NCMEC), which is therefore of key importance for the fight against CSA in the EU. While US law does not oblige providers to detect CSA online in their services, it does oblige service providers to report it to NCMEC where they become aware of the abuse. NCMEC determines the relevant jurisdiction(s) from where materials were uploaded. Where the report relates to an EU Member State, the report is forwarded to the US Department of Homeland Security Investigations (HSI) for onward transfer to Europol, or directly to the relevant EU Member State law enforcement authorities. HSI plays an intermediary role as currently Europol cannot receive information directly from private parties, including NCMEC or service providers. Reports which are received by Europol are cross-checked and forwarded to the relevant Member State authorities. For reports relating to the US, NCMEC is able to provide a number of additional services, such as verifying that the reported content constitutes CSA according to the definitions under US law, and providing information on where the same content has been detected previously. This service cannot be provided for non-US reports due to the much higher volumes (in 2020, 98% of the reports were non-US related). NCMEC has also a hotline function to receive reports from the public (independent from the above reporting by online service providers). It is part of the INHOPE network of national hotlines, which includes hotlines in most EU Member States where users can report CSAM that they may encounter accidentally; the hotlines then forward these reports to law enforcement and contact relevant providers to ensure removal. However, such reports from the public make up less than 2% of content found as it is rare for people to come across CSAM and report it. The INHOPE hotlines facilitate the takedown of CSAM hosted outside the territory of the country where it is reported by identifying the country where the material is hosted and forwarding the information to the relevant hotline in that country for further notification to public authorities, or to the service provider if no hotline exists. While still only very few companies engage in voluntary detection of child sexual abuse, the past few years have nonetheless seen a strong increase in reports of CSA online submitted by online service providers globally through NCMEC: from 1 million reports in 2010 to over 21 million in 2020. The number of reports concerning the EU (e.g. images exchanged in the EU, victims in the EU, etc.) has also dramatically increased: from 17 500 in 2010 to more than 1 million in 2020. Figure 1: EU-related reports submitted by online service providers, 2010-2020

Box 3: new CSAM and self-generated content Part of the increase in new CSAM is driven by self-generated child sexual abuse material. IWF reported a 77% increase from 2019 to 2020 globally. Whereas the first time the material is shared may be consensual, further resharing is typically not consensual. In a 2020 survey conducted by Thorn, 1 in 6 children aged 9 to 12 admitted that they had seen non-consensually reshared nudes of other children, up from 1 in 9 in 2019. A separate survey by Economist Impact of 18-20 year olds on their childhood experiences found similar data: 18% of them reported experiencing a sexually explicit image of themselves being shared by a peer without consent. First time sharing of self-generated material may be consensual but it may also be the result of online grooming. In the same survey conducted by Thorn, 50% of the children aged 9 to 17 said that they had sent the nudes to someone they had never met in real life, up from 37% in 2019. The amount of grooming cases reported globally increased by 98% in 2020 compared to the previous year (37 872 in 2020 vs 19 147 in 2019), presumably due to the pandemic, when both children and offenders spent more time online and at home. The reports that service providers submitted in 2020 in relation to cases in the EU included 3.7 million images and videos of known CSAM, 528 000 images and videos of new CSAM, and more than 1 400 grooming cases. Reports indicate that some companies active and with servers in the EU have now become the largest hosts of CSAM globally (from hosting more than half of all CSAM detected in 2016 to 85% in 2020, with 77% in the Netherlands). Given the worsening situation, Member States have started to take action unilaterally, adopting sectoral rules to deal with the challenge, which are necessarily national in scope and risk further fragmenting the Internal Market (see problem driver section 2.2.2.). Stakeholders’ views EU citizens are concerned about these developments. 93% consider important the principle that children should be protected in the online environment, with 73% of respondents considering this principle very important for inclusion in a potential future list of EU digital principles. Prevention Prevention is an essential component for tackling the problem at its roots. There are two main types of prevention efforts: 1.Prevention efforts focused on children and their environment and on decreasing the likelihood that a child becomes a victim. Examples include awareness raising campaigns to help inform children, parents, carers and educators about risks and preventive mechanisms and procedures, as well as training, and efforts to detect and stop online grooming. 2.Prevention efforts focused on potential offenders and on decreasing the likelihood that a person offends. Examples include prevention programmes for persons who fear that they might offend, and for persons who have already offended, to prevent recidivism. Setting out effective prevention programmes remains challenging. Resources are limited and lack coordination, and efforts, where present, are rarely evaluated to assess their effectiveness. (see section 2.2.3. on problem drivers). Assistance to victims Assistance to victims is essential to mitigate the harm and severe consequences for children’s physical and mental health caused by child sexual abuse (see section 2.1.3). Victims require both immediate and long-term assistance, before, during and after criminal proceedings and taking into account the best interests of the child. This assistance must be specific, i.e. following an individual assessment of the special circumstances of each particular child victim, taking due account of the child’s views, needs and concerns. However, immediate and long-term assistance remains limited, not sufficiently coordinated between relevant actors within and between Member States and of unclear effectiveness (see section 2.2.3.). This leads to information gaps, hampers the sharing of best practices and lessons learnt and decreases the efficacy of efforts.

2.1.2. Why is it a problem? The fact that some child sexual abuse crimes are not adequately addressed in the EU is a problem because it results in victims not being rescued and effectively assisted as soon as possible, children being less protected from crimes, and offenders enjoying impunity. It affects public security in the EU and infringes children’s fundamental rights under the Charter of Fundamental Rights of the EU (Charter), including the right to such protection and care as is necessary for their well-being, the right to human dignity and the right to privacy. The continued presence and dissemination of manifestly illegal images and videos online, and the very heterogeneous approach of service providers, affects private and public interests, hampering trust, innovation and growth in the single market for digital services, in particular due to the fragmentation created by divergent national approaches trying to address the problem of CSA online (see problem driver section 2.2.2.). Additionally, CSA has societal and economic costs. In particular, it contributes to an increased risk of serious mental and physical health problems across the lifespan, and exerts a substantial economic burden on individuals, families, and societies. There are negative consequences at all stages: ·Before the crime is committed: in the absence of proper preventative interventions, individuals who could have been stopped from abusing children may become first-time offenders, offenders are more likely to re-offend, and children are more likely to become victims if they and their carers lack awareness of the threat when using online services. ·While the crime is being committed: the consequences of not detecting and addressing the crimes swiftly include prolonged suffering and harm for victims. In addition, it reinforces the perception of impunity, reducing deterrence and facilitating further offending. ·After the crime has been committed: the consequences of not acting effectively after the crime include the inability to provide proper immediate and long-term assistance to victims, with negative effects for victims and society as described above. In addition, it may not be possible to prosecute offenders, which reduces opportunities for rehabilitation before, during and after criminal proceedings to prevent reoffending. 2.1.3. Who is affected and how? First, children in the EU and elsewhere, who may fall victim to sexual abuse and suffer its negative effects, both in the immediate and long-term. Immediate effects include physical injuries and psychological consequences (e.g. shock, fear, anxiety, guilt, post-traumatic stress disorder, denial, withdrawal, isolation, and grief), sexual behaviour problems and over-sexualised behaviour, academic problems, substance abuse problems, increased likelihood of involvement in delinquency and crime, and increased likelihood of teen pregnancy. Long-term effects include psychological and social adjustment problems that can carry over into adulthood and affect married life and parenthood. They include negative effects on sexual and overall physical health; mental health problems including depression, personality and psychotic disorders, post-traumatic stress disorder, self-mutilation, attempted or completed suicide; and relational and marital problems including fear of intimacy and spousal violence. Secondly, online service providers. Member States’ efforts to tackle the challenge at national level create distortions in the single market for digital services (see problem driver section 2.2.2.), as providers have to comply with sector-specific rules under national laws at least in some of the jurisdictions where they are active, resulting in a more challenging business environment for companies, in particular for smaller companies that are already facing difficulties of competing with their largest counterparts. Third, users of online services. The detection, reporting and removal of CSA online currently lacks clarity, legal certainty and transparency. As a consequence, the rights and interests of users can be negatively affected. This can occur, for instance, in relation to unjustified reporting or removals, which may affect not only the users initiating the communications in question but also those at the receiving end. The existing uncertainty may also have a ‘chilling effect’ on legitimate forms of communications or hamper the full participation of children in online services as their parents and carers become more and more aware of the risks but do not have access to transparent information about the levels of risk and about what measures services take to protect children. Fourth, governments and public authorities. The competent public authorities (e.g. law enforcement or governments at national, regional and local levels) dedicate significant resources to act against CSA. In particular, they put in place prevention programmes and measures to assist victims, and conduct investigations after they become aware of possible CSA. Inefficiencies in the current system lead them to seek local solutions to incentivise and obtain more information from providers. Finally, society in general, given that CSA has consequences not only for the victims, but also for society as a whole. Social costs correspond to the non-monetary consequences of the criminal acts, and include diminished quality of life for society and increased feelings of insecurity among individuals. Economic costs include those of police and judicial services (e.g. criminal prosecution, correctional system), social services, victim support service and victim compensation programmes, education, health, and employment costs. Box 4: estimated costs of child sexual abuse Victims of child sexual abuse require immediate and long-term assistance. The costs of providing such assistance can be significant. For example, the total lifetime costs of assistance to victims arising from new substantiated cases of child sexual abuse in the United States in 2015 was estimated at USD 1.5 billion per year. The long-term effects of child sexual abuse on victims also include lifelong loss of potential earnings and productivity. The total lifetime cost of such losses arising from new substantiated cases of CSA in the US in 2015 was estimated at USD 6.8 billion per year. Overall, the total estimated costs of child sexual abuse in the US in 2015 were estimated at USD 11 billion per year. 2.2. What are the problem drivers? 2.2.1. Voluntary action by online service providers to detect online child sexual abuse has proven insufficient Voluntary action varies significantly among companies Online service providers are often the only entities capable of detecting that abuse involving their services is taking place. Because detection is voluntary, some online service providers take comprehensive action, others take some action, and there are providers that do not take any action against CSA at all. In addition, service providers often do not have access to reliable information on what content and behaviour is illegal in the EU to facilitate accurate detection, proactively and voluntarily, resulting in a risk of both over- and underreporting.

There are currently 1 630 companies registered to report to NCMEC, which is the main entity to receive reports of proactive searches that companies perform on their system, and the de facto global clearinghouse of reports of CSA online. This is a fraction of the online services used to commit these crimes. In 2020, of these 1 630 companies, one, Facebook, sent 95% of reports, 5 sent 99% of reports, and only 10% sent one report or more. There is no evidence that 95% of all the current cases of CSA online (including sharing of known and new CSAM, and grooming) occur on the services of that single company. In fact, experts agree that comparable levels of abuse occur in similar services from other companies, and the difference in detection levels is rather due to the different intensity of detection efforts. For example, some providers may make efforts to detect abuse only in certain services they provide, or may make efforts to detect only certain types of abuse. This would mean that there is a substantial amount of CSA online that remains undetected. Figure 2: breakdown of reports submitted by online service providers globally in 2020 In addition, a number of service providers take action against users for suspected sharing of CSAM, e.g. by banning user accounts, but do not report. For example, WhatsApp indicates that it bans around 300 000 accounts per month for this reason alone. However, it has been reported that WhatsApp reports to NCMEC only about 10% of these cases, as the evidence recovered is circumstantial only and in line with US legislation is insufficient for a criminal investigation. Where that is so, there is on the one hand a risk that users are banned on the basis of unclear and potentially insufficient evidence, while on the other hand actual abuse may not be reported and investigated. This can have a significant negative effect on the fundamental rights of users, and on the affected children. These different approaches and the related risks also create asymmetries in the single market for digital services, as they have prompted a number of Member States to adopt or consider national legislation to create a stronger and more effective approach (see problem driver section 2.2.2). Voluntary action is susceptible to changes in companies’ policies. Because detection is voluntary, companies may decide to change their policies at will. One example is Facebook’s decision to implement end-to-end encryption (E2EE) on its private messaging service by default. Existing detection efforts risk being severely hampered by the introduction of encryption in online services, which in spite of its benefits for cybersecurity and the protection of users’ fundamental rights, such as freedom of expression, privacy, and data protection, also makes the detection of CSA online and the protection of fundamental rights of the victimised children more difficult, when not impossible. Box 5: end-to-end encryption, a policy change impacting child sexual abuse detection In March 2019, Facebook announced plans to implement end to-end encryption (E2EE) by default in its instant messaging service. These plans have been reiterated afterwards, with the implementation taking place “sometime in 2023”. In the absence of accompanying measures, it is conservatively estimated that this could reduce the number of total reports of CSA in the EU (and globally) by more than half, and as much as two-thirds. These estimates were confirmed after Facebook announced that it had stopped the detection of CSA in its instant messaging service in December 2020, given the legal uncertainty it considered to be caused by the entry into force of the European Electronic Communications Code (see the information on the Interim Regulation in section 1). From 1 January to 30 October 2021 the number of reports received by law enforcement in the EU dropped by two-thirds compared to the same period in 2020 (972,581 reports vs 341,326 reports), a loss of 2 100 reports per day. In total in 2021, while there was a 35% increase in global reports, the number of reports relevant for the EU dropped by 47%. Whereas in this case the tools to detect CSA were not used due to legal concerns, the practical effects are likely the same as an implementation of E2EE without mitigating measures would cause: the impossibility to detect CSA, since the detection tools as currently used do not work on E2EE systems. Google announced in November 2020 that it had started to roll out E2EE on Google Messages. Other similar services with E2EE already incorporated (with presumably similar if not higher levels of CSA) include WhatsApp, Apple’s iMessage, Signal and Telegram. In addition to affecting the detection of CSA online and the protection of fundamental rights of the victimised children, the use of E2EE without mitigating measures reduces the means to prevent and combat CSA overall by “turning-off the light” on a significant part of the problem, i.e. decreasing the evidence base, including data on the scale of detectable CSA online, which is essential to fight against overall CSA effectively through assistance to victims, investigations, and prevention. In the absence of mitigating measures (e.g. tools that can detect CSA online in E2EE systems, see annex 9), currently the possible ways to detect CSA online in E2EE systems are: 1)user reports, i.e. either the child or the offender reports the abuse; and 2)metadata, i.e. the time of the online exchange, the user names, and data related to the online exchange other than its content. This also includes suspicious patterns of activity (e.g. if someone repeatedly sets up new profiles or messages a large number of people they do not know). Relying on user reports implies that the responsibility of reporting will be borne solely by child victims of sexual abuse in grooming cases, who in many cases are shamed or threatened into silence (see section 2.1.1. on underreporting), as the offender will obviously not report the abuse. This is already evident from the low number of user reports today. Service providers do not consider metadata as an effective tool in detecting CSAM. In addition, the use of metadata is usually insufficient to initiate investigations. Moreover, it is likely to generate a much lower number of reports than the detection of content, despite the level of abuse being the same (if not higher). As an example, consider WhatsApp (E2EE and therefore uses metadata as the basis of detection) and Facebook Messenger (not E2EE and therefore uses content as the basis of detection). Whereas WhatsApp has around 50% more users than Facebook Messenger (2 billion vs 1.3 billion), and therefore, presumably, higher level of abuse proportional to the number of users, there were around 35 times less reports from WhatsApp than from Facebook Messenger submitted to NCMEC in 2020 (400 000 vs 14 million). Europol reports that the widespread use of encryption tools, including E2EE apps, has lowered the risk of detection for those who offend against children. Offenders are well aware of the possibilities that E2EE present to hide their abuse. In an analysis of offender forums in the Darkweb, it was found that a majority of discussions focused on topics such as technical tools for direct messaging or how to securely acquire and store content. Voluntary action leaves decisions affecting fundamental rights to service providers and lacks harmonised safeguards A voluntary system leaves private companies to make fundamental decisions with significant impact on users and their rights. The challenges in this system are particularly evident when dealing with CSA, where there are fundamental rights and interests at stake on all sides – including the right to protection of their well-being and to privacy on the side of the child, the right to privacy and freedom of expression and information for all users. As a result, if the rights of the child are deemed important enough to justify interfering with the rights of all users and of service providers, then it may not be appropriate to leave the decision on whether and if so, how to do so to the service providers. In addition, the current voluntary action by online service providers to detect CSA online lacks long-term perspective and harmonised safeguards applicable to all relevant service providers, including transparency. This is especially important as some of the voluntary measures that companies decide to take may interfere with users’ rights, including those to privacy and data protection. It is unclear which tools are in use and how they are used, or which procedures are in place to improve the tools and limit the number of false positives. While there is an obvious need not to warn off perpetrators or inadvertently provide guidance on how to avoid detection, there may be room for more information. As a result, users at present may have no effective redress in case of erroneous removals; the possibilities of scrutiny are limited; and there is no effective oversight by regulators. In addition, the existence and effectiveness of procedural safeguards differs widely across providers.

The Interim Regulation introduced a number of safeguards, such as annual transparency reports, consultation with data protection authorities on their processing to detect CSA online, and complaint mechanisms, so that content that has been removed erroneously can be reinstated (see section 1). A number of important safeguards are contained in the DSA proposal, which lays down harmonized transparency requirements in case of content moderation based on providers own initiative, as well as in relation to mechanisms for removal and related user complaints. Given the gravity of impact on both sides – for the child victims, materials depicting their abuse, and the risk of (further) abuse, and for the suspected user, an accusation of having circulated CSAM – the above safeguards form an important baseline but do not go far enough in the present context. In particular, the stakeholder consultations have shown the importance of a universal reporting obligation for CSA online for the providers, using dedicated secure and fast channels, as well as of additional requirements on the technologies employed for automatic detection to ensure that they are both effective in detecting abuse and also limit the number of false positives to the maximum extent technically possible. Voluntary action has failed to remove victims’ images effectively Victims are left on their own when images and videos of their abuse end up online. Under national criminal laws, hotlines in the EU are in principle not allowed to proactively search for images and videos of a given victim, on the victim’s behalf, to effect removal. For the same reason, victims themselves are also prohibited from searching for their own images and videos, as the possession of CSAM is illegal per se. Absent a requirement for relevant services providers to take proportionate measures to detect, report and remove specified content, an effective removal system has not developed. Box 6: Voluntary principles to counter online child sexual abuse The US, UK, Canada, Australia and New Zealand (the ‘Five Eyes’), together with leading online service providers, civil society and academia, announced in 2020 a set of voluntary principles for companies to tackle child sexual abuse online. These address notably the detection, reporting and removal of CSAM, as well as detection and reporting of grooming. Although multiple companies have committed to implementing the voluntary principles, including Facebook, Google, Microsoft, Roblox, Snap and Twitter, there is a lack of transparency on the actions that companies are taking to implement those principles. As a consequence, there is a lack of evidence of tangible results of that commitment. 2.2.2. Inefficiencies in public-private cooperation between online service providers, civil society organisations and public authorities hamper an effective fight against CSA This section describes the inefficiencies in public-private cooperation between the main actors in the fight against CSA, online and offline. In a majority of cases, the inefficiencies relate to regulatory issues. Cooperation between public authorities and service providers Cooperation between public authorities and service providers is of critical importance in the fight against CSA, particularly in relation to service providers’ efforts to detect and report CSA online and remove CSAM. ·Legal fragmentation affecting the Internal Market Currently, although obligations under national law are increasingly introduced, companies offering online services in the EU still detect, report and remove CSA online from their services on a voluntary basis. There are at present no effective procedures under EU law for service providers to report to public authorities or to exchange information in a timely manner or swiftly react to requests and complaints. This hampers investigations and creates obstacles to addressing CSA and to protecting victims. This has led to a number of Member States preparing and adopting individual legislative proposals at the national level to create stricter rules for providers who fail to cooperate with public authorities or do not put in sufficient efforts to detect and report CSAM. Some Member States adopted new legislation as recently as 2021 (e.g. Germany, Austria) and others are currently preparing legislative proposals (e.g. Germany, France, the Netherlands) (see Annex 5). These efforts often involve establishing dedicated public authorities or designating existing authorities to enforce the new rules, as well as strict time-limits for service providers to remove CSAM upon becoming aware, subject to fines if they fail to do so. At the same time, the reach of these efforts varies and they are constrained by the national laws of the Member States. The scope of relevant national laws and their obligations differ in terms of the services covered. For instance, some focus on social networks in general, others on hosting providers managing websites containing illegal content and yet others on online platforms above a certain threshold (e.g. number of registered users and annual revenue). Approaches are by nature limited to national jurisdictions. Given the cross-border nature of the Internet, and by implication many service providers operating online as well as online CSA, such a fragmented approach hampers the proper functioning of the internal market. Moreover, such a fragmented approach cannot ensure the effective detection, reporting and removal of CSAM and the fight against grooming across the EU, beyond the borders of individual Member States having the above-mentioned national legislation in place. Compared to one horizontal framework established at EU level, such a Member State-based approach increases the costs of doing business in the EU as service providers have to adapt to various different sets of rules, which creates uncertainties and challenges in particular for smaller providers seeking to expand to new markets in the EU, and can stifle innovation and competition. Box 7: the CSAM issue in the Netherlands

As highlighted above, reports indicate that some service providers active and with servers in the EU have now become the largest hosts of CSAM globally, with more than half of all CSAM hosted in the Netherlands, given its strong internet infrastructure. The Dutch government has made several commitments to address this issue, including investing in partnerships between the Dutch Government and the private sector. This included a new free service called ‘Hash Check Service’ (operated by the EU co-funded Dutch INHOPE hotline EOKM) made available to companies to scan their servers for known CSAM. Given that there is a small group of Dutch companies that only cooperate to a lesser extent, and some companies not at all, the Netherlands is also preparing a new law to deal with companies that fail to cooperate. In the near future, companies will be under the supervision of a governing body that will have the authority to impose administrative sanctions on companies that fail to cooperate. In addition to criminal law, this procedure specifically aims to eradicate CSAM in a fast and efficient manner. The national approaches create fragmentation on the Internal Market, hindering effective cooperation between public authorities and service providers in the fight against CSA. The continued presence and dissemination of CSAM, and the very heterogeneous approaches of service providers, affect both private and public interests, hampering trust, innovation and growth on the Internal Market (i.e. single market for digital services). Such fragmentation increases compliance and operational costs of the actions in the fight against CSA for stakeholders such as online service providers that operate in several Member States and may lead to legal uncertainty. Non-compliant service providers may move to and continue operating from Member States where national rules are less strict. Given the cross-border and international dimension of online service provision as well as child sexual abuse online, a patchwork of national measures does not effectively protect children, and creates distortions in the functioning of the single market for digital services. The proposed Digital Services Act will not be able to reduce this fragmentation to the extent necessary, given its horizontal nature and the specific challenges posed by CSA (see section 5.1.). For example, the DSA would not create removal obligations. Some Member States have already gone farther, like Germany, which for certain providers such as social networks has imposed removal obligations by law, as well as reporting obligations in case of detection of CSAM, specifying the data to be reported to federal law enforcement, as well as an obligatory notification to the user and other aspects. ·Varying quality of reports While reports from service providers via NCMEC have led to many cases of children being rescued from ongoing abuse, and of offenders arrested, law enforcement authorities estimate that only around 75% of reports they receive from service providers are actionable. The most common reason is that the report contains material that does not constitute child sexual abuse under the Member State’s law. This is largely due to a simple fact: US-based service providers report to NCMEC material that may constitute CSA under US law, which may include content that is not illegal in the EU and omit content that is illegal in the EU. For example, the CSA Directive leaves up to Member States to make illegal sexual abuse material involving individuals appearing to be a child but in fact older than 18, whereas US legislation requires that the material involve an “identifiable minor” to be illegal. On the other hand, the CSA Directive criminalizes grooming only when the child is below the age of sexual consent, whereas it is always illegal in the US for any person under 18. Further challenges arise as a result of a lack of unified reporting requirements which clearly set out the information to be included in reports. While US service providers are obliged to make reports to NCMEC, much of the information to be included in the report is left at the discretion of the provider. The service that NCMEC provides for US-related reports (i.e. human review of the reports to ensure that they are actionable) is typically not available for EU-related reports, due to resource constraints. A lack of sufficient information is also one of the most common reasons cited by the law enforcement authorities of the Member States for a report not to be actionable. ·Lack of resources in law enforcement agencies Absent the support provided by NCMEC to US authorities, each national law enforcement authority is left to its own devices when analysing CSAM, despite the support provided by Europol to help coordinate cases. This requires a significant investment of resources and makes it very difficult to deal effectively with the large amount of reports these authorities receive, and prevents an effective public-private cooperation against CSA. ·Lack of feedback from public authorities to service providers. Currently, there is no mechanism for systematic feedback from law enforcement to companies on their reports. Where providers report content that is not illegal under the law of the relevant Member State, the provider is not made aware of that fact. This increases the likelihood of the provider reporting the same or similar content again in the future. ·Challenges due to the international and cross-border nature of CSA There are several international and cross-border aspects to the fight against CSA online. In many cases, these are inherent in the cross-border nature of the Internet. As a result, a single incident of online abuse may involve perpetrators and victims located in multiple jurisdictions. While certain minimum standards relating to CSA crimes have been widely adopted in criminal law in many countries, and within the EU the CSA Directive contains specific requirements providing for a degree of harmonisation, specific national definitions and offences differ from one country to another. In addition, long-standing difficulties with regard to cross-border access to electronic evidence pose a particular problem for the investigation of CSA online. Law enforcement frequently needs additional information during investigations from service providers, which are often located in another Member State, or in a third country. Existing judicial cooperation is too slow and direct cooperation between service providers and public authorities is unreliable, inconsistent and lacks transparency and accountability. Several legislative proposals and other ongoing initiatives aim to address these issues (see box 2 in Annex 6). Furthermore, due to the existing legal framework and the often important or even dominant market position of US service providers, Member States are heavily dependent in their fight against CSA on reports received from a third country, the US, through NCMEC. Cooperation between civil society organisations and service providers ·Cooperation challenges in notice and action procedures. When they receive a notice from civil society organisations requesting them to remove content, service providers in more than 25% of cases refuse to take action to remove the notified content or take a considerable time period to do so. Whilst there can be justified reasons for not taking action or for some delays in individuals cases (for instance, because of uncertainty as to whether the notified content actually constitutes CSAM under the applicable laws), there is a particularly problematic group of providers known as ‘bulletproof hosting providers’, which refuse to assume any responsibility for content stored on their servers. It should be recalled that, at present, EU law does not provide for an obligation for providers to report or act upon notified content, not even where it manifestly constitutes CSAM. Under the eCommerce Directive (Art. 14) and the proposed DSA (Art. 5, see section 5.1.), hosting service providers’ failure to act expeditiously to remove or disable access to illegal content (including CSAM) would lead to loss of the benefit of the liability exemption. In such cases, the service providers may – but not necessarily will – be liable under the applicable national laws of the Member States, depending on whether these national laws provide for liability for service providers. Cooperation between public authorities and civil society organisations ·Limited impact of hotlines’ action in the EU due to regulatory gaps. Inability to search proactively. As noted, hotlines operating in Member States are under national criminal law in principle not allowed to search CSAM proactively. They therefore tend to rely exclusively on reports from the public, which are of limited number and fluctuating in quality. The number of user reports is significantly lower than those from proactive efforts, as the situations in which someone comes across CSAM unintentionally and reports it are limited. Also, user reports are often inaccurate, in particular compared with reports from proactive searches. For example, the only hotline that conducts proactive searches in Europe, IWF in the UK, reported that whereas about half of the reports it manages come from the public and half from proactive searches, only 10% of the total CSAM that it finds traces back to public reports vs 90% from proactive searches.

·Inefficiencies in cooperation on assistance to victims. For long-term assistance to victims, there is room for improvement in the cooperation between public authorities and NGOs to ensure that victims are aware of the resources available to them. In addition, currently there is no cooperation between public authorities and hotlines or other NGOs to support victims at their request in searching and taking down the material depicting them. ·Inefficiencies in cooperation on prevention. Inefficiencies in cooperation exist notably on prevention programmes for offenders and for persons who fear that they might offend. In some Member States, NGOs carry out these programmes with limited support from public authorities. In addition, the coordination between public authorities and NGOs on the programmes they respectively offer at different stages is also limited (e.g. between the programmes that public authorities offer in prisons and the reintegration programmes that NGOs offer after the offender leaves prison). Cooperation between public authorities, service providers and civil society organisations ·Lack of legal certainty: -For service providers. The Interim Regulation did not create an explicit legal basis for service providers to proactively detect CSA, and it only provided a temporary and strictly limited derogation from certain articles of the e-Privacy Directive to allow the continuation of the voluntary measures to detect CSA, provided that these are lawful. Whereas some service providers invoke legal bases provided for in the GDPR for the processing of personal data involved in them carrying out their voluntary actions to tackle CSA, others find the GDPR legal bases not explicit enough. The uncertainty thus deters some service providers from taking such voluntary action. -For hotlines. The operation of hotlines is not explicitly provided for in EU law, and only five Member States explicitly regulate it, with others relying on memorandums of understanding. This leads to the inability of hotlines to assess the content of reports from the public in some Member States, or to notify the service provider directly, leading to fragmentation and ineffectiveness across the EU. ·Lack of operational standards: Law enforcement agencies, online service providers and civil society organisations have separate systems and standards used in the detection, reporting and removal of CSA online. They vary not only between the different types of stakeholders (e.g. between law enforcement and service providers) but also between the same type of stakeholder (e.g. between law enforcement agencies in different Member States). This includes the use of multiple, differing databases of hashes used in the detection of known CSAM. This hampers the collective ability to efficiently and effectively detect, report and remove CSAM, to identify and rescue victims, and to arrest offenders. Stakeholders’ views Public authorities identified among the main challenges while investigating CSA cases: a) inefficiencies in public-private cooperation between service providers and public authorities, and b) inefficiencies/difficulties with access to evidence due to technical challenges. Over 80% referred to the increased volume of CSAM detected online in the last decade and further flagged that there are insufficient human and technical resources to deal with it. These same stakeholders state that a common baseline (also in terms of a common classification system and terminology) is required to support better law enforcement and judicial cooperation and information sharing consistent with the cross-border nature of offending in CSAM. Civil society organisations stressed the need to improve cooperation between them and law enforcement authorities (74%) in the fight against CSA online (including by providing funding to enable cooperation, organizing joint trainings/meetings and ensuring better information sharing, as well as the need for legal recognition and a clear legal basis for the national hotlines). In addition, 73% of the respondents from civil society organisation pointed out that improved cooperation with service providers is needed. Service providers highlighted the need for coordinated actions on a global level, and the importance of exchange of best practices. 2.2.3. Member States’ efforts to prevent child sexual abuse and to assist victims are limited, divergent and lack coordination and are of unclear effectiveness Prevention efforts ·Limited.

In relation to the two main types of prevention efforts described in section 2.1.: oPrevention efforts to decrease the likelihood that a child becomes a victim. Awareness raising and training is limited in availability, particularly to organisations and persons that come in regular and direct contact with children as part of their jobs or vocational activities, in addition to carers and parents. A vast majority of the abuse occurs in the circle of trust of the child. At the same time, those in regular and direct contact with children should have the knowledge and tools to ensure that children do not become victims, given their proximity to the child. oPrevention efforts to decrease the likelihood that a person offends. Research into what motivates individuals to become offenders is scarce and fragmented. This current lack of research makes it difficult to put in place effective programmes before a person offends for the first time, in the course of or after criminal proceedings, both inside and outside prison. As a result, there are currently very few programmes in place . ·Uncoordinated. Multiple types of stakeholders need to take action to enact a preventive approach that delivers results. This includes public authorities, the research community, NGOs, and providers of online services used by children. The various types of practitioners in this field do not communicate sufficiently with each other and with researchers on the effectiveness of the programmes, lessons learned and best practices; language can be a further barrier. Expertise and resources to establish and implement such initiatives are not evenly distributed in the EU, and successful programmes are mostly local endeavours. There are overlapping efforts in some areas, e.g. Member States designing similar programmes and campaigns in parallel , whereas other areas, such as reaching out to potential offenders, are not sufficiently addressed. ·Unclear effectiveness. The few programmes that exist are rarely evaluated to assess their effectiveness and usability . A recent systematic review of the published empirical literature on child sexual abuse perpetration prevention interventions found only five published evaluation studies, and these were methodologically limited (e.g. four examined the same intervention only on adults in Germany, and the other one focused only on children aged 5 to 12) . Assistance to victims’ efforts ·Limited. Victims of CSA do not always receive the tailored and comprehensive assistance required , such as support in trying to stop the sharing and distribution online of the images and videos depicting their abuse, which perpetuates the harm. ·Uncoordinated. Victims of CSA require comprehensive support that brings together all relevant sectors, including health, legal, child protection, education and employment. Such coordination between relevant actors within and between Member States is lacking. The existing initiatives do not systematically make use of existing best practices and lessons learned in other Member States or globally. This translates into information gaps on help resources, gaps in specialised support, and overall inefficiency of efforts. ·Unclear effectiveness. There is little data on whether survivors have access to appropriate support, and existing research suggests that the level of satisfaction with support received is low . Box 8: main sources of evidence on current efforts on prevention and assistance to victims The CSA Directive requires Member States to put in place prevention measures of programmes of the two main types described in section 2.1.1. (i.e. programmes focused on children or on possible offenders), as well as assistance to victims measures. The Commission has been monitoring the transposition of the CSA Directive since 2013, when the deadline for Member States to transpose it expired. One of the main challenges for Member States concern the transposition of the articles concerning prevention and assistance to victims . Member States have generally struggled to put in place the required prevention programmes or measures, in particular those for offenders and for people who fear that they might offend, as well as assistance to victims programmes. In some cases, these programmes have not been put in place yet and in others they are in place but they do not fully comply with the requirements of the Directive. The Commission organised six dedicated workshops in 2018 and 2019 to support Member States in the transposition of these and other provisions and better understand the challenges. These workshops, together with additional bilateral exchanges between the Commission and Member States, revealed a need for more structured and continuous support, as some aspects of prevention and assistance to victims have not been traditionally an area of focus for Member States’ action in the fight against CSA. The shortcomings typically originate in a lack of expertise in relevant areas, as well as difficulties in communication and coordination between key actors, e.g. different ministries. In particular when it comes to measures targeting (potential) offenders, there remains significant room for improvement. In addition to the evidence gathered through monitoring the transposition of the Directive and supporting its implementation, the feedback from stakeholders during the consultation activities, in particular NGOs focused on child’s rights, shows the need for improving awareness and education of children, parents, and caregivers. This feedback also included the need for improving the availability of effective prevention programmes for offenders and persons who fear that they might offend, as well as