Proposal for a REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL amending Regulation (EU) 2021/1232 as regards the extension of its period of application
Date: 2025-12-19
Institutions: Directorate-General for Migration and Home Affairs, European Commission
Subjects: child pornography, child protection, data protection, derogation from EU law, paedophilia, personal data, protection of communications, regulation of telecommunications, sexual violence, social media

EN 

  EN 

   EUROPEAN COMMISSION  Brussels, 19.12.2025  COM(2025) 797 final 2025/0429 (COD)  Proposal for a REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL amending Regulation (EU) 2021/1232 as regards the extension of its period of application  (Text with EEA relevance)  
 
EXPLANATORY MEMORANDUM 

1. 

CONTEXT OF THE PROPOSAL 

Reasons for and objectives of the proposal 

• 
Regulation (EU) 2021/1232 (“Interim Regulation”)1 lays down temporary and strictly limited 
rules  derogating  from  certain  obligations  laid  down  in  Directive  2002/58/EC  (“the  ePrivacy 
Directive”),  with  the  sole  objective  of  enabling  providers  of  certain  number-independent 
interpersonal  communications  services  to  use  specific  technologies  for  the  processing  of 
personal and other data to the extent strictly necessary to detect online child sexual abuse on 
their  services  and  report  it  and  to  remove  online  child  sexual  abuse  material  from  their 
services. 

As  explained  in  its  Recital  10,  the  Interim  Regulation  is  intended  to  provide  a  temporary 
solution pending the adoption of a long-term legal framework to tackle child sexual abuse at 
Union level.  

The  proposal  for  a  Regulation  of  the  European  Parliament  and  of  the  Council  laying  down 
rules to prevent and combat child sexual abuse,2 which the Commission adopted on 11 May 
2022, aims to provide that long-term legal framework. 

The application period of the Interim Regulation, initially set to expire on 3 August 2024, was 
extended  until  3  April  2026  by  Regulation  (EU)  2024/13073.  The  inter-institutional 
negotiations  on  the  proposed  long-term  Regulation  have  not  concluded  and,  despite  the 
extension  of  the  application  period  of  the  temporary  regime,  it  is  uncertain  that  they  will 
conclude  in  time  for  the  long-term  Regulation  to  enter  into  force  and  to  apply  before  the 
Interim  Regulation  is  set  to  expire.  Therefore,  it  is  necessary  to  introduce  through  this 
proposal a further limited time extension to the Interim Regulation, to enable the continuation 
of  the  above  voluntary  activities  during  a  sufficient  period  of  time  to  allow  the  inter-
institutional negotiations of the long-term Regulation to conclude. This will ensure that child 
sexual abuse online can be effectively and lawfully combated without interruptions  until the 
long-term regime created by the proposed Regulation is agreed.  

Should  the  interinstitutional  negotiations  conclude  in  an  agreement  on  the  long-term  legal 
framework, and transitional rules extending the Interim Regulation contained in the long-term 
legal framework go into effect, on or before 3 April 2026, then the temporary extension would 
no longer be necessary. 

• 

Consistency with existing policy provisions in the policy area 

This proposal delivers on commitments made in the EU Strategy for a More Effective Fight 
Against Child Sexual Abuse, notably to propose legislation to tackle child sexual abuse online 
effectively. The current EU legal framework in this area consists of Union legislation relating 

1 

2 

3 

Regulation  2021/1232/EU  of  the  European  Parliament  and  of  the  Council  of  14  July  2021  on  a 
temporary  derogation  from  certain  provisions  of  Directive  2002/58/EC  as  regards  the  use  of 
technologies  by  providers  of  number-independent  interpersonal  communications  services  for  the 
processing of personal and other data for the purpose of combating online child sexual abuse (Text with 
EEA relevance). 
Proposal for a Regulation of the European Parliament and of the Council laying down rules to prevent 
and combat child sexual abuse, COM/2022/209 final. 
Regulation (EU) 2024/1307 of the European Parliament and of the Council of 29 April 2024 amending 
Regulation (EU) 2021/1232 on a temporary derogation from certain provisions of Directive 2002/58/EC 
as regards the use of technologies by providers of number-independent interpersonal communications 
services for the processing of personal and other data for the purpose of combating online child sexual 
abuse (Text with EEA relevance). 

EN 

1 

  EN 

 
to child sexual abuse, such as the Child Sexual Abuse Directive, and the Interim Regulation, 
which applies until 3 April 2026.  

The  proposed  legislation  complements  the  European  Strategy  for  a  Better  Internet  for 
Children4,  which  aims  to  create  safe  digital  experiences  for  children  and  to  promote  digital 
empowerment,  as  well  as  the  EU  Strategy  on  the  rights  of  the  child5  and  the  related 
Commission  Recommendation  on  integrated  child  protection  systems6,  aimed  to  support 
Member States in strengthening their child protection systems against any forms of violence 
against children, including sexual abuse, in the best interests of the child.    

• 

Consistency with other Union policies 

The proposal extends the period of application of the Interim Regulation, for a limited period 
of time, without otherwise amending that Regulation in any way.  

Consequently, as is the case with the Interim Regulation as it stands prior to the amendment 
now  proposed,  the  approach  embodied  therein  builds  on  the  General  Data  Protection 
Regulation7 (GDPR). As explained in Recitals 12 and 15 as well as Article 1(1) of the Interim 
Regulation, the GDPR applies and is left unaffected by the Interim Regulation. Therefore, the 
rules set out in the GDPR must continue to be respected, including those on the lawfulness of 
processing  (Article  6).  In  practice,  providers  tend  to  invoke  various  grounds  for  processing 
provided for in the GDPR to carry out the processing of personal data inherent in voluntary 
detection and reporting of child sexual abuse online.  

The proposal, as is the case for the Interim Regulation as it stands, covers providers that offer 
number independent interpersonal communications services and hence are subject to national 
provisions  implementing  the  ePrivacy  Directive8  and  its  proposed  revision  currently  in 
negotiations9, with both of which the proposal is coherent.  
The proposal is also coherent with the Digital Services Act (DSA)10. The Interim Regulation 
complements  the horizontal framework of the DSA, setting  out  specific  rules where needed 
for the particular case of combating online child sexual abuse. 

2. 

• 

LEGAL BASIS, SUBSIDIARITY AND PROPORTIONALITY 

Legal basis 

The relevant legal bases are Article 16 and Article 114 of the Treaty on the Functioning of the 
European  Union  (‘TFEU’).  These  provisions  are  also  the  legal  bases  of  the  Interim 
Regulation.  

4 
5 
6 

7 

8 

9 

10 

COM(2022) 212, 11 May 2022. 
COM(2021) 142 final, 24 March 2021. 
Commission  Recommendation  (EU)  2024/1238  of  23  April  2024  on  developing  and  strengthening 
integrated child protection systems in the best interests of the child. 
Regulation  (EU)  2016/679  of  the  European  Parliament  and  of  the  Council  of  27  April  2016  on  the 
protection of natural persons with regard to the processing of personal data and on the free movement of 
such data, and repealing Directive 95/46/EC (General Data Protection Regulation). 
Directive 2000/31/EC of the European Parliament and of the Council of 8 June 2000 on certain legal 
aspects of information society services, in particular electronic commerce, in the Internal Market. 
Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the 
processing  of  personal  data  and  the  protection  of  privacy  in  the  electronic  communications  sector 
(Directive on privacy and electronic communications). 
Regulation  (EU)  2022/2065  of  the  European  Parliament  and  of  the  Council  of  19  October  2022  on a 
Single Market For Digital Services and amending Directive 2000/31/EC (Digital Services Act). 

EN 

2 

  EN 

 
• 

Subsidiarity (for non-exclusive competence)  

According to the principle of subsidiarity, EU action may only be taken if the envisaged aims 
cannot be achieved by Member States alone. EU intervention is needed to maintain the ability 
of  providers  of  number-independent  interpersonal  communications  services  to  voluntarily 
detect and report child sexual abuse online and remove child sexual abuse material, as well as 
to  continue  ensuring  a  uniform  and  coherent  legal  framework  for  the  activities  in  question 
throughout  the  internal  market,  as  provided  for  in  the  Interim  Regulation.  The  limited  time 
extension of the Interim Regulation can only be adopted by Union legislation.  

• 

Proportionality 

The  proposal  complies  with  the  principle  of  proportionality  as  set  out  in  Article  5  of  the 
Treaty on European Union as it will not go beyond what is necessary for the achievement of 
the  set  objectives.  It  introduces  a  limited  time  extension  to  the  targeted  and  temporary 
derogation as regards certain aspects of changes to the current framework in order to ensure 
that certain measures remain permissible to the extent that they currently comply with Union 
law.  

The duration of the extension is limited to a time period strictly necessary to adopt the long-
term  legislation,  as  can  reasonably  be  assessed  at  present  having  regard  in  particular  to  the 
current state of the negotiations. 

• 

Choice of the instrument 

The objectives of the present proposal can best be pursued through a Regulation, given that 
the act that is amended, namely the Interim Regulation, is also a Regulation.  

3. 

• 

RESULTS 
CONSULTATIONS AND IMPACT ASSESSMENTS 

EX-POST 

EVALUATIONS, 

OF 

STAKEHOLDER 

Ex-post evaluations/fitness checks of existing legislation 

Not applicable 

• 

Stakeholder consultations 

Not applicable 

• 

Collection and use of expertise 

Not applicable 

• 

Impact assessment 

In view of the policy objective and the time-sensitive nature of the issue, there are no other 
materially different policy options available, and thus no impact assessment  is necessary. In 
particular, the measure intends to introduce a limited time extension of the interim and strictly 
limited derogation from  the applicability of Articles 5(1) and 6 of the ePrivacy Directive to 
ensure that number-independent interpersonal communications service providers can continue 
to voluntarily using specific technologies to detect and report child sexual abuse online and to 
remove child sexual abuse material on their services after 3 April 2026, pending the adoption 
of long-term legislation.  

EN 

3 

  EN 

• 

Fundamental rights 

The  proposal  takes  full  account  of  the  fundamental  rights  and  principles  recognised  by  the 
Charter of Fundamental Rights of the European Union (“the Charter”).  

The proposed measures comply with Article 7 of the Charter, which protects the fundamental 
right  of  everyone  to  the  respect  for  his  or  her  private  and  family  life,  home  and 
communications, and includes the confidentiality of communications. Moreover, to the extent 
that  the  processing  of  electronic  communications  by  number-independent  interpersonal 
communications  services  for  the  sole  purpose  of  detecting  and  reporting  child  sexual  abuse 
online and removing child sexual abuse material falls into the scope of the derogation created 
by  this  proposal,  the  GDPR,  which  implements  in  secondary  legislation  Article  8(1)  of  the 
Charter,  which  provides  that  everyone  enjoys  the  right  to  the  protection  of  personal  data, 
continues to apply to such processing.  

In addition, the proposal complies with Article 24(2) of the Charter, which provides that, in 
all actions relating to children, whether taken by public authorities or private institutions, the 
child’s best interests must be a primary consideration. It also complies with Articles 1, 3 and 4 
of the Charter, on the rights to human dignity, the right to the integrity of the person and the 
prohibition  of  inhuman  or  degrading  treatment,  respectively,  considering  that  child  sexual 
abuse can (gravely) interfere with these fundamental rights of the children involved. 

Finally, by making it possible, subject to certain appropriate conditions, for providers to take 
voluntary measures to tackle possible misuse of their services, the proposal also takes account 
of their freedom to conduct a business, guaranteed under Article 16 of the Charter.  

4. 

BUDGETARY IMPLICATIONS 

This proposal has no implications for the EU budget. 

5. 

• 

OTHER ELEMENTS 

Implementation plans and monitoring, evaluation and reporting arrangements 

Not applicable 

• 

Detailed explanation of the specific provisions of the proposal 

Article  1  sets  out  the  amendment  to  the  Interim  Regulation  brought  about  by  the  present 
Regulation,  consisting  of  a  limited  extension  of  the  period  of  application  of  the  Interim 
Regulation. That is the sole amendment made to the Interim Regulation. 

Article 2 sets the date for entering into force of the present Regulation. 

EN 

4 

  EN 

2025/0429 (COD) 

Proposal for a 

REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL 

amending Regulation (EU) 2021/1232 as regards the extension of its period of 
application  

(Text with EEA relevance) 

THE EUROPEAN PARLIAMENT AND THE COUNCIL OF THE EUROPEAN UNION, 

Having  regard  to  the  Treaty  on  the  Functioning  of  the  European  Union,  and  in  particular 
Article 16(2), in conjunction with Article 114(1), thereof, 

Having regard to the proposal from the European Commission, 

After transmission of the draft legislative act to the national parliaments, 
Having regard to the opinion of the European Economic and Social Committee11,  

Acting in accordance with the ordinary legislative procedure, 

Whereas: 

(1) 

(2) 

(3) 

11 
12 

13 

Regulation (EU) 2021/1232 of the European Parliament and of the Council12 provides 
for  a  temporary  regime  as  regards  of  the  use  of  technologies  by  certain  providers  of 
publicly available interpersonal communications services for the purpose of combating 
online  child  sexual  abuse,  pending  the  adoption  of  a  long-term  legal  framework 
addressing the prevention of and combating online child sexual abuse (the ‘long-term 
legal  framework’).  That  Regulation,  as  amended  by  Regulation  (EU)  2024/1307, 
applies until 3 April 2026. 

The proposal for a Regulation of the European Parliament and of the Council laying 
down  rules  to  prevent  and  combat  child  sexual  abuse13,  which  the  Commission 
adopted on 11 May 2022,  aims to  provide  the  long-term  legal  framework. However, 
the interinstitutional negotiations on that proposal have not  yet  advanced  sufficiently 
to  be  certain  that  they will  be concluded on time for the long-term  legal  framework, 
including  any  amendments  to  Regulation  (EU)  2021/1232  that  it  may  contain,  to  be 
adopted and start to apply before 4 April 2026. 

It  is  important  that  child  sexual  abuse  online  can  be  combated  effectively,  in 
accordance with the applicable rules of Union law, including the conditions set out in 
Regulation  (EU)  2021/1232,  and  without  interruption,  pending  the  adoption  and 
application of the long-term legal framework.  

[OJ C , , p. .] 
Regulation  (EU)  2021/1232  of  the  European  Parliament  and  of  the  Council  of  14  July  2021  on  a 
temporary  derogation  from  certain  provisions  of  Directive  2002/58/EC  as  regards  the  use  of 
technologies  by  providers  of  number-independent  interpersonal  communications  services  for  the 
processing of personal and other data for the purpose of combating online child sexual abuse (OJ L 274, 
30.7.2021, p. 41, ELI: http://data.europa.eu/eli/reg/2021/1232/oj). 
Proposal for a Regulation of the European Parliament and of the Council laying down rules to prevent 
and combat child sexual abuse, COM/2022/209 final. 

EN 

5 

  EN 

 
(4) 

(5) 

(6) 

Given these circumstances, Regulation (EU) 2021/1232 should be amended to extend 
its period of application for a period of time limited to that which is strictly necessary 
for the long-term legal framework to be adopted and start to apply. 

Considering the need to ensure legal certainty in a timely manner, and considering the 
limited nature of the amendment provided for in this Regulation, namely the extension 
of  its  period  of  application,  it  is  appropriate  to  provide  that  this  Regulation  should 
enter into force as soon as possible. 

The  European  Data  Protection  Supervisor  was  consulted  in  accordance  with  Article 
42(1) of Regulation (EU) 2018/1725 of the European Parliament and of the Council14 
and delivered its opinion on […]. 

(7) 

Regulation (EU) 2021/1232 should therefore be amended accordingly, 

HAVE ADOPTED THIS REGULATION: 

Article 1 

In  Article  10  of  Regulation  (EU)  2021/1232,  the  second  subparagraph  is  replaced  by  the 
following: 

“It shall apply until 3 April 2028”.  

This  Regulation  shall  enter  into  force  on  the  day  following  that  of  its  publication  in  the 
Official Journal of the European Union. 

Article 2 

This Regulation shall be binding in its entirety and directly applicable in all Member States. 

Done at Brussels, 

For the European Parliament 
The President 

For the Council 
The President 

14 

EN 

Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the 
protection of natural persons with regard to the processing of personal data by the Union institutions, 
bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 
45/2001 
39, 
and  Decision  No 
ELI: http://data.europa.eu/eli/reg/2018/1725/oj). 

1247/2002/EC 

21.11.2018, 

295, 

(OJ 

p. 

L 

6 

  EN