CSAM detection is the use of automated technology by online services to identify child sexual abuse material (CSAM) and attempts to solicit children, so that the material can be removed and reported to authorities or designated hotlines. In online safety regulation, the term also covers the legal framework that permits or requires such scanning, including the contested EU proposal widely known as chat control.
The subject combines two goals that are both protected by law: the protection of children from abuse and its continuing circulation, and the confidentiality of private communications. Almost every policy question in this area is about how far the first goal can justify intrusion into the second, particularly in end-to-end encrypted messaging.
How CSAM detection technology works
Detection systems rely on three families of technique with very different accuracy and privacy profiles. The most established is hash matching, which compares a compact fingerprint of each uploaded image or video against databases of material already verified by hotlines and law enforcement. Newer systems add machine-learning classifiers to find previously unseen material and text analysis to spot grooming conversations.
| Technique | What it finds | Error profile |
|---|---|---|
| Cryptographic hashing | Exact copies of known files | Very low false positives, misses any modification |
| Perceptual hashing | Known images after resizing or recompression | Low false positives, some collision risk |
| Image and video classifiers | Previously unknown material | Higher error rates, needs human review |
| Grooming detection in text | Solicitation patterns in conversations | Highest uncertainty, context-dependent |
In a typical workflow, a match triggers human review by trained moderators before any report is filed. Confirmed cases go to a national or international hotline, for example the reporting center that receives reports from US providers, which then forwards them to the competent police authorities.
Where scanning happens and why encryption matters
The point of scanning determines how intrusive detection is. On unencrypted cloud storage or public platforms, the provider can analyze content on its servers. In end-to-end encrypted services, the provider cannot see content, so detection would have to happen on the user’s device before encryption, a technique called client-side scanning.
| Location | Typical service | Main concern |
|---|---|---|
| Public content | Social media posts, forums | Limited, content is already visible |
| Server-side private storage | Unencrypted cloud drives, email | Intrusion into private files |
| Server-side messaging | Unencrypted direct messages | Confidentiality of communications |
| Client-side scanning | Encrypted messengers | Weakens the security model of encryption |
Security researchers argue that client-side scanning creates a general-purpose surveillance capability on every device, which could be repurposed for other content or exploited by attackers. Supporters reply that a narrowly scoped system with audited hash lists can protect children without reading other messages. This disagreement explains much of the legislative deadlock in Europe.
The EU legal framework and chat control
In the European Union, voluntary detection in messaging services is allowed by an interim regulation (Regulation (EU) 2021/1232), which creates a temporary derogation from the confidentiality rules of the ePrivacy Directive. It permits providers to use detection technology under safeguards such as data minimization, human oversight and reporting to authorities, and it has been extended to bridge the gap while permanent rules are negotiated.
In 2022 the Commission proposed a permanent Regulation to prevent and combat child sexual abuse, which critics nicknamed chat control. It foresaw detection orders that could require providers, including encrypted services, to scan for known and new material and for grooming, and it created a dedicated EU center to manage indicators and reports. The European Parliament responded by excluding encrypted communications and limiting orders to targeted cases.
Member States long failed to agree. In late 2025 the Council adopted a position that dropped mandatory detection orders, relied on risk assessment and mitigation duties and made voluntary detection a lasting option. Negotiations with Parliament continued afterward, so the final shape of the permanent regime should be checked against the current legislative status.
Approaches outside the EU
Other jurisdictions balance the same interests differently. The table shows the broad pattern rather than every detail of each law.
| Jurisdiction | Core rule | Detection duty |
|---|---|---|
| European Union | Interim derogation plus pending permanent regulation | Voluntary, with mandatory duties debated |
| United States | Providers must report apparent CSAM they become aware of | No general duty to search |
| United Kingdom | Online Safety Act with regulator codes of practice | Hash matching expected for certain services |
| Australia | Online safety codes and industry standards | Proactive detection for some service types |
Under the UK Online Safety Act, Ofcom may also issue notices requiring the use of accredited technology, a power that encrypted messaging providers have publicly opposed. US law is shaped by the Fourth Amendment, which is one reason the duty is limited to reporting rather than searching.
Limitations, risks and practical safeguards
Even well-designed systems have known weaknesses. Hash lists detect only material that has already been identified, while classifiers produce false positives that can expose innocent users, for example parents sharing medical photos of their children with a doctor. Offenders also migrate to services that do not scan.
- Human review before reporting reduces the impact of false positives.
- Audited, independent indicator lists limit the risk of scope creep.
- Transparency reports disclose volumes, error rates and appeals.
- Data minimization keeps only what is needed for the report.
- Effective appeal routes let wrongly flagged users restore accounts.
Detection is only one layer of child protection. Safety by design, such as default privacy settings for minors, limits on contact by strangers and easy in-app reporting, often prevents harm earlier and with less intrusion.
A plain-language summary
CSAM detection means using software to find images and videos of child sexual abuse on online services so that they can be taken down and reported to police. The simplest method works like a list of known fingerprints: each uploaded photo is compared against fingerprints of material that experts have already confirmed.
The difficult part is private messaging. Scanning private chats, especially encrypted ones, means looking at content that is supposed to stay private. That is why the EU proposal called chat control has caused so much debate about where to draw the line.
An example from practice
A mid-sized European photo-sharing platform runs perceptual hash matching on every public and shared upload. One evening the system flags an image that matches an entry in a hotline’s verified database. The upload is blocked automatically and placed in a restricted queue.
A trained moderator confirms the match within the platform’s review window, the account is suspended, and a report with the minimum required data is sent to the national hotline, which passes it to the police. In the same month the classifier flags several beach holiday photos that turn out to be harmless; reviewers clear them, and the platform records them as false positives in its transparency report. The case shows why human review remains essential.