Encrypted messaging apps and CSAM: provider obligations in the EU in 2026

Key data

Providers of encrypted messaging apps operating in the European Union have new legal obligations as of July 24, 2026. Regulation (EU) 2026/1881 establishes a temporary exception to the ePrivacy Directive (2002/58/EC) to allow the processing of personal data and content with a specific objective: to detect, report and remove material of child sexual abuse online (CSAM, by its English acronym).

The measure is not indefinite. It responds to the need to maintain operational detection tools while permanent regulation is negotiated at the European level. But while it is in force, non-compliance exposes providers to significant legal and reputational consequences.

What does this regulation establish?

The ePrivacy Directive (2002/58/EC) protects the confidentiality of electronic communications, which in practice prevents messaging providers from analyzing message content. Regulation (EU) 2026/1881 opens a temporary and limited exception to that protection, exclusively for the fight against CSAM.

The key elements established by the regulation are:

• Authorization to process personal data and content for the specific purpose of detecting, reporting and removing material of child sexual abuse online.
• Exclusive application to providers of interpersonal communications services independent of numbering — that is, messaging apps that do not use traditional telephone numbering (such as WhatsApp, Signal, Telegram or similar).
• Obligation to implement detection mechanisms under strict guarantees of data protection and fundamental rights.
• Temporary nature: the regulation has an expiration date and will be replaced by permanent legislation once the ongoing European legislative process concludes.
• Notification protocols to authorities: providers must establish procedures to communicate detected cases to the competent authorities.

Economic and operational impact

The impact is not only legal: it is operational and technological. Affected providers must assume real adaptation costs in several dimensions:

• Development or integration of CSAM detection technology compatible with encrypted messaging environments, respecting the safeguards required by the Regulation.
• Review and update of privacy policies to reflect the new legal basis for data processing enabled by the temporary exception.
• Adaptation of processing activity records (PAR) required by the GDPR to include this new processing.
• Design of internal notification protocols to competent authorities when CSAM is detected.
• Data protection impact assessment (DPIA): given that this is high-risk data processing, it is foreseeable that it will be mandatory.
• Medium-term planning: being a temporary regulation, companies must anticipate adaptation to the permanent regulation that will replace it.

Who does it affect?

• Providers of encrypted messaging apps operating in the EU: WhatsApp, Signal, Telegram, and any equivalent service.
• Technology companies that offer interpersonal communications services independent of numbering as part of their product (corporate chats, collaboration platforms with integrated messaging).
• European startups and scale-ups in the digital communications sector that have developed messaging products.
• Data Protection Officers (DPO) of any organization operating this type of service: they must lead the adaptation.
• Legal and compliance teams of technology providers with presence in the EU, regardless of where they are headquartered.

It does not affect companies that only use messaging apps as an internal tool (employees using WhatsApp to communicate). The obligation falls on the providers of the service, not on its corporate users.

Practical example

A European company that has developed an encrypted messaging app for corporate use and has users in several EU countries falls within the scope of Regulation 2026/1881.

Until now, its privacy policy established that the content of messages was completely private and was not analyzed under any circumstances, supported by the ePrivacy Directive. With the entry into force of the Regulation, this company must:

1. Update its privacy policy to reflect that, exceptionally and under the safeguards of the Regulation, message content can be processed for the purpose of detecting CSAM.
2. Implement or contract a certified CSAM detection technology solution compatible with its encrypted architecture.
3. Establish an internal protocol that defines what to do when a case is detected: who notifies, which authority, in what timeframe.
4. Update its Processing Activity Record and assess whether a Data Protection Impact Assessment is necessary.
5. Monitor the progress of permanent regulation to anticipate the next round of adaptations.

What should companies do now?

1. Verify if you are an affected provider: check if your service fits the definition of "interpersonal communications service independent of numbering". If you offer encrypted messaging to users in the EU, you probably do.
2. Review and update the privacy policy: it must reflect the new legal basis for processing enabled by Regulation 2026/1881 for CSAM detection.
3. Update the Processing Activity Record (PAR): include the new data processing with its purpose, legal basis, data categories and recipients (authorities).
4. Conduct or update the Data Protection Impact Assessment (DPIA): given the high risk of processing, it is a recommended compliance measure and possibly mandatory.
5. Design the notification protocol to authorities: define the internal procedure for communicating detected CSAM cases to the competent authorities of each Member State.
6. Evaluate CSAM detection technology solutions: identify tools compatible with the encrypted architecture of the service and that comply with the safeguards required by the Regulation.
7. Plan the transition to permanent regulation: the regulation is temporary; anticipating the changes that permanent legislation will bring will avoid a second round of urgent adaptations.

Official source

Consult the complete regulation in official source

Disclaimer: This article is for informational purposes only and does not constitute legal advice. For specific decisions, consult a qualified professional. Source: https://eur-lex.europa.eu/./legal-content/AUTO/?uri=OJ:L_202601881