Internet providers must detect child sex abuse risk under pain of EU fines

Internet providers will have to assess whether there is a significant risk of their services being misused for online child sexual abuse or to solicit children, and then take measures to mitigate these risks, under proposed rules in the EU.

MEPs will be voting on a proposition for new measures that will protect children online by preventing and stopping child sexual abuse.

The proposal is that services targeting children should require by default user consent for unsolicited messages, have blocking and muting options, and boost parental controls.

These include mitigation measures that will be targeted, as well as rules for pornographic sites to have adequate age verification systems, flagging mechanisms for child sexual abuse material and human content moderation to process these reports.

A draft Parliament position has already been adopted by the European Parliament’s civil liberties and home affairs (LIBE) committee, but the position still needs to be endorsed by the plenary.

“To meet this compelling challenge effectively, we have found a legally sound compromise supported by all political groups,” Spanish rapporteur Javier Zarzalejos (EPP) said. “It will create uniform rules to fight the sexual abuse of children online, meaning that all providers will have to assess if there is a risk of abuse in their services and mitigate those with tailor-made measures. As a last resort, detection orders can be used to take down abusive material still circulating on the internet. This agreement strikes a balance between protecting children and protecting privacy.”

The draft law avoids mass surveillance or generalised monitoring of the internet, by allowing judicial authorities to authorise time-limited orders, as a last resort, to detect any child sexual abuse material, and take it down or disable access to it, if mitigation measures are not effective in taking it down.

The law also says there must be “reasonable grounds of suspicion” for such detection orders on individuals or groups, including subscribers to a channel linked to child sexual abuse.

End-to-end encryption has been excluded from the scope of the detection orders to guarantee that all users’ communications are secure and confidential.

The law would also set up an EU Centre for Child Protection to help implement the new rules and support internet providers in detecting child sexual abuse by collecting reports and sending them to competent national authorities and Europol. The Centre will also develop detection technologies for providers and maintain a database of hashes and other technical indicators of child sexual abuse material identified by national authorities.

The Centre would also support national authorities as they enforce the new child sexual abuse rulebook, conduct investigations and levy fines of up to 6% of worldwide turnover for non-compliance.

MEPs finally proposed to create a new Victim’s Rights and Survivors Consultative Forum to make sure that victims’ voices are heard.