Europe Can Protect Children Online Without Surveillance or Age Bans

For years, Europe has argued about how best to keep children safe online. The fight has come down to two options: scan their messages or lock them out of many platforms until they're older. There is a third way, one that protects children without watching them. Yet Europe has never defined, in any testable way, what a "safe" platform for children actually looks like.

The first proposed Child Sexual Abuse Regulation ("Chat Control" to its critics) would have obliged platforms to reach inside private messages, issuing detection orders for child sexual abuse material (CSAM), and for the solicitation of children (i.e. grooming). To reach inside end-to-end encrypted messages, detection has to happen on the device itself, before the message is encrypted, a technique known as client-side scanning, and security researchers have said repeatedly that there is no way to build a backdoor that only good people can walk through.

The proposal has been blocked, revived, and blocked again, and steadily watered down: the compromise texts going into the final trilogue had narrowed detection back toward hash-matching (comparing files against a database of abuse images) for known material on unencrypted servers. Mandatory scanning has been blocked, for now, and there’s still no agreement on what should replace it. Meanwhile, the separate temporary derogation allowed platforms to scan voluntarily expired in April 2026. Though that expiry may not stick. The council has since moved to reinstate it, and Parliament will vote again soon, this time under different rules that will make it easier to be approved.

The second option is to ban. Denmark is legislating a social-media age limit for under-15s; the UK has announced a ban for under-16s; and others are following. The intent is right. But the mechanism is blunt. We already have a preview of how it goes: when the UK switched on age-verification rules for adult content in 2025, VPN downloads surged — one provider reported a 1,800 percent jump in the first month. If a determined 13-year-old can defeat an age gate with a free app, a ban that depends on the same technology can be evaded the same way.

Both fixes assume someone must watch the child

Both options are usually fought as separate battles: one over how to tackle abuse, the other over whether young children belong on social platforms at all. They are not the same problem, but they rest on the same hidden assumption: that protecting a child requires someone — an adult, a server, a regulator, a parent — to see what the child is doing. Scanning watches everything. Bans check who you are before they let you in. Neither asks whether protection could happen without surveillance at all.

It can. The technology to detect grooming as a conversation unfolds can run on the child's own device — flagging a risk pattern locally and surfacing a calm, age-appropriate intervention in the moment, with no message content, metadata or signal ever leaving the phone. There is no database to breach, no cache of data to subpoena or repurpose and no encryption to break because nothing is transmitted.

Two key objections that security researchers raise against client-side scanning are that whoever controls the on-device match list — the set of things each phone is told to look for — controls what every phone searches for, and that the moment a detection signal leaves the device, you have enabled surveillance on the phone.

A third way answers the second objection outright: the signal stays on the device and nothing is transmitted onward. It changes the shape of the first, too — the model looks for conversational risk rather than matching against a centrally controlled list of targets. But it does not make that first concern vanish: any detection model has to be trained and, over time, updated, and whoever controls those updates still has a say in what the phone looks for. The answer to that cannot be "trust the vendor." Instead, the model, and every update to it, must be auditable and certified against an open standard, so that the thing running on a child's phone can be independently checked and cannot be quietly re-pointed at something else.

A prompt can protect without reporting

The obvious objection is that a system that flags a risk, but does not report it, cannot deliver safety. But that assumes that the only protective act is escalation to an adult. Behavioral evidence points the other way: a timely, well-designed prompt at the moment of risk can change what people, including adolescents, do next. The research behind the anti-cyberbullying tool ReThink found that when teens were prompted to reconsider before sending a hurtful message, adolescents changed their minds 93 percent of the time and decided not to post it. While ReThink measures how to get a child to reconsider a message they are about to send, not warning them they are being targeted by an adult, the transferable finding is the mechanism: a prompt delivered at the decisive moment reliably changes what the child does next.

There are two different functions at play, and it helps to keep them apart. Detection-and-reporting is a platform-level legal duty: where the law requires it, the platform detects the material and reports it to the authorities. On-device intervention is not that. It does not detect an illegal artifact and route it to anyone; it recognizes a risk pattern in a live conversation and surfaces a prompt to the child. The two can coexist: any legal duty to detect and report CSAM continues to sit at the platform level, where it already does. On-device intervention adds a different layer — the live conversation before the harm is done. The grooming-specific evidence base is still young, which is precisely why it should be built in the open and measured against a standard, not asserted behind a marketing claim.

There is another issue that on-device prompts resolve: proposed solutions that would escalate potential solicitation to a parent or guardian assume that the adult in the loop is safe, present, attentive and on the child’s side. For many children, that assumption simply does not hold. Child sexual abuse is frequently committed by someone the child knows, inside his or her own circle of trust. Childlight's 2025 Into the Light Index, one of the most comprehensive studies to date, found that, in the countries where this is measured, around one in 13 children experience sexual abuse by a family member and that relatives accounted for more than 55 percent of assessed CSAM, with fathers estimated to have produced over 900,000 images globally in 2024. Even when the adult is not a threat, they may be absent, unaware, or ill-equipped to act. A safety model that escalates to a parent assumes a parent who is watching and capable. This is not to say an on-device prompt reaches every child — contact abuse in the home is a different problem — but it is why 'escalate to the nearest adult' cannot be the default safety architecture.

When we build systems like this, we need shared, testable definitions of what a well-designed intervention actually is. It should not be left to each vendor's judgment. At a minimum, it means an intervention that changes what the child does in the moment, which the evidence on timely prompts suggests it can. It must also do the opposite of harm: it must not frighten the child, must not teach them more about the threat than they need to know and must never make them feel they have done something wrong or that acting will get them or someone they love into trouble. That fear is precisely what keeps children silent — and an intervention that surfaces only to the child removes it. This also flips the usual problem of false positives. A scanning system must be near-perfect, because its mistakes fall on the accused; an on-device prompt can afford to err on the side of caution, because the worst case is a calm nudge shown to a child who was never at risk and can simply ignore it. This does not soften the privacy-versus-protection trade-off. It dissolves it.

No one has defined what makes a platform “safe” for children

It’s critical to note that a technique that has the potential to protect children without compromising encryption is not a guarantee. On its own, "we run an on-device safeguard" is just one more feature a company can claim protects children, and that no one can independently check. The platform could ship a weak version, or none, and from the outside, you could not tell. That is the crux of my argument’s second half: whether an on-device protection genuinely stays on the device, reports to no one, and actually works cannot rest on the platform's word. It has to be something an independent body can test against a shared standard and withdraw when it fails.

Which brings me to the deeper failure beneath Europe’s deadlock. Every instrument it has produced — the Digital Services Act, the AI Act, the GDPR, the UK's Age Appropriate Design Code, the new age-verification recommendation — mandates that platforms protect children. Not one of them defines, in testable terms, what "protected" means. So when a platform says "we comply" or "we keep children safe," there is no shared, independent way to check whether that is true.

The cost of that absence is clearest in the one corner of this problem where we actually have hard numbers — the detection and reporting of CSAM. In 2023, Google filed roughly 1.47 million reports to the US National Center for Missing & Exploited Children; Apple filed 267. That 5,000-fold gap is not a measure of how much abuse occurs on each service. It is a measure of how hard each chose to look. When detection is voluntary and undefined, "we found nothing" and "we never looked" are indistinguishable from the outside — and children pay the price.

We need an open standard of what a safe-for-children service actually does

That is why we need a standard: an open, auditable definition of what a safe-for-children service actually does, control by control, that an independent third party can certify against — the way we certify food hygiene, payment security, or building fire safety. Not a logo a company awards itself, but a verifiable claim someone else can check and, when it fails, withdraw.

Put the two together — detection that runs where the conversation is, and a standard that makes "safe" checkable, and you no longer have to choose between a child's safety and a child's privacy, because protection no longer requires surveillance. You no longer have to choose between a ban and a free-for-all, because "appropriate measures" stops being a phrase lawyers argue over and becomes a list an auditor can tick.

Europe is writing its next chapter on this right now. The Commission's call for evidence on a new action plan to protect children from crime has just closed, and negotiators have concluded what may be the final trilogue on the CSA Regulation, with a political deal expected within weeks if not days (and perhaps already struck by the time you read this). The instinct in both will be to reach, again, for the two familiar levers — scan harder or ban younger. But Europe should ask a different question. Not "how much should we surveil children to keep them safe?" and not "at what age should we lock them out?" — but rather "why are we still accepting *trust us* from the platforms, when we could simply require them to prove they are safe, without watching a single child?" The third way has been there the whole time. We have been too busy fighting over the first two to build it.

Disclosure: Custorian is non-commercial and takes no funding from the technology platforms its standards cover. It has a direct interest in the standards work and intervention research described herein.