The EU finds it breached its own privacy rules in a 2023 ad campaign on X that intended to sway opinions for a proposal to force messaging apps to scan for CSAM
The European Union's executive body is facing an embarrassing privacy scandal after it was confirmed on Friday that a Commission ad campaign …
Context & Ripple Effects
The Commission's finding lands in a long-running fight over its proposed CSAM-scanning rules, first outlined in the EU's plan to require tech companies to scan for CSAM. Critics had already argued that the approach threatened encrypted communications and democratic values in a later expert critique of the proposal.
The proposal's political path had also stalled when a Council vote on a draft that would have covered WhatsApp and Signal was removed from the agenda. The privacy finding gives that already contested effort a new credibility problem: its promoter did not meet its own standards while campaigning for it.
First-order effects
- The Commission must account for a privacy-rule breach in its 2023 X advertising campaign, weakening its standing as the sponsor of the CSAM-scanning proposal.
- Opponents of the proposal gain concrete evidence to challenge the Commission's handling of personal-data safeguards, not only the merits of mandated scanning.
Second-order effects
- Debate over the proposal is likely to put greater weight on demonstrable privacy safeguards and oversight, raising the burden on the Commission to show that any enforcement model protects users' data.
- The episode complicates the Commission's posture toward X: it had opened a DSA investigation into X's ad transparency and platform practices, while its own use of the platform has now produced a privacy compliance finding.
Third-order effects
- If privacy compliance failures continue to accompany advocacy for surveillance-oriented rules, institutional credibility may become a material constraint on how the EU advances such measures.
- The dispute illustrates a broader governance challenge: regulators seeking more platform data controls must apply equally rigorous limits to their own targeting and data use.
The trend: The story is one data point in the growing tension between child-safety regulation, encrypted-service oversight, and the accountability of the institutions advocating those powers.