I think, but mostly hope, that this client side scanning initiative will fall apart. Not just because it's an obvious destruction of civil liberties for us in the EU, but also because it's doomed to fail even if implemented. The underlying concept is ineffective at dealing with CSAM, or any kind of adversarial user scenario. Unfortunately my hopes have a bad legislative record.

Clients aren't trustworthy. Ignoring the myriad services that exist, and will come to exist, which just never implement this -- there will be (somewhat) easily accessible versions of apps that remove such telemetry. E.g. VScode is to VScodium as WhatsApp is to WhatsAppium.

Imagine the spoofing opportunities. Message someone, get their client ID, report that client detected all the worst CSAM imaginable.

Think of the false positives. Think of the expense. Think of the children. Think of the children whose non-abusive parents send banal but confounding photos to each other, get hounded by CSAM allegations, and some fraction of whom get separated from their child.

Passing this will be a huge expense of time all of these legislators could use better. Implementing these directives will be a huge expense of money and knowhow to build a flawed and exploitable system. Enforcing the consequences will have untold amounts of suffering unrelated to CSAM. And likely after the first few creeps are caught, the adversarial actors will just start using other channels.

But by that point the conversation will have shifted to clientside scanning of thoughts...