Google Ireland Transparency Report Under Regulations (EU) 2021/1232 and (EU) 2024/2916 Regulation (EU) 2021/1232, as amended by Regulation (EU) 2024/1307, introduced a temporary derogation from certain provisions of Directive 2002/58/EC as regards the use of technologies by providers of number-independent interpersonal communications services (“ NI-ICS ”) for the processing of personal and other data for the purpose of combating online child sexual abuse (the “ Regulation ”). The providers of NI-ICS services must use the standard form set out in the Annex to Regulation (EU) 2024/2916 when publishing and submitting to the competent supervisory authority and to the European Commission an annual report on the processing of personal data under Article 3(1), point (g), subpoint (vii), of Regulation (EU) 2021/1232. This report provides information on the processing of personal data for the purpose of detecting and removing online child sexual abuse and reporting it to the National Center for Missing and Exploited Children (“ NCMEC ”) for the NI-ICS in scope of the Regulation within the European Union (“ EU ”). Published: January 30, 2026 Transparency Report Under Regulations (EU) 2021/1232 and (EU) 2024/2916 Overview Google is committed to fighting online child sexual abuse. Child sexual abuse material (“ CSAM ”) is illegal and our Terms of Service prohibit using any of Google’s platforms or services to store or share this content. Our teams work around-the-clock to identify, remove, and report this content, using a combination of industry-leading automated detection tools and specially-trained human reviewers. We report CSAM to NCMEC, the clearinghouse and comprehensive reporting center in the United States for matters related to child exploitation. NCMEC may send those reports to law enforcement agencies around the world. For more information on Google’s global efforts to combat CSAM, please see Google’s CSAM Transparency Report , accompanying FAQs , blog and policy resources . Additionally, Google’s Protecting Children site outlines our broader efforts to detect, prevent, and remove online child sexual abuse from Google’s services. Introduction This report describes Google Ireland Limited (“GIL”) efforts and resources to detect online child sexual abuse through automated technologies deployed in our NI-ICS provided by GIL that are in scope of the Regulation as it pertains to users in the EU. This report relates to a technology deployed for the purpose of proactively detecting known CSAM. This technology is called “hash matching.” The technology functions by generating unique digital fingerprints of visual images and comparing them to the secure database of previously identified CSAM hashes. Importantly, this technology is engineered to avoid accessing the actual content of communications. It solely compares the digital fingerprints. Our hash matching technology is aligned with Article 3(1)(b) of the Regulation. Unknown CSAM, solicitation and grooming in NI-ICS provided by GIL that are in scope of the Regulation are not proactively detected using this technology, thus we do not provide data on proactive detection using this technology for these categories of content. This report captures information for the period from January 1, 2025 to December 31, 2025, and is published on an annual basis. The numbers below cover the consumer version of Google Chat and Gmail for the relevant time period for EU users. The table in the report contains responsive information in accordance with the standard form issued November 26, 2024 by the European Commission implementing Regulation 2024/2916. Category according to Article 3(1)(g)(vii) of Regulation (EU) 2021/1232 Subcategory Description Response 1) the type and volumes of data processed Specific number-independent interpersonal communications service concerned Gmail Google Chat Metadata related to the users who are parts of the online exchange i.e. any data related to the users who are parts of the online exchange and their accounts that is not content data. Yes/no. If yes, specify all types of data processed (e.g. user name, user identification number, IP address, Internet protocol, network port number, location, etc.) and the volume Yes. To effectively combat this abhorrent material on our platforms, Google may need to process data related to the account responsible for the content, metadata related to the content, and data related to a potential victim. Google processes (and shares with NCMEC) the categories of metadata set out in the CyberTipline Reporting API Technical Documentation . During this reporting period, and specifically with regard to volumes of data processed under this Regulation, Google identified and reported 1525 pieces of content associated with 388 CyberTipline reports and 357 Google accounts for the NC-ICS in scope of the Regulation within the EU. Content data of the online exchange Yes/no. If yes, specify the below Yes. Google may process images, videos, and other media types where people could generate CSAM. Number of images processed 1 in relation to EU users 1511 Number of images processed in relation to non-EU users 2 11 Number of videos processed in relation to EU users 95 Number of videos processed in relation to non-EU users 2 0 Number of other files processed in relation to EU users If yes, specify what type of files (e.g. pdfs, documents, gifs, audio files) 4; text files. Number of other files processed in relation to non-EU users 2 If yes, specify what type of files (e.g. pdfs, documents, gifs, audio files) 0 2 GIL is the service provider for all Gmail and Chat users in the entire European Economic Area ( EEA ) and Switzerland. Therefore these numbers relate to users in the three non-EU EEA member states and Switzerland. GIL is not the relevant service provider for any other non-EU users. 1 We interpret “processed” as meaning that known CSAM is detected. Number of bytes of text processed for detection of solicitation of children in relation to EU users Google does not use text classifiers in its NI-ICS. Number of bytes of text processed for detection of solicitation of children in relation to non-EU users N/A Other information of relevance to the types and volumes of data processed N/A 2) the specific ground relied on for the processing pursuant to Regulation (EU) 2016/679 Where the claimed legal ground is Article 6(1)(c) or (e) GDPR, please indicate which Union or national law is relied upon pursuant to Article 6(3) GDPR. When Google processes personal data under the Regulation for the purpose of detecting and combating online child sexual abuse, it does so on the GDPR grounds that the processing is necessary in order to protect the vital interests of children and those who are the victims of online child sexual abuse (Article 6(1)(d)). In addition, that processing is necessary for the purposes of the legitimate interests of Google to detect, prevent or otherwise address online child sexual abuse on Google’s services, and to protect Google users, customers, partners, and the public from this egregious form of illegal content. The processing is also necessary for the purposes of the legitimate interests of victims of child sexual abuse and the organization to whom Google reports online child sexual abuse (NCMEC) to detect, prevent and remove online child sexual abuse from Google’s services (Article 6(1)(f)). 3) the ground relied on for transfers of personal data outside the Union pursuant to Chapter V of Regulation (EU) 2016/679, where applicable Please specify in what type of cases a transfer outside the Union has taken place and for which purpose, and which legal grounds for transfer have been applied under Chapter V of the GDPR. Google maintains servers around the world and information collected and processed by GIL to provide services to users in the EU may be processed on and moved between Google servers located outside the European Union to optimize performance and reliability and to safeguard the integrity and availability of user data. Additionally, as noted at the end of the report, Google reports apparent child sexual abuse to NCMEC. Where Google transfers personal data outside the European Union (including through storage on its global servers), it relies on adequacy decisions under Article 45 GDPR, for example, that such transfers are lawful on the basis of the EU-US Data Privacy Framework (DPF) (under which Google is certified) or another adequacy decision (where relevant). Where an adequacy decision is not available, Google relies on safeguards under Article 46 GDPR in the form of Standard Contractual Clauses . Please see more details in the Data transfer section of the Google Privacy Policy . 4) the number of cases of online child sexual abuse identified Known CSAM Number of reports concerning known CSAM in relation to EU users Known CSAM refers to material that has been confirmed as constituting online child sexual abuse material 380 Number of images of known CSAM reported in relation to EU users 1419 Number of videos of known CSAM reported in relation to EU users 92 Number of other files of known CSAM reported in relation to EU users If yes, specify what type of files 0 Number of user accounts in the EU reported as sending at least one content item of known CSAM N/A Number of user accounts in the EU reported as receiving at least one content item of known CSAM N/A New CSAM Number of reports concerning possible new CSAM in relation to EU users Possible new CSAM refers to reported files other than known CSAM N/A. Please refer to our comments in relation to unknown CSAM, solicitation and grooming in the "Introduction" section. Number of images of possible new CSAM reported in relation to EU users N/A. Please refer to our comments in relation to unknown CSAM, solicitation and grooming in the "Introduction" section. Number of videos of possible new CSAM reported in relation to EU users N/A. Please refer to our comments in relation to unknown CSAM, solicitation and grooming in the "Introduction" section. Number of other files of possible new CSAM reported in relation to EU users If yes, specify what type of files N/A. Please refer to our comments in relation to unknown CSAM, solicitation and grooming in the "Introduction" section. Number of user accounts in the EU reported as sending at least one content item of possible new CSAM N/A. Please refer to our comments in relation to unknown CSAM, solicitation and grooming in the "Introduction" section. Number of user accounts in the EU reported as receiving at least one content item of possible new CSAM N/A. Please refer to our comments in relation to unknown CSAM, solicitation and grooming in the "Introduction" section. Solicitation Number of reports of possible solicitation of children in relation to EU users N/A. Please refer to our comments in relation to unknown CSAM, solicitation and grooming in the "Introduction" section. Number of user accounts in the EU reported as possibly soliciting a child N/A. Please refer to our comments in relation to unknown CSAM, solicitation and grooming in the "Introduction" section. Number of user accounts reported as possibly soliciting a child in the EU N/A. Please refer to our comments in relation to unknown CSAM, solicitation and grooming in the "Introduction" section. 5) the number of cases in which a user has lodged a complaint with the internal redress mechanism or with a judicial authority and the outcome of such complaints Known CSAM Number of content items removed as constituting known CSAM Content items 483 Number of complaints lodged with the internal mechanism against the removal of the content item for constituting known CSAM 0 complaints lodged with the internal mechanism against the removal of the content item for constituting known CSAM. Reasons for the complaints lodged with the internal mechanism against the removal of the content item for constituting known CSAM (optional) - Number of content items removed as constituting known CSAM that were restored after review following a complaint lodged with the internal mechanism In this scenario, if a user appeal of an account restriction is successful the content at issue is made available to the user for download. During this reporting period, 6 instances occurred where an initial verdict was overturned upon review, and content was made available for user download. Average time needed to take the decision to restore or keep the removal of items initially removed as constituting known CSAM, following a complaint lodged with the internal mechanism (optional) - Number of complaints lodged with the judicial authority against the removal of the content item for constituting known CSAM 0 user accounts lodged a complaint with a judicial authority based on detection within the services in scope of the Regulation within the EU. Reasons for the complaints lodged with the judicial authority against the removal of the content item for constituting known CSAM (optional) - Number of content items removed as constituting known CSAM that were restored after review following a complaint lodged with the judicial authority 0 content items were restored following review of complaints lodged by the above user accounts with a judicial authority based on detection within the services in scope of the Regulation within the EU. Average time needed to comply with the judicial decision to restore or keep the removal of items initially removed as constituting known CSAM, following a complaint lodged with the judicial authority (optional) - Number of user accounts in the EU suspended for having shared known CSAM User accounts in the EU 114 user accounts in the EU were suspended for attempting to share known CSAM. Number of complaints lodged with the internal mechanism against the suspension of the user account in the EU for having shared known CSAM 254 complaints were lodged with the internal mechanism against the suspension of the user account in the EU for attempting to share known CSAM. Reasons for the complaints lodged with the internal mechanism against the suspension of the user account in the EU for having shared known CSAM (optional) - Number of user accounts in the EU suspended for having shared known CSAM that were restored after review following a complaint lodged with the internal mechanism 7. In these cases, reinstatement was not only due to an error in detection or a content-level false positive, but also based on contextual information identified during the appeal process, which indicated that the content was correctly identified but did not appear to be possessed or shared with intent to harm, abuse, or exploit children. Average time needed to take the decision to restore or keep the suspension of the user accounts in the EU initially suspended as having shared known CSAM, following a complaint lodged with the internal mechanism (optional) - Number of complaints lodged with the judicial authority against the suspension of the user account in the EU for having shared known CSAM 0 user accounts lodged a complaint with a judicial authority based on detection within the services in scope of the Regulation within the EU. Reasons for the complaints lodged with the judicial authority against the suspension of the user account in the EU for having shared known CSAM (optional) - Number of user accounts in the EU suspended for having shared known CSAM that were restored after review following a complaint lodged with the judicial authority 0 user accounts were restored following review of complaints lodged by the above user accounts with a judicial authority based on detection within the services in scope of the Regulation within the EU. Average time needed to comply with the judicial decision to restore or keep the suspension of the user accounts in the EU initially suspended as having shared known CSAM, following a complaint lodged with the judicial authority (optional) - New CSAM Number of content items removed as constituting possible new CSAM Content items N/A. Please refer to our comments in relation to unknown CSAM, solicitation and grooming in the "Introduction" section. Number of complaints lodged with the internal mechanism against the removal of the content item for constituting possible new CSAM N/A. Please refer to our comments in relation to unknown CSAM, solicitation and grooming in the "Introduction" section. Reasons for the complaints lodged with the internal mechanism against the removal of the content item for constituting possible new CSAM (optional) - Number of content items removed as constituting possible new CSAM that were restored after review following a complaint lodged with the internal mechanism N/A. Please refer to our comments in relation to unknown CSAM, solicitation and grooming in the "Introduction" section. Average time needed to take the decision to restore or keep the removal of items initially removed as constituting possible new CSAM, following a complaint lodged with the internal mechanism (optional) - Number of complaints lodged with the judicial authority against the removal of the content item for constituting possible new CSAM N/A. Please refer to our comments in relation to unknown CSAM, solicitation and grooming in the "Introduction" section. Reasons for the complaints lodged with the judicial authority against the removal of the content item for constituting possible new CSAM (optional) - Number of content items removed as constituting possible new CSAM that were restored after review following a complaint lodged with the judicial authority N/A. Please refer to our comments in relation to unknown CSAM, solicitation and grooming in the "Introduction" section. Average time needed to comply with the judicial decision to restore or keep the removal of items initially removed as constituting possible new CSAM, following a complaint lodged with the judicial authority (optional) - Number of user accounts in the EU suspended for having shared possible new CSAM User accounts in the EU N/A. Please refer to our comments in relation to unknown CSAM, solicitation and grooming in the "Introduction" section. Number of complaints lodged with the internal mechanism against the suspension of the user account in the EU for having shared possible new CSAM N/A. Please refer to our comments in relation to unknown CSAM, solicitation and grooming in the "Introduction" section. Reasons for the complaints lodged with the internal mechanism against the suspension of the user account in the EU for having shared possible new CSAM (optional) - Number of user accounts in the EU suspended for having shared possible new CSAM that were restored after review following a complaint lodged with the internal mechanism N/A. Please refer to our comments in relation to unknown CSAM, solicitation and grooming in the "Introduction" section. Average time needed to take the decision to restore or keep the suspension of the user accounts in the EU initially suspended as having shared possible new CSAM, following a complaint lodged with the internal mechanism (optional) - Number of complaints lodged with the judicial authority against the suspension of the user account in the EU for having shared possible new CSAM N/A. Please refer to our comments in relation to unknown CSAM, solicitation and grooming in the "Introduction" section. Reasons for the complaints lodged with the judicial authority against the suspension of the user account in the EU for having shared possible new CSAM (optional) - Number of user accounts in the EU suspended for having shared possible new CSAM that were restored after review following a complaint lodged with the judicial authority N/A. Please refer to our comments in relation to unknown CSAM, solicitation and grooming in the "Introduction" section. Average time needed to comply with the judicial decision to restore or keep the suspension of the user accounts in the EU initially suspended as having shared possible new CSAM, following a complaint lodged with the judicial authority (optional) - Solicitation Number of user accounts in the EU suspended for having solicited a child User accounts in the EU N/A. Please refer to our comments in relation to unknown CSAM, solicitation and grooming in the "Introduction" section. Number of complaints lodged with the internal mechanism against the suspension of the user account in the EU for having solicited a child N/A. Please refer to our comments in relation to unknown CSAM, solicitation and grooming in the "Introduction" section. Reasons for the complaints lodged with the internal mechanism against the suspension of the user account in the EU for having solicited a child (optional) - Number of user accounts in the EU suspended for having solicited a child that were restored after review following a complaint lodged with the internal mechanism N/A. Please refer to our comments in relation to unknown CSAM, solicitation and grooming in the "Introduction" section. Average time needed to take the decision to restore or keep the suspension of the user account in the EU initially suspended for having solicited a child, following a complaint lodged with the internal mechanism (optional) - Number of complaints lodged with the judicial authority against the suspension of the user account in the EU for soliciting a child N/A. Please refer to our comments in relation to unknown CSAM, solicitation and grooming in the "Introduction" section. Reasons for the complaints lodged with the judicial authority against the suspension of the user account in the EU for having solicited a child (optional) - Number of user accounts in the EU suspended for having solicited a child that were restored after review following a complaint lodged with the judicial authority N/A. Please refer to our comments in relation to unknown CSAM, solicitation and grooming in the "Introduction" section. Average time needed to comply with the judicial decision to restore or keep the suspension of the user account in the EU initially suspended for having solicited a child, following a complaint lodged with the judicial authority (optional) - 6) the numbers and ratios of errors (false positives) of the different technologies used Error rate: number of pieces of content flagged automatically as possible online CSA which are not online CSA upon human review, divided by the number of pieces of content flagged automatically as possible online CSA Please specify for each of the different technologies used. Known CSAM A1: Number of content items automatically flagged as constituting known CSAM 1604 B1: Number of content items automatically flagged as constituting known CSAM which are not known CSAM upon human review N/A Error rate: B1/A1 (%) 0 C1: Number of content items automatically flagged as constituting known CSAM that are subject to human review 335 Other relevant findings N/A New CSAM A2: Number of content items automatically flagged as constituting new CSAM N/A. Please refer to our comments in relation to unknown CSAM, solicitation and grooming in the "Introduction" section. B2: Number of content items automatically flagged as constituting new CSAM which are not CSAM upon human review N/A. Please refer to our comments in relation to unknown CSAM, solicitation and grooming in the "Introduction" section. Error rate: B2/A2 (%) N/A. Please refer to our comments in relation to unknown CSAM, solicitation and grooming in the "Introduction" section. C2: Number of content items automatically flagged as constituting new CSAM that are subject to human review N/A. Please refer to our comments in relation to unknown CSAM, solicitation and grooming in the "Introduction" section. Other relevant findings N/A Solicitation A3: Number of user accounts in the EU automatically flagged as either having solicited a child or being solicited as a child N/A. Please refer to our comments in relation to unknown CSAM, solicitation and grooming in the "Introduction" section. B3: Number of user accounts in the EU automatically flagged as either having solicited a child or being solicited as a child which were not involved in solicitation upon human review N/A. Please refer to our comments in relation to unknown CSAM, solicitation and grooming in the "Introduction" section. Error rate: B3/A3 (%) N/A. Please refer to our comments in relation to unknown CSAM, solicitation and grooming in the "Introduction" section. C3: Number of user accounts in the EU automatically flagged as either having solicited a child or being solicited as a child that are subject to human review N/A. Please refer to our comments in relation to unknown CSAM, solicitation and grooming in the "Introduction" section. Other relevant findings N/A 7) the measures applied to limit the error rate and the error rate achieved Known CSAM Measures to check the quality of existing hashes (please specify) Indicators (e.g. hashes) Google ascertains hash quality by evaluating the frequency of prior encounters and manual review verdict(s). Measures to vet hashes before they are added to the database (please specify) Google obtains hashes of known CSAM from a variety of trusted sources, including: Internet Watch Foundation (IWF), NCMEC; and others, including content we find on our platforms and subsequently hash. These unverified hashes undergo manual review and once confirmed as CSAM, they are added to our detection systems. Other measures to limit the error rate through actions on the hashes (please specify) Google also applies high quality hash detection to limit the error rate. Implementation plan vetted by independent third party Implementation of the detection technology N/A Other measures to limit the error rates through actions on the deployment of the detection technology (please specify) To control error rates, the system applies several key mechanisms including (i) strict thresholds on the hash quality to limit errors, and (ii) hash confidence rules to direct uncertain matches for additional manual review. Systematic human review of every content item flagged as known CSAM prior to reporting Human review While Google does not manually review every instance of known CSAM prior to reporting, our process ensures that every report is backed by human verification. Reporting is automated only for content that matches a hash previously confirmed as CSAM by a manual reviewer. Human review of sample content items flagged as known CSAM prior to reporting Google conducts manual sampling of automated verdicts to ascertain the verdict's quality prior to reporting to NCMEC. Training policies of human reviewers (please specify, e.g. the type and duration of training before start working, the periodicity and type of refresh trainings, etc.) Sensitive content reviewers are offered subject matter specific training on a variety of topics. Those working with sensitive content are required to complete an onboarding training on the psychological impact of sensitive content, and managers are required to complete an additional training on ways to support their teams who work with sensitive content. Additional optional mental health training opportunities are also offered in order to provide a deeper dive into the unique challenges faced by each team. Measures to ensure periodic quality control assessments of human reviewers and the verdicts that are applied (please specify) Google undertakes weekly quality audits, employing a standard quality framework to assess the quality of the verdict applied by the human reviewers. Quality metrics are monitored and reported as precision and recall on a monthly basis and metrics going below an agreed target (e.g. 95%) triggers root cause analysis and corrective actions. Measures to ensure feedback from NCMEC and/or from other organisations acting in the public interest against child sexual abuse (please specify) Other measures While Google's reports to the NCMEC CyberTipline are one-way reporting, the information sharing and collaboration with NCMEC and NGOs provide the necessary feedback loop to continuously improve Google's detection technology against child sexual abuse. Measures to ensure feedback from law enforcement (please specify) Google ensures feedback from law enforcement is handled through a formal, legally mandated process that begins after a confirmed CSAM incident has been reported to NCMEC. The feedback loop is reactive and happens when law enforcement agencies, upon investigating an NCMEC tip, decide they require additional information. Measures to ensure feedback from the outcome of a complaint in the context of the internal redress mechanism or a complaint lodged with a judicial authority (please specify) Google manages and ensures feedback from the outcome of a complaint—whether it arises from an internal redress mechanism or a complaint lodged with a judicial authority—through adherence to two key structured processes: (i) For complaints received via Google's complaints mechanism, dedicated appeal forms and a formal review process are used to ensure due process and provide the user with a final, transparent decision. (ii) For complaints lodged with a judicial authority, Google ensures compliance and acknowledges the outcome by strictly adhering to valid legal processes and binding court orders, thereby integrating the judicial ruling into its enforcement actions and providing a necessary check on its policies. Other measures to limit the error rate (please specify) Google limits the error rate through a combination of measures that focus on human reviewer quality and technical deployment controls. Google ensures that human reviewers undergo extensive training, including annual recertification, along with ad-hoc sessions when new policies are launched. On the technical side, the system uses strict thresholds to limit errors, and applies hash confidence rules to direct uncertain matches for additional manual review. Error rate achieved following the implementation of the measures to limit the error rate (if applicable, i.e. if new measures have been introduced) Error rate achieved N/A New CSAM Measures to check the quality of existing AI classifiers (please specify) Indicators (e.g. AI classifiers) N/A. Please refer to our comments in relation to unknown CSAM, solicitation and grooming in the "Introduction" section. Measures to vet AI classifiers before they are added to the database (please specify) N/A. Please refer to our comments in relation to unknown CSAM, solicitation and grooming in the "Introduction" section. Other measures to limit the error rate through actions on the AI classifiers (please specify) N/A. Please refer to our comments in relation to unknown CSAM, solicitation and grooming in the "Introduction" section. Implementation plan vetted by independent third party Implementation of the detection technology N/A. Please refer to our comments in relation to unknown CSAM, solicitation and grooming in the "Introduction" section. Other measures to limit the error rates through actions on the deployment of the detection technology (please specify) N/A. Please refer to our comments in relation to unknown CSAM, solicitation and grooming in the "Introduction" section. Systematic human review of every content item flagged as possible new CSAM prior to reporting Human review N/A. Please refer to our comments in relation to unknown CSAM, solicitation and grooming in the "Introduction" section. Human review of sample content items flagged as possible new CSAM prior to reporting N/A. Please refer to our comments in relation to unknown CSAM, solicitation and grooming in the "Introduction" section. Training policies of human reviewers (please specify, e.g. the type and duration of training before start working, the periodicity and type of refresh trainings, etc.) N/A. Please refer to our comments in relation to unknown CSAM, solicitation and grooming in the "Introduction" section. Measures to ensure periodic quality control assessments of human reviewers and the verdicts that are applied (please specify) N/A. Please refer to our comments in relation to unknown CSAM, solicitation and grooming in the "Introduction" section. Measures to ensure feedback from NCMEC and/or from other organisations acting in the public interest against child sexual abuse (please specify) Other measures N/A. Please refer to our comments in relation to unknown CSAM, solicitation and grooming in the "Introduction" section. Measures to ensure feedback from law enforcement (please specify) N/A. Please refer to our comments in relation to unknown CSAM, solicitation and grooming in the "Introduction" section. Measures to ensure feedback from the outcome of a complaint in the context of the internal redress mechanism or a complaint lodged with a judicial authority (please specify) N/A. Please refer to our comments in relation to unknown CSAM, solicitation and grooming in the "Introduction" section. Other measures to limit the error rate (please specify) N/A. Please refer to our comments in relation to unknown CSAM, solicitation and grooming in the "Introduction" section. Error rate achieved following the implementation of the measures to limit the error rate (if applicable, i.e. if new measures have been introduced) Error rate achieved N/A. Please refer to our comments in relation to unknown CSAM, solicitation and grooming in the "Introduction" section. Solicitation Measures to check the quality of existing AI classifiers (please specify) Indicators (e.g. AI classifiers) N/A. Please refer to our comments in relation to unknown CSAM, solicitation and grooming in the "Introduction" section. Measures to vet AI classifiers before they are added to the database (please specify) N/A. Please refer to our comments in relation to unknown CSAM, solicitation and grooming in the "Introduction" section. Other measures to limit the error rate through actions on the AI classifiers (please specify) N/A. Please refer to our comments in relation to unknown CSAM, solicitation and grooming in the "Introduction" section. Implementation plan vetted by independent third party Implementation of the detection technology N/A. Please refer to our comments in relation to unknown CSAM, solicitation and grooming in the "Introduction" section. Other measures to limit the error rates through actions on the deployment of the detection technology (please specify) N/A. Please refer to our comments in relation to unknown CSAM, solicitation and grooming in the "Introduction" section. Systematic human review of every content item flagged as possible solicitation prior to reporting Human review N/A. Please refer to our comments in relation to unknown CSAM, solicitation and grooming in the "Introduction" section. Human review of sample content items flagged as possible solicitation prior to reporting N/A. Please refer to our comments in relation to unknown CSAM, solicitation and grooming in the "Introduction" section. Training policies of human reviewers (please specify, e.g. the type and duration of training before start working, the periodicity and type of refresh trainings, etc.) N/A. Please refer to our comments in relation to unknown CSAM, solicitation and grooming in the "Introduction" section. Measures to ensure periodic quality control assessments of human reviewers and the verdicts that are applied (please specify) N/A. Please refer to our comments in relation to unknown CSAM, solicitation and grooming in the "Introduction" section. Measures to ensure feedback from NCMEC and/or from other organisations acting in the public interest against child sexual abuse (please specify) Other measures N/A. Please refer to our comments in relation to unknown CSAM, solicitation and grooming in the "Introduction" section. Measures to ensure feedback from law enforcement (please specify) N/A. Please refer to our comments in relation to unknown CSAM, solicitation and grooming in the "Introduction" section. Measures to ensure feedback from the outcome of a complaint in the context of the internal redress mechanism or a complaint lodged with a judicial authority (please specify) N/A. Please refer to our comments in relation to unknown CSAM, solicitation and grooming in the "Introduction" section. Other measures to limit the error rate (please specify) N/A. Please refer to our comments in relation to unknown CSAM, solicitation and grooming in the "Introduction" section. Error rate achieved following the implementation of the measures to limit the error rate (if applicable, i.e. if new measures have been introduced) Error rate achieved N/A. Please refer to our comments in relation to unknown CSAM, solicitation and grooming in the "Introduction" section. 8) the retention policy and the data protection safeguards applied pursuant to Regulation (EU) 2016/679 Retention policies Retention policy for content items identified as online CSA (please specify) Please specify for each category the length of the relevant retention periods. CSAM content processed within the scope of the Regulation will be stored for a maximum period of 12 months from when it is identified and reported, unless Google is in receipt of a valid legal process requiring a longer storage period. Please see more details on data retention policy and the data protection safeguards in the Google Privacy Policy . Retention policy for non-content data related to reports of online CSA, including after a possible deactivation of the account by the user (please specify) Google retains non-content data related to reports made to NCMEC for up to 2 years. This retention is necessary to support statutory transparency reporting, facilitate responses to valid legal processes from law enforcement authorities and regulatory inquiries, and ensure due process in responding to data subject rights requests and handling other inquiries regarding disabled accounts. If Google is in receipt of a valid legal process requiring it to retain data, this retention period may be longer. Retention policy for data related to complaints and policy violations The content of user appeals is kept for 3 years. Google retains certain other data relating to user appeals for up to 2 years (e.g. appeal decisions). This retention is necessary to enable Google to defend potential legal claims. If Google is in receipt of a valid legal process requiring it to retain data, this retention period may be longer. Other relevant retention policies (please specify) N/A Data protection safeguards Use of de-identification or pseudonymisation techniques and anonymisation of data Specify the techniques and in which instances they are deployed Google employs pseudonymisation and de-identification techniques to protect user data. Specifically, our hash-matching technology functions by generating unique digital fingerprints of visual images and comparing them to the database of previously identified CSAM hashes. Additionally, CSAM data retained for the purpose of improving our CSAM detection technologies to combat the proliferation of online child sexual abuse exploitation is de-identified and no longer tied to a Google account identifier. Use of industry standard encryption (algorithms and protocols) for data in transit between privately owned infrastructure and public networks N/A - Google does not transfer information to NCMEC or law enforcement via public networks. The data shared with NCMEC is shared through NCMEC’s CyberTipLine API. More information is available in NCMEC’s CyberTipLine Reporting API documentation . Implementation of data governance strategies/comprehensive privacy programmes (please specify) E.g. Internal data access restrictions, usage of Access Control Lists, confidentiality obligations to those with access, etc. When Google processes CSAM, its data protection principles and internal privacy and legal reviews ensure that there is a justified purpose for the processing, that the processing is of an acceptable level of quality, that the data used is proportional to the purpose, and that retention, access, and sharing are appropriately limited. Additionally, to ensure the accuracy of abuse decisions, Google human reviewers specialize in reviewing for online child sexual abuse and undergo robust training under guidance of counsel on how to recognize this content on Google’s services, as described in the section above. Google also has a comprehensive privacy program that ensures that data is accessed, used, or shared only in an authorized manner. Should issues arise, Google's incident response team promptly investigates any reported incidents and makes resolving them a high priority. Procedures to review of anonymisation and data governance strategies (please specify) Google maintains a comprehensive program and policies to review and approve data governance strategies, including a centralized group of anonymization experts who help teams validate and approve anonymization strategies. This ensures that different categories of data are accessed, shared, processed, or otherwise used in a manner consistent with user expectations, Google’s commitments, and applicable law. Key components include a privacy and security launch review process, as well as mandatory training on data privacy, data compliance, and handling high-risk data. Procedures to maintain security incident response plans for monitoring, detecting, and handling any possible security vulnerabilities and incidents across infrastructure (please specify) Google maintains comprehensive procedures to manage security incident responses, including continuous monitoring, detection, and handling of vulnerabilities and incidents across its infrastructure. Other technical and organisational measures to ensure the security of the data (please specify) Google maintains significant security measures to safeguard personal data, including: Access control lists (ACLs): Access to data is strictly limited to authorized personnel tasked with abuse combat operations. All access occurs within secure, controlled systems and is logged for auditing purposes. Data is never shared externally unless legally mandated. Encryption: Data is encrypted at rest and retained in dedicated, accessed-controlled storage environments. Internal Redress mechanism Please specify whether: i) you inform the individual on the facts relevant for your decision, ii) the procedures in place to assess possible user’s enquiries regarding your decision, iii) a dedicated communication channel with users exists, iv) users are informed about the completion of the assessment and v) whether additional information is sent to the recipients of Article (3)(1)(h)(i) of Regulation (EU) 2021/1232 based on the outcome of the assessment of user’s complaint When a Google Account is restricted or disabled, the user receives a notification detailing the specific violation and setting out information on redress options available to them. Google has dedicated appeal forms and a formal review process to ensure due process and users are provided with a link to appeal the decision. Users are also provided with notification on the outcome of an appeal decision. Google submits supplemental reports to NCMEC when required under our policies. Right to access users’ data Please specify whether, how and when users are being given access to their data in case their accounts are temporarily or permanently suspended or deleted as a result of identified CSAM or solicitation Depending on the nature and severity of the violation, we may provide an in-product educational warning or restrict access to Google products or services, whereby a user can still exercise their right to access their Google Account. We will restrict access to a Google Account only in cases where it is proportionate to do so. During the period that account access is restricted, Google will only allow the user to access limited services or products relating to their account. It is important to note that granting access to all content data in a restricted account may mean granting access to illegal and sometimes even criminal content. Additionally, in some cases the content is of a nature that its creation and distribution violates the rights and freedoms of others, and that violation would therefore be furthered by granting access to the account that contains such data, thereby enabling further distribution and copying. Other safeguards (please specify) Purpose Limitation & Accuracy: Personal data is processed only when there is a documented, specific necessity for combating CSAM. We employ detection technologies that are rigorously tested for high precision and recall to minimize errors, and we conduct periodic reviews to ensure these methods remain necessary and effective over time. Access Control & Security: Access to CSAM-related data is strictly limited to authorized personnel tasked with abuse combat operations. All access occurs within secure, controlled systems and is logged for auditing purposes. Data is never shared externally unless legally mandated. 9) the names of the organisations acting in the public interest against child sexual abuse with which data has been shared pursuant to this Regulation National Centre for Missing and Exploited Children (NCMEC) Google reports apparent online child sexual abuse to the NCMEC. EU Centre to prevent and combat child sexual abuse Only applicable upon establishment of the EU Centre N/A Other (please specify) N/A