So here is an interesting read (sorry... cross-posted... but this is IMPORTANT)
Many people have stated that Apple is required to do this, as a service provider.
Someone also linked to the actual law; 18USC2258A.
Here's an interesting part of this. 2258A, section (f)
(f) Protection of Privacy.-Nothing in this section shall be construed to require a provider to-
(1) monitor any user, subscriber, or customer of that provider;
(2) monitor the content of any communication of any person described in paragraph (1); or
(3) affirmatively search, screen, or scan for facts or circumstances described in sections (a) and (b).
Now... read that again carefully. NOTHING in this section shall be construed to *require* a provider to...
... MONITOR ANY USER, SUBSCRIBER, OR CUSTOMER
... MONITOR THE CONTENT OF ANY COMMUNICATION...
... AFFIRMATIVELY SEARCH, SCREEN OR SCAN FOR FACTS OR CIRCUMSTANCES.
That being said, this is a CHOICE by Apple... and NOT A REQUIREMENT. In fact, the law specifically says that they are NOT REQUIRED to scan, monitor or search for CSAM. Just to report it if it is discovered.
I have been saying this since the announcement. People are still under the impression that scanning must take place regardless, they think the choice is between on-device vs. on-cloud even though the correct answer is no scanning at all with zero access E2EE.
I think that speaks to the public's general default view about policing in general, they believe it must simply exist in its current pervasive, authoritarian, and militaristic form because they simply can't imagine a world without it. The notion that people are entitled to not be treated like criminals with spyware pre-installed on their property is a completely alien concept to them apparently.