According to a Politico article from July this year
EU Parliament lets companies look for child abuse on their platforms, with reservations
The European Parliament on Tuesday approved a controversial law that would allow digital companies to detect and report child sexual abuse on their platforms for the next three years.
Tuesday's vote was the final hurdle for the bill, and will allow companies to scan their platforms for explicit material without fear of violating Europe's strict privacy laws. The bill pitted the European Commission, who proposed the bill, and children's rights activists against the Parliament and Europe's privacy regulators, who fear the bill could undermine the EU's privacy rules.
The results showed 537 MEPs voted in favor of the bill, with 133 against and 24 abstaining. Despite the result, [some] European lawmakers warned that the rules are "legally flawed" and could crumble in front of a court. [...]
MEPs also said that the blanket scanning of private messages of European citizens to look for evidence of child grooming could clash with another set of privacy rules protecting personal data, the GDPR.
To allay the Parliament's concerns, EU countries agreed to modify the Commission’s law to add additional safeguards, including bringing in Europe's network of privacy watchdogs to advise on what technologies should be used to do the scanning, and how they should be used. They also left out audio messages from the bill. The changes prompted Sippel, who was negotiating on behalf of the Parliament, to sign off on the bill.
So YMMV, but insofar it looks pretty legal unless a court decides otherwise.
It seems Apple went public with their plan after this EU law was passed, so they probably took it into account.
For what's that worth, there's an analysis from someone at Cambridge (in the Compliant and Accountable Systems Group, Department of Computer Science and Technology) that:
EU law would
require that Apple obtain the consent of individual iPhone users for on-device scanning. This
consent would need to be opt-in, rather than opt-out; there would need to be a real
possibility for users to refuse consent; users’ access to iCloud could not be made conditional
on giving consent to CSAM Detection; and users must be able to withdraw consent without
suffering loss of iCloud service. This may place a welcome brake on the deployment of on-
device CSAM detection in the EU. However, these barriers may be removed by future EU or
Member State legislation – just as similar potential barriers for automated CSAM detection
by certain messaging services have already been removed by EU legislation.
So it seems that there would be a way for Apple to do this "device scanning" even in the EU with user (clickwrap) agreement...
The paper enumerates the things than can be made implicit (bundled) in a GDPR agreement, and then goes on to argue that probably none of these apply to Apple's CSAM on device, and so they'll probably need a separate checkbox for CSAM... which the paper's author is pretty sure the users would not check.
Importantly, because consent must be specific, consent to one purpose (such as processing
to detect CSAM) can’t be presumed from consent to another purpose (such as processing
for cloud backup). Nor can consent to processing to detect CSAM be ‘bundled’ with
consent to cloud backup. GDPR strongly indicates that ‘bundling’ – the practice of making
access to a service conditional on giving consent to processing that is not necessary for that
service – is not permitted. [...]
It is unlikely in the extreme that even minimally informed holders of CSAM would give
consent to Apple’s CSAM Detection system.
The paper more tenuously (IMHO) argues then that Apple needs do the same for their server-side scanning in the EU, i.e. get explicit consent, because it's somehow tied to the on-device scanning via the iCloud account. (The author also makes their personal disapproval of CSAM in all forms more explicit towards the end of the paper.) But still that someone who disapproves of CSAM entertains that it might be deployed via clickwrap user consent (albeit with a separate checkbox) is noteworthy.
In this context I'll note (even though the paper doesn't), that there is a 2019 CJEU decision that pre-checking certain kinds of checkboxes (like for "nonessential" cookies) is not legal. I suspect
CSAM will fall in this kind of category... so they won't be able to have the checkbox for it pre-checked, unless Apple does something more devious and make it so that image hashes become "essential" to something else that the user would more readily like to agree to...
Also, looking at a current (August 1) Apple description of their system, it seems they only plan to run the image hashing on the device (and upload a threshold-encrypted version of the result, so that only multiple, cumulative "hits" on several images would be detectable/decryptable on the server), which would basically make their system (as currently envisaged) inoperable without the local hash step. I've also looked at Commission's 70-page impact assessment for their most recent proposal (the one discussed at the beginning of this answer), but it only discusses things like PhotoDNA and server-side hashing. So I guess they were unware that someone might plan to do [only] client-side hashing as part of a CSAM design.
If this goes to an EU court, I guess an issue will be when and why iOS would create those (threshold-encrypted) vouchers that contain the images hashes, e.g. if they'd be considered an essential part/step of an otherwise approved purpose...