> So whenever you send anything to example.com you also send it to government-snooping-service.org?domain=example.com.

No, it's client side scanning - you have a database with bad material / a neural network trained to detect such material. Only when it detects a positive match, it will contact the government server.

Providers, not individual apps.

For actual details in the draft see

page 45 and 46 ... https://cdn.netzpolitik.org/wp-upload/2024/05/2024-05-28_Cou...

...

"... measures shall be ... targeted and proportionate in relation to that risk, taking into account, in particular, the seriousness of the risk as well as the provider’s financial and technological capabilities and the number of users; ..."