According to some reports they’ve been doing it server side for a while: https://nakedsecurity.sophos.com/2020/01/09/apples-scanning-icloud-photos-for-child-ab

According to some reports they’ve been doing it server side for a while: https://nakedsecurity.sophos.com/2020/01/09/apples-scanning-icloud-photos-for-child-abuse-images https://nakedsecurity.sophos.com/2020/01/09/apples-scanning-...