No, it's saying that exact thing: online users of porn must be deanonymised on penalty of prison. To stop child abuse because that's related somehow?

It's just that the countries themselves must choose the particulates: who will do the deanonymisation, in what way, what will enforcement look like, etc.

That's what they mean with "the final shape of the law hasn't been determined yet".

Every EU directive works that way: https://en.wikipedia.org/wiki/Directive_(European_Union)

A directive is a legal act of the European Union[1] that requires member states to achieve particular goals without dictating how the member states achieve those goals

In this case: the de-anonymisation must happen. Up to the respective countries to do the dirty work.

When people, rightfully, get angry the local politician will say "we had to because EU". And the EU will say "well we didn't say it had to be in that way, it's your local politician that did that."