Chat Control Explained
Disclaimer: I had AI help with this post, mainly for understanding myself this issue. This is my collage of the information I gathered.
If you’ve heard about “Chat Control” in the European Union (EU) but don’t know what it actually means, here’s the breakdown, including the recent “controversy”.
What Is Chat Control 1.0?
Chat Control 1.0 is a temporary exemption to the EU’s ePrivacy Directive. Adopted in July 2021, it gave online platforms a legal shield to voluntarily scan private messages for child sexual abuse material (CSAM) without violating confidentiality rules.
Originally set to expire in August 2024, it’s been extended twice before. The key points:
- Applies to platforms like Gmail, iCloud Mail, Instagram DMs, Discord, etc.
- Marked as “voluntary”, but major companies continued scanning even after expiry
- Does not currently apply to end-to-end encrypted services (WhatsApp, Signal, iMessage) because the encrypted payload cannot be accessed
The Timeline: March–July 2026
| Date | Event |
|---|---|
| 26 March 2026 | Parliament votes to reject extension: 311 against, 228 in favour, 92 abstentions |
| 3–4 April 2026 | Legal basis for voluntary scanning expires (Chat Control 1.0 lapses) |
| May–June 2026 | Companies continue scanning; no enforcement action taken |
| 9 July 2026 | Parliament revives the derogation: 314 against extension, 276 in favour (fell 47 votes short of blocking it) |
| April 2028 | Current expiry date for the revived derogation (unless Chat Control 2.0 passes earlier) |
The March vote had crossed the absolute-majority threshold to reject the extension. But because the rule for blocking the same measure required the same threshold, and many MEPs were absent for the summer recess, the July revival passed despite more votes against than in favour.
Critics called it a procedural bypass. Patrick Breyer, former MEP and longtime opponent, wrote: “The resistance we saw in Parliament today was so strong that finding a majority for permanent, suspicionless mass scanning in future negotiations is a complete pipe dream” — yet the regime continued.
Why Did Scanning Continue After April?
Even though the legal basis expired, Google, Meta, Microsoft and Snap stated they would keep scanning private messages regardless. This raised two concerns:
- Legal ambiguity: Without the derogation, their scanning arguably violated ePrivacy rules, but no enforcement followed
- Normalisation: Companies treated scanning as business-as-usual, weakening the argument that the law was necessary to enable it
What Is Chat Control 2.0?
Chat Control 2.0 is the permanent replacement still under negotiation. Key proposals include:
| Aspect | Chat Control 1.0 (Temporary) | Chat Control 2.0 (Proposed Permanent) |
|---|---|---|
| Scope | Voluntary scanning, non-E2EE platforms only | Could mandate scanning across all messaging services |
| End-to-end encryption | Exempt (technical impossibility) | Under consideration — could require client-side scanning or backdoors |
| Legal basis | Temporary derogation from ePrivacy | Standalone regulation, possibly overriding current protections |
| Safeguards | Limited oversight | Proposed warrant requirement failed to pass in March 2026 |
| Status | Revived until April 2028 | Trilogue negotiations resumed September 2026 |
The core controversy: Can you detect illegal content without breaking encryption? Critics argue the answer is no — any viable scanning system either scans before encryption (client-side scanning) or requires a decryption key held by the platform. Both undermine end-to-end encryption in practice.
Who Opposes Chat Control?
Opposition spans the political spectrum:
- Privacy advocates: EFF, Fight Chat Control, Access Now
- Cybersecurity experts: Former CISOs, cryptographers warning of systemic vulnerabilities
- Politicians: Patrick Breyer (Germany), Svenja Hahn (ALDE), plus members from left-wing, liberal and right-wing groups
- Industry: Some tech companies concerned about compliance costs and liability shifts
The common argument: targeted investigations with judicial warrants work better than mass surveillance, and mass scanning creates security risks that benefit criminals more than authorities.
Bottom Line
If you’re outside the EU: this still affects you if you use EU-based platforms. If you’re inside the EU: your private messages may be scanned voluntarily right now, and the permanent law could tighten restrictions significantly.
For users of end-to-end encrypted services like XMPP with OMEMO: these remain technically exempt for now. But the political momentum behind Chat Control suggests long-term pressure on all private communication tools.
Further Reading
- Fight Chat Control — Campaign site with detailed timeline and resources
- Patrick Breyer — Chat Control Coverage
- CSO Online — Mass Scanning Without a Warrant
- GBlock — EU Revives Chat Control
- CADE — European Parliament Vote Analysis