Chat Control: EU scanning law, latest news

What is Chat Control

Chat Control is the popular name for EU rules that allow, or would require, scanning private messages for child sexual abuse material (CSAM). The idea was first developed in 2021, and the Commission published the permanent regulation proposal on 11 May 2022 (Legislative Observatory, procedure 2022/0155(COD)). The process has two tracks: an interim measure, called Chat Control 1.0, and a proposed permanent regulation, called Chat Control 2.0.

The dispute is about method, not about protecting children. Critics argue that scanning messages before they are encrypted undermines the principle behind end-to-end encryption.

Has Chat Control passed?

Partly: the interim Chat Control 1.0 has passed and applies, while the permanent Chat Control 2.0 has not been adopted. The interim rules are Regulation (EU) 2026/1881 of 24 July 2026, published in the Official Journal on 28 July. Article 1(3) says it does not apply to communications protected by end-to-end encryption, and Article 11 says it applies until 3 April 2028 (EUR-Lex page fetched 10 October 2026). The Legislative Observatory shows the procedure as completed: the Council approved it on 23 July and it was signed on 24 July.

The permanent regulation is a different matter. On the same database, procedure 2022/0155(COD) is still “Awaiting Parliament’s position in 1st reading”, so Parliament has not yet adopted a position. The newest story we hold is from 10 August 2026 and says that Chat Control 2.0 negotiations continue over the summer. We have no report on the September talks, so their outcome is unverified.

When will Chat Control be voted on, and when does it apply

Chat Control 1.0 already applies: the regulation entered into force on the third day after its 28 July 2026 publication, which is 31 July, and runs until 3 April 2028. Its predecessor had lapsed earlier: the temporary framework expired on 3 April 2026, after Parliament rejected an extension in March by 311 votes to 228, with 92 abstentions. One story describes that March rejection as a vote by Parliament’s civil liberties committee; the Legislative Observatory lists plenary decisions on 11 and 26 March 2026. So between April and July no interim rules were in place.

For Chat Control 2.0 there is no vote date and no start date. The fifth negotiating round on 29 June ended in deadlock over mandatory scanning, and negotiators were not due to meet again until September. A permanent law would still need formal adoption by Parliament and the Council.

Is Chat Control in the UK or the US?

No, in both cases: Chat Control is an EU measure, and the UK and the US are not EU member states. Regulation 2026/1881 is binding and directly applicable in all member states, according to its last article. The stories do not say whether platforms extend EU scanning to users elsewhere.

The UK is fighting a similar battle under its own rules. Prime Minister Keir Starmer announced at London Tech Week a plan that would require Apple and Google to activate nude-image detection on devices, with fines and possible criminal liability for executives if firms do not comply within three months. Signal president Meredith Whittaker said the app would “absolutely, 100% walk” from the UK rather than implement client-side scanning. In the US, the House passed the Kids Internet and Digital Safety Act on 29 June. The story links it to age verification, not message scanning, and it heads to a skeptical Senate. See also age verification.

How Chat Control works: version 1.0 versus 2.0

Chat Control 1.0 lets providers scan voluntarily; Chat Control 2.0 would make scanning a legal duty in some cases. Version 1.0 creates an exemption from the ePrivacy Directive, so platforms may scan unencrypted communications on a voluntary basis to detect, report and remove CSAM. The provider decides whether and how to do it.

Under the proposed 2.0, providers would first assess risk and apply mitigation measures. If a national authority finds significant risk, it could ask a court or independent body for a targeted, time-limited detection order. For encrypted apps the most debated tool is client-side scanning, which inspects content on the device before encryption. Campaigners warned in June of three worst cases: “voluntary” scanning that becomes effectively mandatory as a risk-mitigation measure, detection orders without prior court approval, and mandatory age verification for hosting and communication services. The stories disagree on whether the permanent text would reach encrypted messages: one says the permanent version will not include scanning of them, others describe client-side scanning as the core of the proposal.

Technical experts add that the AI filters used for scanning are unreliable and prone to false positives, so ordinary family photos could be reported to law enforcement. The wider debate is covered under encryption backdoors and lawful access.

How Parliament revived Chat Control 1.0 in July

Parliament let the interim rules back in on 9 July 2026, although most voting MEPs opposed them. After the March rejection, European Parliament President Roberta Metsola put the file back on the table at the request of the European People’s Party, which used a rarely used procedure in which rejecting the text requires an absolute majority of all MEPs. The motion to reject got 314 votes against the regulation but needed 361. Another story gives 276 as the number of MEPs opposing the scheme, so the tallies differ between sources. The Legislative Observatory confirms 9 July as Parliament’s second-reading decision.

Centre-left MEPs added a last-minute amendment excluding end-to-end encrypted services. The Commission gave a favourable opinion and EU governments adopted the text on 23 July with 25 in favour, one against and one abstention, without further talks with MEPs. Rapporteur Birgit Sippel said a clear majority had wanted to limit the scope to known CSAM and include targeted measures. MEP Jeroen Lenaers of the EPP says the law closes a legal loophole and is not mass surveillance. Greens MEP Ignazio Marino replied that no child is helped by a law the Court of Justice will annul. Patrick Breyer called the vote “a farce”, noting that EU Commission figures show mass scanning accounted for only 36 percent of abuse reports in 2024.

The arguments, and the Apple lawsuit

Supporters point to scale: according to Europol, more than 20 million suspected abuse reports were logged in 2024. Opponents, including privacy regulators and rights groups, say that scanning before encryption would destroy private communication and risk false accusations at scale, and Signal has said it would rather leave the EU than comply. Voices of survivors split: some stress that privacy is essential for reporting abuse, while Finnish singer Scharliina Eräpuro, a survivor, notes that about 60 percent of known CSAM is hosted in Europe and calls for long-term solutions that cover AI-generated content.

Apple shows the other side of the dilemma. A class of 2,680 survivors is suing the company for $1.2 billion over its decision to drop on-device CSAM detection, and West Virginia’s Attorney General filed a separate suit. In 2023 Google made 1.47 million CSAM reports and Apple made 267. See also children’s online safety.

What it means for you

• WhatsApp, Signal and other end-to-end encrypted services are outside the interim rules, because the regulation excludes encrypted communications.
• On services without such encryption (Gmail, iCloud, Instagram, Discord, Snapchat, Skype, Xbox) the provider may scan voluntarily. The rules do not force it to.
• If message privacy matters to you, use a messenger with end-to-end encryption. See messaging apps privacy.
• Watch Chat Control 2.0, not 1.0: it decides whether on-device scanning and mandatory age verification arrive. The interim rules expire on 3 April 2028, so the topic will return.

Still open: whether the autumn talks produced a compromise, whether the permanent law will touch encrypted messages and require age verification, and whether the interim rules will be challenged before the Court of Justice.