Skip to content
Kallima - Home
en Languages
Menu

Awareness

Chat Control: four years on, your encrypted messages are still protected

Updated on

In May 2022, the European Commission proposed a regulation to combat child sexual abuse online. The goal was legitimate, but the method was questionable: it would have allowed authorities to require messaging services, including end-to-end encrypted ones like Signal or WhatsApp, to scan their users’ messages for abuse images or grooming attempts. Its opponents nicknamed it “Chat Control.” Four years later, under combined pressure from the European Parliament, several member states, civil society, researchers and legal experts, the regulation has still not been adopted, and end-to-end encryption, threatened several times, has so far been preserved.

Why it was so dangerous

An end-to-end encrypted message can only be read by its sender and its recipient. To scan it anyway, the scan has to happen on the phone itself, before encryption. This is called client-side scanning. Every phone would become a checkpoint.

Experts have issued warning after warning since 2022. In September 2025, a new open letter against the proposal gathered the signatures of 807 scientists from 37 countries. Their conclusion has not changed. According to them, such a system would:

  • create a vulnerability that hackers or hostile governments could exploit. Phones become an attack surface, and encryption no longer guarantees that no one else can access the content;
  • generate countless false alarms, for example on perfectly innocent family photos. A frequently cited real case is that of an American father flagged by Google in 2022 for a photo of his child sent to a doctor;
  • easily become a slippery slope and expand to other content once in place. An infrastructure designed for one category of content can technically be reconfigured to target others, such as terrorism, copyright or political dissent.

Researchers also point out that the method is ineffective. Criminals could easily get around it by slightly altering images or using other tools. The system would therefore mostly monitor ordinary users.

Resistance that is paying off

  • November 2023: the European Parliament adopts its position. It excludes end-to-end encrypted communications and only accepts targeted detection of suspects, ordered by a judge.
  • 2024–2025: three successive presidencies of the Council of the European Union fail to secure a majority. In October 2025, Germany refuses to back the text. Its Justice Minister declares that suspicionless monitoring of conversations “must be taboo in a state governed by the rule of law.” Signal threatens to leave the European market rather than build a surveillance system into its app.
  • November 2025: the Council finally adopts a position, without mandatory detection. However, this position also makes voluntary scanning permanent and adds risk mitigation obligations.
  • March 2026: Parliament refuses to extend the temporary regime that allows companies to voluntarily scan messages. The regime expires on April 3, 2026.
  • July 2026: the temporary regime is reinstated until April 2028, but Parliament secures an explicit exclusion of end-to-end encrypted communications.

This victory did not come out of nowhere. It is the result of four years of work by scientists, organizations such as EDRi and La Quadrature du Net, companies that refused to give in, and thousands of citizens who wrote to their elected representatives.

It’s not over yet

As of late September 2026, the permanent regulation is still being negotiated between Parliament, the Council and the Commission. Five rounds of negotiations have failed. The sixth is scheduled for September 29, under the Irish presidency.

The main sticking point: the Council wants to make “voluntary” scanning of private messages permanent on services that are not end-to-end encrypted. Parliament, for its part, only accepts targeted detection aimed at suspects and authorized by a judge. The Council’s own legal service has found suspicionless scanning of private communications incompatible with the EU Charter of Fundamental Rights.

In the meantime, the temporary regime has been extended until April 2028. In July, a majority of MEPs voted against it, but without reaching the threshold required to block it. Even if an agreement is reached on the permanent regulation, the text will still need to be formally adopted by Parliament and the Council.

What you can do

  • Use an end-to-end encrypted messaging app, such as Signal, and encourage your friends and family to do the same.
  • Follow the negotiations: La Quadrature du Net and former MEP Patrick Breyer document every step.
  • Support organizations that defend encryption, in Europe and elsewhere.

Sources