Image: Stefan Nürnberger / CC BY-SA 4.0 (Wikimedia Commons)
In short: Since 2022 the EU has been negotiating a regulation against child sexual abuse material online, widely known as chat control. At the sixth trilogue on 29 September 2026, the Commission, Council and Parliament again found no agreement on scanning private messages. The Council wants to make today's voluntary scanning permanent; the Parliament wants only targeted orders. End-to-end encrypted chats are no longer part of either side's plans. The interim rule allowing voluntary scanning runs until 3 April 2028, and the next round is expected in November, according to the German Federal Bar (BRAK).
What has been agreed
| Topic | Status |
|---|---|
| EU Centre against child abuse | Agreed |
| Searching publicly accessible content | Largely agreed |
| Authorities forcing "voluntary" mass scans | Ruled out |
| Scanning private unencrypted messages | No agreement |
| End-to-end encrypted content | Dropped by Council and Parliament |
Data from BRAK and netzpolitik.org, October 2026.
Where the dispute continues
The Council wants to remove detection orders and keep voluntary scanning permanently. The Parliament considers indiscriminate mass surveillance incompatible with fundamental rights and wants orders that are as targeted as possible; it is still open whether these would apply to individual users, groups or parts of a service. A new term, "search plans", describes how providers would document their detection technology and safeguards.
What it means for you
Little changes right now. End-to-end encrypted messengers such as WhatsApp or Signal are excluded under the current rules. Unencrypted services, such as many classic email accounts, may be scanned voluntarily by providers, and public posts and shared files could be searched more in future.
How to protect your privacy
Use a messenger with end-to-end encryption on by default, avoid making cloud folders public, and keep your apps updated. Read about the latest WhatsApp features and browse our privacy category.
Background: how chat control started
The Commission presented its proposal for the so-called CSA Regulation in May 2022. The original draft would also have covered end-to-end encrypted content through client-side scanning, which checks content on the device before it is encrypted. According to netzpolitik.org, both the Parliament and, after years of talks, the member states in the Council now reject this part. In parallel, an interim rule known as "Chat Control I" lets platforms such as Meta, Google and Microsoft scan private communication voluntarily. It had lapsed in spring and, according to BRAK, was renewed shortly before the summer break despite earlier opposition from the Parliament. Encrypted messages and audio calls remain excluded. BRAK has repeatedly criticised the extension, citing fundamental rights and the confidentiality between lawyers and their clients.
Who should follow this
Anyone who uses messengers, professionals bound by confidentiality such as lawyers, doctors and journalists, parents, and companies running online services.
Sources
