After Years of Controversy, the EU's Chat Control Nears Its Final Hurdle: What to Know

"After a years-long battle, the European Commission's "Chat Control" plan, which would mandate mass scanning and other encryption-breaking measures, at last codifies agreement on a position within the Council of the EU, representing EU States. The good news is that the most controversial part, the forced requirement to scan encrypted messages, is out. The bad news is there's more to it than that."

"Chat Control has gone through several iterations since it was first introduced, with the EU Parliament backing a that protects fundamental rights, while the Council of the EU spent many months pursuing an intrusive law-enforcement-focused approach. Many earlier this year required the scanning and detection of illicit content on all services, including private messaging apps such as WhatsApp and Signal. This requirement would fundamentally break end-to-end encryption ."

"It is unclear how this will play out over time, though we are concerned that this approach to voluntary scanning will lead to private mass-scanning of non-encrypted services and might limit the sorts of secure communication and storage services big providers offer. With limited transparency and oversight, it will be difficult to know how services approach this sort of detection."

The Council of the EU has codified a position on the Chat Control plan that removes the forced requirement to scan end-to-end encrypted messages. The Council's position preserves encryption protections while allowing voluntary detection by platforms for messages that are not end-to-end encrypted. Voluntary scanning remains technically illegal in the EU except via a derogation set to expire in 2026. Digital rights groups, including EDRi, achieved the removal of mandatory scanning but warn that voluntary scanning could enable private mass-scanning, constrain secure communication and storage services, and operate with limited transparency and oversight. The EU Parliament backed protections for fundamental rights while the Council previously pursued a law-enforcement-focused approach.

Read at Electronic Frontier Foundation