Key facts
- Temporary EU rules allowing voluntary scanning for child sexual abuse material have been extended until April 2028.
- A proposed permanent law, 'Chat Control 2.0', would mandate risk assessments and message scanning.
- Privacy advocates argue the law would undermine encryption and risk false accusations.
- Signal has stated it would leave the EU rather than comply with such scanning.
- Discussions between the European Parliament, Council, and Commission have stalled over mandatory scanning.
The European Union is grappling with the future of private messaging as lawmakers debate a permanent 'Chat Control 2.0' law, which could mandate the scanning of private communications to detect child sexual abuse material (CSAM).
Temporary rules allowing platforms to voluntarily scan for known CSAM were set to expire but have been extended until April 2028. This regime faced significant opposition, being rejected by the Parliament's civil liberties committee in March before surviving a close vote on July 9. The core of the ongoing debate centers on the proposed permanent legislation, which would introduce mandatory risk assessments and detection orders, potentially impacting encrypted messages.
Discussions between the European Parliament, the Council, and the Commission have been ongoing since December 2025, but a consensus has not been reached. The most recent round of talks on June 29 ended in a deadlock specifically over the issue of mandatory scanning. Negotiators are not expected to meet again until September.
Supporters of the legislation highlight statistics from Europol, which logged over 20 million suspected abuse reports in 2024, emphasizing the need for tools to combat child exploitation. However, privacy regulators and human rights organizations have voiced strong objections, arguing that scanning messages before encryption would fundamentally undermine the security of encrypted communications and could lead to widespread false accusations. Messaging app Signal has publicly stated it would cease operations in the EU rather than comply with such scanning requirements.