Chat Control explained: what the EU has agreed, and what it hasn't

Picture a traveler from Ohio landing in Lisbon. On the airport train she checks WhatsApp, replies to an Instagram DM and skims her Gmail. Which of those can a company legally scan for child sexual abuse material while she's on EU soil? The honest answer is "some of them, depending on the app," and the rules that decide it are being rewritten right now.

Most of those services are American, and EU rules shape global products. So, not quite two weeks after Global Encryption Day (October 21), here's where Europe's "Chat Control" fight actually stands.

#First, which Chat Control?

Headlines use the label for two separate pieces of EU legislation, and mixing them up is how you end up reading that "the EU passed Chat Control" (only half true).

Chat Control 1.0 is Regulation (EU) 2026/1881. In legal terms it's a derogation: a time-limited exception to the ePrivacy Directive, the EU law that keeps your communications confidential. It obliges nobody to scan anything. It only gives providers who want to scan a lawful basis for doing so. The previous version expired on April 3, 2026. The new one was signed on July 24, took effect on July 31 and runs until April 3, 2028, eucrim reports.

Chat Control 2.0 is the Child Sexual Abuse Regulation (CSAR), a permanent law the Commission proposed on May 11, 2022. The Council's own summary of its position lists the main pieces: services must assess how they could be misused and take steps to reduce that risk, national authorities can order content removed or blocked, and a new EU agency, the EU Centre on Child Sexual Abuse, handles reports and keeps a database of indicators. The big unresolved question is whether authorities also get detection orders, legally binding instructions telling a service to search for abuse material.

Here's the quick way to tell them apart:

#What 1.0 allows today

The interim rules apply to "number-independent interpersonal communications services," the legal term for messaging and email services that don't run on phone numbers. Providers in that group may choose to detect and report abuse material, take it down and spot attempts to groom children. If they do, they have to meet conditions, including data protection impact assessments, human review and telling users what they do.

The 2026 version adds two hard limits right in its first article. According to the text adopted by Parliament and Council (PE-CONS 14/26, Article 1(2) and 1(3)):

"2. This Regulation does not apply to the scanning of audio communications. 3. This Regulation does not apply to interpersonal communications to which end-to-end encryption is, has been or will be applied."

eucrim adds that this means 1.0 can't serve as a legal basis for client-side scanning of encrypted chats. What's left in play is unencrypted messaging: mainly DMs and webmail on a small number of big, mostly US services.

How it got here was messy. Parliament voted down an extension on March 26, so the old rules lapsed in April. The file only came back because Parliament President Roberta Metsola revived it after the center-right EPP group asked her to, according to Euronews. In the July 9 second-reading vote, 314 MEPs backed rejecting the Council's text, 276 opposed and 17 abstained. A second-reading rejection needs an absolute majority of all MEPs (Parliament said 360 at the time; other accounts say 361), so 314 wasn't enough. MEPs then added amendments, the encryption carve-out among them, and a second motion to reject failed 276 to 286, with 30 abstentions. Same number, different vote: don't mix them up. Member states approved Parliament's amendments by written procedure on July 23. The Council's record of that procedure (CM 3756/26) shows every government in favor except Hungary, which voted against, and Belgium, which abstained.

#How scanning works, in one paragraph

There are two basic techniques. One turns each image into a compact fingerprint (a hash) and checks it against a list of fingerprints of material that has already been confirmed as abuse. It's reliable for repeats and useless for anything new. The other uses machine-learning classifiers, models trained to guess whether an unfamiliar image or a chat looks like abuse or grooming. They can catch new material, at the cost of many more false alarms. Neither works on a server that only relays end-to-end encrypted traffic, because only the users' devices hold the keys. That's why E2EE chats sit outside server-side scanning by design. (Quick primer: End-to-end encryption, explained like you're busy.)

#The sixth trilogue: what September 29 settled

A trilogue is a closed-door negotiation between Parliament, the Council (the member-state governments) and the Commission. Round six on the CSAR took place on September 29, 2026 under the Irish Council presidency, and we now have both sides' accounts.

Parliament's side. On September 30, rapporteur Javier Zarzalejos welcomed agreement on what the planned EU Centre will do: sorting incoming reports from providers, keeping the database of indicators and searching publicly accessible content itself.

The Council's side. The presidency's outcome note to national delegations, WK 15082/26, is dated September 30 and became public on October 27, per Brussels Record's tracker. It's a working document, not a press statement, but it's the closest thing to an official Council readout. It records:

• a provisional agreement on the EU Centre searching public content, for both known and new material;
• an "in principle" deal on public-content detection orders, limited to known material, which the note says is meant "to avoid a general monitoring obligation";
• that every element is part of a package and depends on a deal on non-public content;
• "no breakthrough" on searches and detection in non-public content.

The private-content gap. According to the same note, Parliament treats detection orders for private content as essential, but only if they're aimed at specific users, cover known material only and are used as a "last resort." The presidency replied that it had no mandate to agree to detection orders in private content at all. That fits the Council's November 2025 position, which would make today's voluntary scanning permanent rather than add mandatory orders. What the Council wants instead are own-initiative searches by providers in non-public content. The presidency told Parliament that end-to-end encrypted content "would be excluded" from those searches. Parliament asked for them to be narrower: known material only, and no searching until the provider's search plan has been handed to a court (or, in countries with a justified exception, an independent authority) for review.

Campaigners read this differently, of course. Patrick Breyer, a former MEP who opposes the law, argues that under the Council's "search plan" idea, a provider could begin combing through private chats unless an authority stepped in to stop it, and that keeping 1.0 alive alongside the new law would leave a loophole. That's an advocate's reading, not an agreed position.

One encryption safeguard is already on paper. The draft agreement column of the Council's four-column table carries Article 1(4a), a binding clause on encryption. Wednesday's post goes through its wording line by line.

#Vote math and the calendar

The Council adopts laws by qualified majority: at least 55% of member states (15 of 27) that together hold at least 65% of the EU population. To block a deal, you need at least four governments representing more than 35% of the population.

Brussels Record's tracker counts nine governments that have publicly come out against making scanning of private messages compulsory. Together they speak for 32.9% of EU residents, leaving them 2.1 points short. Berlin's stance comes with conditions, and three capitals (Brussels, Lisbon and Ljubljana) still hadn't picked a clear side as of early October. According to the tracker, any one of Germany, Belgium or Portugal would be enough to push the bloc past 35%.

The dates to watch:

• October 5 and 20: national counsellors met on the file. No result has been published.
• November 3 (reported): national officials are due to look at compromise texts, according to MLex as cited by Brussels Record.
• December (tentative): the outcome note pencils in trilogue number seven for December at the European Parliament. Breyer's Chat Control page gives the date as December 8 and calls it potentially the final round.
• December 31, 2026: the Irish presidency ends. Lithuania takes over in January 2027, followed by Greece in July.
• April 3, 2028: 1.0 runs out unless a permanent law has replaced it.

#What this means for you

Everyday users: end-to-end encrypted chats on Signal, WhatsApp and iMessage are outside 1.0. The scannable zone is unencrypted channels: most social media DMs, regular email and Telegram's default cloud chats (only its Secret Chats use E2EE). No EU law today lets anyone scan your Signal messages.

Industry: the line to watch in the final CSAR text is whether detection duties can reach end-to-end encrypted services. If they can, the only technical way to comply is scanning on the device, before encryption.

Nobody in this fight disputes that child abuse online is a serious and growing problem. The argument is about method. For contrast, US providers also scan voluntarily and report to the National Center for Missing & Exploited Children (NCMEC). The relevant statute, 18 U.S.C. § 2258A, states in subsection (f) that it doesn't require them to search. Friday's post goes deeper on the US.

Coming Wednesday: can you scan an encrypted message without breaking the encryption?

Follow the series: Wednesday covers how scanning would actually work on an encrypted app, and Friday covers the UK, the US and the rest of the world. Get policy posts as they land via our policy RSS feed. Spotted something we got wrong? Tell us and we'll update the post.