A European Union proposal to scan the private communications of 450 million citizens remains alive in Brussels, despite repeated failures to reach agreement among lawmakers. Known informally as Chat Control 2.0, the measure would require messaging services to automatically scan images and text sent by users, including content protected by end-to-end encryption, in an effort to detect child sexual abuse material. The latest trilogue negotiation, the sixth since the bill was first tabled in 2022, ended without consensus, and talks are expected to resume in November.
From Voluntary Scanning to Mandatory Surveillance
The current legal framework, in place since 2021 and set to run until 2028, allows messaging and email providers to voluntarily scan content for child sexual abuse material. Chat Control 2.0 would replace this opt-in system with a mandatory one. Providers would be legally obligated to deploy detection technology across their platforms, regardless of whether a user has given consent or is suspected of any wrongdoing. The central dispute among EU institutions is one of scope: the European Parliament favours restricting scanning to individuals already linked to credible suspicion, while other parties within the Council continue to push for a system that would apply indiscriminately to all users.
The Problem With Scanning Encrypted Messages
Encryption exists precisely to ensure that only the sender and recipient of a message can read its contents. Scanning encrypted communications before they are sent - a method often called client-side scanning - requires building a mechanism into the software itself that inspects content prior to encryption. Security researchers have long warned that any such mechanism, however well-intentioned, creates a structural weakness that could be exploited by hackers, hostile states, or anyone who gains unauthorised access to the scanning system. A backdoor built for law enforcement does not remain a backdoor only for law enforcement.
There is also the question of accuracy. A 2023 study commissioned by the European Parliament found that automated detection tools of this kind would likely produce high error rates and a significant number of false positives. In practice, this means ordinary citizens - including minors sharing innocuous photos, or parents messaging about their own children - could find themselves flagged, investigated, or reported to authorities without having done anything wrong.
Part of a Broader Regulatory Pattern
Chat Control 2.0 does not exist in isolation. It follows the Digital Services Act, which came into force in 2022 and imposes substantial financial penalties - up to six per cent of a company's global revenue - on platforms that fail to remove content the EU designates as hate speech or disinformation. Critics argue that the DSA already grants considerable power to "trusted flaggers" to shape what content remains visible online. Layering a mass-scanning surveillance regime on top of existing content-moderation rules would mark a significant escalation, combining control over what Europeans can say with the ability to monitor what they privately write.
What Happens Next
No final text has been agreed, and the European Parliament's narrower position has so far held against pressure for blanket surveillance. But the outcome is not guaranteed. With negotiations resuming in the autumn, the next round of talks will determine whether the EU moves toward targeted, judicially supervised investigation of genuine suspects, or toward a system that treats every citizen's private messages as fair game for automated inspection. For a bloc that presents itself as a global standard-setter on digital rights, the choice carries weight well beyond its own borders.