# EU Chat Control: What It Means for You > The EU's Chat Control mass-scanning law is back and extended to 2028. Here's what it means for your private messages and email, and how to reduce your exposure. By Rose · July 18, 2026 · 9 min read · Privacy Source: https://bluwarden.com/blog/chat-control-is-back --- If you only half-followed the news in early 2026, here's the confusing part: Parliament rejected this law. Twice. It expired in April. And then, in the space of about ten days in July, it was resurrected and extended until 2028 - despite more MEPs voting against it than for it. That's not a typo, and it's not a conspiracy theory. It's how EU procedure works when a second-reading threshold requires an **absolute majority** to reject something, not just a simple majority. A majority of voting MEPs actually opposed the regulation - 314 against, 276 in favor - but the motion to reject it failed to secure the required absolute majority of 361 votes. The minority won. That's the headline, and it's worth sitting with before we get into the technical detail. This post explains what Chat Control actually is, why the "it's just to protect children" framing sold to the public doesn't match what the EU's own privacy regulators have said about it, what it means practically for you and for your business, and the concrete steps you can take to reduce your exposure - regardless of how the politics eventually settle. **Important:** This isn't a legal briefing and it isn't activism. It's the same practical, plain-language approach we take to phone hardening and [password hygiene](/blog/password-best-practices-2026), applied to a piece of legislation that affects how private your messages are by default. --- ## There are two Chat Controls - don't confuse them This is the single most common source of confusion, and it's often confused on purpose. | | Chat Control 1.0 | Chat Control 2.0 | |---|---|---| | **Status (July 2026)** | In force, extended to 3 April 2028 | Still being negotiated - trilogues resume September 2026 | | **Nature** | Temporary derogation from the ePrivacy Directive | Proposed permanent regulation (the Child Sexual Abuse Regulation, CSAR) | | **Scanning** | Voluntary for providers | Would be mandatory for messaging and email providers | | **Encrypted apps** | Not scanned in practice; the July 2026 extension explicitly carves end-to-end-encrypted services out of the voluntary-scanning scope (pending Council confirmation) | The core unresolved fight - encrypted services could be forced to scan on-device before encryption | | **Who uses it today** | Mainly unencrypted US services: Gmail, Facebook/Instagram Messenger, Snapchat, iCloud Mail, Xbox | N/A - not yet law | **Where things stand right now:** Chat Control 1.0 lapsed on 3 April 2026 after Parliament rejected an extension by 311 to 228. It was revived through an emergency procedural motion inserted onto the agenda shortly before summer recess, and on 9 July 2026 Parliament let it pass at second reading, extending it until 3 April 2028. Notably, the text as passed adopted an amendment that explicitly excludes end-to-end-encrypted communications (WhatsApp, Signal, Telegram) from the voluntary-scanning scope - though that carve-out still awaits Council confirmation. Chat Control 2.0, the mandatory permanent version, remains unresolved. --- ## The "for the children" narrative, and why security people are skeptical of it Nobody serious is against fighting child sexual abuse material. The disagreement is about method - and "think of the children" framing is designed to make that disagreement sound monstrous. That pattern alone is usually worth a second look. - **It doesn't cleanly work as advertised.** The broader proposal relies on detecting new, unknown material, not just matching known files. Applied to end-to-end encrypted services, digital rights groups argue this can only be enforced through client-side scanning - inspecting content on your own device before it's ever encrypted - which functionally breaks the encryption even if the transmitted data itself stays intact. - **The false-positive problem is not theoretical.** Swiss police measured an error rate around 80% on this kind of automated matching, mostly on already-known material - before software is asked to judge new images and conversations at all. At EU population scale, that means enormous volumes of innocent content flagged and routed to human reviewers. - **The EU's own watchdogs raised the alarm.** The European Data Protection Board and European Data Protection Supervisor jointly warned that the proposal, in its current form, may present more risk to individuals - and by extension to society - than to the criminals it targets. That's the EU's internal privacy regulator, not an outside activist group. - **Infrastructure built for one purpose tends to grow.** A pipeline built to scan for CSAM is, architecturally, a pipeline that scans everyone's private messages. History suggests what gets routed through it tends to expand over time. - **The politics themselves are murky.** A law that Parliament rejected in March only survived in July via a procedural quirk and an urgency motion timed right before recess. That's not the profile of a settled democratic mandate. None of this argues against CSAM detection as a goal. It argues for the distinction Parliament's own negotiators have pushed for: **targeted, judicially-authorized scanning of actual suspects**, not default-on, suspicionless scanning of the entire population. --- ## What this means for a normal user | Question | Current answer | |---|---| | Is my Signal/WhatsApp/iMessage being scanned right now? | No. Scanning under Chat Control 1.0 is voluntary and used mainly by unencrypted providers. Properly end-to-end encrypted apps aren't scanning content today. | | Could that change? | Yes, if Chat Control 2.0 passes in its mandatory form. It hasn't passed - talks resume September 2026. | | Is my Gmail/Outlook/iCloud Mail affected? | Potentially, yes. These are unencrypted-by-default and sit squarely in the practical scope of voluntary scanning today. | | Does this only affect criminals? | No - by design, it's suspicionless scanning of everyone, not targeted surveillance of suspects. | Nothing catastrophic changed this week for someone already using genuinely encrypted apps. What did change: governments now have a comfortable status quo running to 2028, which removes most of the pressure that was pushing toward a proportionate permanent framework. It's also worth noticing the pattern this sits inside. The same argument - safety requires that someone always knows who is behind the message, the account, or the code - is reshaping other parts of the stack at the same time. Google's move to [verify the identity of every Android developer](/blog/android-developer-verification-sideloading), including for apps installed outside the Play Store, is the same trade being made on the platform side rather than the messaging side. Not every version of that instinct cuts against the user, though. The [EU Cyber Resilience Act](/blog/cyber-resilience-act-what-changes), whose first obligations land in September 2026, applies the same "someone must be accountable for this code" logic to the manufacturers of connected products - and the thing it hands the public is a published end-of-support date rather than a scanning mandate. --- ## What this means for businesses If your product touches messaging, email, file sharing, or any user-to-user communication and you operate in or serve the EU, this belongs on your roadmap now, not in September. 1. **Unencrypted communication features are the most exposed.** If messages are stored or transmitted without end-to-end encryption, you're the kind of service most likely to face scanning expectations - voluntary today, potentially mandatory tomorrow. 2. **"Voluntary" providers are setting the bar you'll be measured against.** Enterprise customers and regulators are increasingly asking what detection measures are in place, even where none are legally required yet. 3. **Encryption architecture decisions are expensive to reverse.** Decide now whether a feature is genuinely end-to-end encrypted (provider cannot access plaintext, ever) or merely encrypted-in-transit. That distinction will matter far more in twelve months than it does today. 4. **Client-side scanning is a trust and supply-chain question, not just a legal one.** Any component capable of inspecting content pre-encryption will draw scrutiny from security-conscious customers regardless of what the law ultimately requires. 5. **Expect this in procurement conversations.** Data-processing questionnaires already ask about GDPR compliance; expect "are you subject to Chat Control-style scanning obligations" to join that list. 6. **Build for flexibility, not for the current interim rules holding exactly as they are.** This is a live negotiation. --- ## How to reduce your exposure None of this requires exotic tooling. It's the same discipline as general phone and password hygiene, aimed at this specific problem. ### 1) Move sensitive conversations to genuinely end-to-end encrypted apps Signal remains the reference point - open protocol, independently audited, minimal metadata retention, no server-side ability to read content. WhatsApp and iMessage/FaceTime are E2EE for content by default, though metadata handling differs between them and is worth checking individually. Avoid relying on unencrypted defaults - standard SMS and standard email - for anything you'd consider genuinely private. ### 2) Move sensitive email off scanning-exposed providers Gmail, Outlook.com, and iCloud Mail are not end-to-end encrypted by default and sit squarely within voluntary scanning's practical scope today. For sensitive correspondence - legal, medical, financial, journalistic - consider a zero-access-encryption provider such as Proton Mail or Tuta. ### 3) Verify claims, don't just trust branding "Made in the EU" isn't automatically a privacy guarantee. Look for independent security audits, published transparency reports, and a clear, specific statement on whether a provider participates in voluntary scanning - rather than taking a marketing page's word for it. ### 4) Prefer architecture that makes scanning technically impossible, not just policy that says it won't happen A provider that *chooses* not to scan today can be compelled to start tomorrow. A provider whose architecture genuinely cannot access your plaintext content is in a fundamentally stronger position to resist that - and has nothing to quietly enable even under pressure. ### 5) Remember metadata survives strong content encryption Who you talk to, when, and how often is often visible even when the content isn't. If that matters for your situation, look for apps with minimal metadata retention, and consider the identity-separation techniques covered in our [Android](/blog/android-standard-security-hardening) and [iOS hardening guides](/blog/ios-standard-security-hardening) (Private Space, separate accounts). ### 6) Track the legislative process, not just the headlines Chat Control 2.0 is decided in trilogue negotiations largely out of public view, resuming September 2026. Groups like EDRi, Patrick Breyer's office, and Fight Chat Control publish plain-language trackers - EDRi's [CSA Regulation document pool](https://edri.org/our-work/csa-regulation-document-pool/) is the most complete public record of the texts and where each institution stands. If you plan to contact your MEP, do it before September - pressure lands better before a text is finalised than after. ### 7) Businesses: run the encryption audit now Map every feature that stores or transmits user communications. Classify each as end-to-end encrypted, encrypted-in-transit only, or unencrypted. For anything in the latter two categories, decide deliberately whether that's an acceptable product choice or technical debt to close before mandatory obligations land. --- ## Summary The highest-impact moves, in order: 1. Understand there are **two separate laws** - the temporary voluntary one just extended to 2028, and the mandatory permanent one still being negotiated. 2. **Move sensitive messaging and email** to genuinely end-to-end encrypted, audited providers. 3. **Verify, don't trust** - check for independent audits and real architecture, not marketing claims. 4. **Businesses:** audit your communication stack's encryption architecture ahead of September's trilogue resumption. 5. **Track the permanent regulation**, not just this week's headline - the real decision hasn't been made yet. The scanning infrastructure being normalised this summer isn't really about the fine print of one interim law. It's about whether suspicionless, default-on scanning of private communications becomes the accepted baseline in Europe, or stays the exception it's supposed to be. That gets decided in rooms most people won't be watching, starting in September. Worth watching anyway. --- *Worried about where your business sits on Chat Control and encryption compliance? [Get in touch](/#contact) - the bluwarden team can review your communication architecture and regulatory exposure.* *This guide is general advice, not legal counsel or a substitute for a compliance assessment tailored to your organisation. For a review of your specific communication architecture and regulatory exposure, consult a qualified data protection or security professional.*