CHAT CONTROL I. - EU's Chat Control voting & what it means
Yesterday, much of the political discussion revolved around the EU's latest vote on “Chat Control”.
The name is commonly used for two separate pieces of EU legislation that are at very different stages.
Chat Control 1
was introduced as a temporary measure and began applying on 3 August 2021.
It created an exception to the EU’s normal privacy rules, allowing providers of messaging and email services to voluntarily scan private communications for suspected child sexual abuse material, report users and remove flagged content.
The measure was later extended until 3 April 2026, when it expired after the European Parliament refused to prolong it again.
The Council has since attempted to revive the system, while Parliament is demanding additional restrictions, particularly the exclusion of end-to-end encrypted communications.
The two institutions must now agree on a common text before Chat Control 1 can return.
Chat Control 2
is the much larger and more consequential permanent law proposed by the European Commission in May 2022. It has not yet entered into force.
The proposal would require online services to assess the risk of their platforms being used for child sexual abuse, introduce preventative measures and comply with official detection orders requiring them to search for known abuse material, previously unknown material and possible grooming.
It would also establish a new EU Centre responsible for coordinating reports and assisting national authorities.
For ordinary users, the crucial question is whether these detection obligations can be applied to private and end-to-end encrypted communications.
Encryption protects a message while it travels between devices, but it cannot protect that message if the application or operating system is required to inspect it before encryption takes place.
This is why the argument over Chat Control 2 is not merely about illegal images or the moderation policies of technology companies. It is about whether private correspondence should remain private, or whether every device should eventually contain a mechanism capable of examining communications before they are sent.
What happens next is therefore split between two parallel negotiations.
The institutions must decide whether and in what form the expired temporary system will return, while they continue negotiating the permanent Chat Control 2 regulation.
Nothing requiring the general scanning of encrypted messages has yet become EU law, but the legal and technical foundations for such a system are now being debated openly.
Yesterday, The European Parliament voted on whether to revive the expired temporary Chat Control 1 rules - the old exemption that allowed communication providers to voluntarily scan private messages for child sexual abuse material.
A simple majority of MEPs wanted to reject the Council’s version.
The vote was 314 in favour of rejection, 276 against and 17 abstentions.
But because this was Parliament’s second reading, rejection required an absolute majority of all MEPs, currently 360. Since only 314 voted to reject it, the Council text was not defeated.
Democracy, apparently, now includes losing after receiving more votes.
Parliament then adopted amendments to the Council proposal.
The most important amendment excludes communications that use, have used or will use end-to-end encryption. In other words,
Parliament did not approve the Council’s unrestricted revival of Chat Control 1.
It approved a more limited version that would continue allowing voluntary scanning of certain unencrypted communications while protecting end-to-end encrypted services from the temporary law.
Nothing entered into force yesterday.
Chat Control 1 remains expired for now. Parliament’s amended text now goes back to the Council, which has three months to accept all the amendments.
What is decided during the next stage will determine whether encryption continues to mean that only the sender and recipient can read a message, or merely that nobody else can read it after the device has already inspected it.
Fazit
For now, encrypted communication is "safe" in Europe.
Understandable goals vs all out surveillance
Laws against child sexual abuse and grooming are easy to support in principle.
The more difficult question is what happens once governments possess a system capable of inspecting private communications on a massive scale.
Such infrastructure is rarely guaranteed to remain limited to the original offence forever.
Once devices and services can automatically search messages, it's easy to add other themes: terrorism, extremism, disinformation, hate speech, public disorder or whatever the political priority happens to be at the time.
It is impossible to scan for "child porn" and "grooming" without actually going over all the communication.
A system cannot search private messages for child sexual abuse material or grooming without examining the messages of innocent people as well. The surveillance must come first; suspicion is produced afterwards.
The United Kingdom already offers a warning of how broadly laws regulating harmful communications can be applied.
British police made roughly 12,000 arrests in 2023 under laws covering online messages considered grossly offensive, menacing or knowingly false.
People have been arrested over jokes, social-media posts and memes, including a man detained after posting an image mocking the expanding Pride flag.
The real question is therefore whether Europeans are willing to construct a system whose limits will depend on the restraint of governments.
This is NOT a satirical article.
You might also like
