A European Union proposal that would require automated scanning of private digital messages remains unresolved after six rounds of negotiation, with no consensus yet reached between the European Parliament, the Council and the European Commission. Known informally as Chat Control 2.0, the measure is framed as a tool against child sexual abuse material. But its scope - potentially extending to every message sent by every citizen in the bloc - has turned it into one of the most consequential digital rights disputes in Europe today.
From Voluntary Scanning to Mandatory Surveillance
Since 2021, platforms operating in the EU have been permitted, on a voluntary basis, to scan private communications for illegal content related to child exploitation. That arrangement is due to expire in 2028. Chat Control 2.0, first introduced in 2022, would replace it with something far more sweeping: a legal obligation for messaging services to detect and report suspect content, using automated systems applied indiscriminately to users regardless of suspicion.
The central disagreement, still unresolved in the latest trilogue talks, is whether scanning should be targeted at individuals already linked to abuse investigations, as the European Parliament has proposed, or applied universally across the population, as some member states within the Council favor. That distinction is not a technicality. It is the difference between judicially supervised investigation and continuous, suspicionless monitoring of private life.
Why Scanning Encrypted Messages Creates New Risks
End-to-end encryption exists so that only the sender and recipient of a message can read its contents - not the platform, not an internet provider, and not a government. Chat Control 2.0 would require scanning to occur before encryption is applied, a technique often called client-side scanning. In practice, this means software installed directly on a person's device would examine messages, photos and files before they are ever protected by encryption.
This approach does not technically "break" encryption, but it defeats its purpose. Any mechanism built to inspect content on a device can, in principle, be repurposed, misused or exploited by outside actors. Security researchers have long warned that introducing a scanning layer into a private communication system creates a new point of vulnerability - one that could be targeted by cybercriminals or expanded by future governments for purposes well beyond child protection.
The Problem With Automated Detection
Artificial intelligence systems tasked with identifying illegal imagery or grooming language do not operate with perfect accuracy. A 2023 European Parliament study examining this specific proposal concluded that such systems would likely generate a high rate of false positives - flagging innocent conversations, family photos or medical images as suspicious. At the scale of hundreds of millions of users, even a small error rate translates into an enormous volume of wrongly reported citizens, with real consequences for those swept up by mistake.
This is the practical argument against Chat Control 2.0, separate from the civil liberties one: a system this blunt may not even achieve its stated goal effectively, while imposing surveillance on an entire population to catch a comparatively small number of offenders.
Part of a Wider Pattern of Digital Regulation
Chat Control 2.0 does not exist in isolation. It follows the Digital Services Act, which gives EU regulators substantial power to compel platforms to remove content deemed harmful, with penalties reaching six percent of global revenue for non-compliance. Critics of that law have argued it pressures companies toward over-removal of legitimate speech to avoid risk. Chat Control 2.0 would add a surveillance layer to that content-governance structure, extending oversight from public posts into private, personal communication.
Negotiations are expected to resume in November. The outcome will determine whether the EU settles on a narrower, suspicion-based system respecting the Parliament's position, or moves toward the blanket monitoring that privacy advocates, security experts and digital rights groups have warned against. For a bloc of roughly 450 million people, the decision will shape the boundary between public safety and the right to a private conversation for years to come.