Chat Control: Why the EU Wants to Scan Everyone’s Messages

Published: August 5th 2025, 22:45
Category: Digital Policy & Privacy

Illustration of EU Chat Control: smartphone with chat bubbles being scanned by LeonardoAI

Chat Control: The Basics
The EU’s proposed Regulation to Prevent and Combat Child Sexual Abuse (nicknamed “Chat Control”) would let authorities order platforms to detect, report and remove illegal content — including in private chats. Critics warn the plan could lead to generalised scanning and undermine end‑to‑end encryption for 450+ million people.

Private messaging shouldn’t become a checkpoint

The stated aim is child protection. The practical effect is a system that examines everyone’s private conversations by default. That flips the EU’s usual standard — targeted investigation — into surveillance first.

A better balance is possible: strengthen parental tools and education, pursue suspects with warrants, and remove hosted illegal material fast — without wiring scanners into every app for 450 million people.

What the Chat Control does?

Scanning orders: Courts could compel services to scan private messages for known CSAM, new material, and even “grooming” patterns.
Client‑side checks: For end‑to‑end encrypted apps, that implies on‑device scanning before messages are sent — the only way to inspect E2E content.
EU Centre: A new body would run hash lists, receive reports, and forward cases to national police.
Universal scope: This isn’t targeted at suspects. Everyone’s chats could be analysed if orders are issued to the platform.

“In practice, the proposal risks de facto generalised and indiscriminate scanning of private communications.”
— EU Data Protection Authorities (EDPB & EDPS), Joint Opinion 04/2022

Why “scan only kids’ accounts” isn’t a workable fix

Universal age checks: To know who is a minor, services must identify every user. That means extra data collection (IDs, face/voice inference, or behaviour profiling) and new breach risks.
Mixed conversations are normal: Minors chat in family, school and community groups that include adults. Filtering “only children’s” chats still requires screening both sides.
Encryption gets bypassed: On-device (client-side) scanning inspects messages before they’re encrypted, weakening end-to-end protection for all users, not just minors.

Status: August 2025

Council push: Under Denmark’s EU presidency, ministers are preparing a vote in October 2025.
Key swing: Several states back a tougher text; Germany’s final position could make or break it.
Not law (yet): Parliament and Council still have to agree a final text. Expect heavy amendments — or a block.

What could possibly go wrong?

False positives: Imperfect AI flags memes, private photos, or jokes — and ordinary people end up investigated.
Scope creep: Once mass scanning exists, tomorrow’s target can be copyright, dissent, politics.
Security risks: Backdoors and on‑device scanners are attack surface — for criminals and hostile states too.
Chilling effect: People self‑censor when private spaces stop being private.

The Fix‑EU take: protect kids without mass surveillance

Target suspects, not everyone: Use warrants, tip‑lines, and hosted‑content takedowns instead of scanning E2E chats.
Parental tools, not platform peeping: Improve opt‑in safety features for minors; teach families digital hygiene.
Defend encryption: Keep the lock on private correspondence — it protects victims and activists too.
Real transparency: Major surveillance powers need sunset clauses, audits, and parliamentary control — or they grow.

Jargon Buster

CSAM: Child Sexual Abuse Material — illegal images/videos.
E2E encryption: Only sender and recipient can read messages; the service can’t.
Client‑side scanning: Checking content on your device before it’s encrypted/sent.

Your Opinion:

Final thoughts

No one should accept a Europe where private messaging is private in name only. Protect children, yes — but not by treating every citizen like a suspect. Write a better law.