A European Union proposal to scan the private messages of hundreds of millions of citizens remains stalled but very much alive. Known informally as Chat Control 2.0, the measure would require messaging services to detect and report material related to child sexual abuse - a goal few would dispute. The method it proposes, however, has turned a child-protection initiative into one of the most contested digital rights battles in Europe's recent history.
From Voluntary Scanning to Mandatory Surveillance
The current legal framework, in place since 2021 and due to expire in 2028, allows platforms to voluntarily scan for illegal content. Chat Control 2.0, first tabled in the European Parliament in 2022, would replace this with an obligation. Providers of messaging apps, email services and other communication tools would be compelled to deploy detection technology across their platforms, scanning content before or after it is sent, regardless of whether a user is suspected of any wrongdoing.
Negotiations between the Parliament, the Council of the EU and the European Commission - a process known as trilogue - have failed to produce agreement across six rounds of talks. The central dispute is about scope. Parliament has pushed for surveillance limited to individuals already under suspicion. The Council has repeatedly favoured a broader mandate covering all users, a divide that has kept the legislation in deadlock for years.
Why Encryption and AI Are at the Centre of the Dispute
End-to-end encryption is designed so that only the sender and recipient of a message can read its contents - not even the service provider has access. Chat Control 2.0 would require scanning to happen regardless of encryption, meaning providers would need to build in some mechanism to inspect content before it is encrypted or after it is decrypted. Security researchers have long warned that any such access point, however well-intentioned, creates a vulnerability that can be exploited by malicious actors, undermining the protection encryption is meant to provide for everyone, not just suspected criminals.
The reliance on artificial intelligence to carry out this scanning adds a further layer of concern. A 2023 study commissioned by the European Parliament on this proposal concluded that such detection technology would generate high error rates and a substantial number of false positives. In practice, this means innocent messages, photos and conversations could be flagged, reviewed and potentially reported to authorities without any wrongdoing having occurred.
Part of a Wider Pattern of Regulation
Chat Control 2.0 does not exist in isolation. It follows the Digital Services Act, adopted in 2022, which imposes fines of up to six per cent of global revenue on major platforms that fail to remove content designated as hate speech or disinformation. Critics argue that the DSA's reliance on EU-approved "trusted flaggers" to identify problematic content has already given regulators significant influence over what speech remains visible online. Seen together, the two measures suggest a broader shift in how Brussels approaches digital life - treating platforms less as neutral infrastructure and more as instruments of enforcement.
Supporters of Chat Control frame it as a necessary tool against a genuine and serious crime. Opponents counter that the same outcome could be pursued through targeted investigation of suspects rather than blanket surveillance of the entire population. The distinction matters: one approach preserves the presumption of innocence, the other quietly dispenses with it.
What Comes Next
Talks are expected to resume in November, with no guarantee of resolution. The outcome will shape not only how Europeans communicate privately but also what precedent is set for government access to encrypted data elsewhere in the world. Privacy advocates, technologists and civil liberties groups continue to press for a narrower, suspicion-based approach, arguing that mass scanning of private communications is a disproportionate response that risks normalising surveillance as a default condition of digital life rather than an exceptional measure reserved for genuine threats.