Chat Control approved: Certain EU countries will see your private messages. Is yours on the list?


Privacy reshared this.

in reply to Victor

At least if you just do phone calls the attack surface is reduced... They can scan your calls maybe, but not your entire chat history with all of your contacts and give it to an AI which could profile you based on that + you are not scanned on everything else you do on your phone / locked into proprietary ecosystems.

The ideal would just be using a Linux platform and using something like xmpp, but who are you gonna convince to use it? People use what they are used to use, if it's not popular messaging apps is phone calls.. And now it seems a more private alternative..

Questa voce è stata modificata (3 mesi fa)
in reply to Pierre-Yves Lapersonne

Countries which support the implementation of Chat Control:

Spain, Romania, Portugal, Malta Lithuania, Hungary, Ireland, France, Denmark, Croatia, Cyprus, and Bulgaria.

Countries that are undecided:

Belgium, Greece, Italy, Latvia, Slovakia, and Sweden.

Countries which oppose Chat Control:

Slovenia, the Netherlands, Poland, Luxembourg, Germany, Estonia, Finland, the Czech Republic, and Austria

in reply to dave

Can someone help me understand the likely outcome in countries that implement chat control? Will those governments force Google and Apple to remove apps that do not comply (e.g. Signal) from their official app stores? Will those governments somehow detect users who find workarounds and go after them? I figure most people in those countries will shrug their shoulders and move on with their lives, but how will this impact citizens who do not wish to comply?
Questa voce è stata modificata (3 mesi fa)
in reply to Armand1

It seems the reason companies are currently allowed to do this in the EU is because there was in 2020 a temporary derogation from certain provisions of the e-Privacy Directive.

But it was temporary, so it will expire in April 2026. With this new law the intention is to make that "voluntary detection" a permanent thing they allow service providers to do, as a norm. The providers still have the choice to not do it, so I don't think this affects services like signal, as far as I understand.

Questa voce è stata modificata (3 mesi fa)
in reply to DacoTaco

Where is this explained? the article might be wrong then, because it does state the opposite:

scanning is now “voluntary” for individual EU states to decide upon


It makes it sound like it's each state/country the one deciding, and that the reason "companies can still be pressured to scan chats to avoid heavy fines or being blocked in the EU" was because of those countries forcing them.

Who's the one deciding what is needed to reduce “the risks of the of the chat app”? if it's each country the ones deciding this, then it's each country who can opt to enforce chat scanning.. so to me that means the former, not the latter.

In fact, isn't the latter already a thing? ...I believe companies can already scan chats voluntarily, as long as they include this in their terms, and many do. A clear example is AI chats.

Questa voce è stata modificata (3 mesi fa)
in reply to Ferk

I recommend reading the dutch debate : tweedekamer.nl/kamerstukken/pl…

And yes, the latter is currently a thing (but in a weaker form) but will no longer be allowed in april 2026, which is why this law is getting pushed so hard. Currently chats can be asked by police/interpol/... But they need good reasons, and the results can be varying because chat platforms like signal do not keep chat messages/stuff.
The new law forces them to have systems in place to catch or have data for law inforcements. It just allows for 'any system to get the needed info', it no longer says chat scanning is needed directly, but is rather indirectly which is as stupid and bad as before.

in reply to DacoTaco

Thanks for the link, and the clarification (I didn't know about april 2026).. although it's still confusing, to be honest. In your link they seem to allude to this just being a way to maintain a voluntary detection that is "already part of the current practice"...

If that were the case, then at which point "the new law forces [chat providers] to have systems in place to catch or have data for law inforcements"? will services like signal, simplex, etc. really be forced to monitor the contents of the chats?

I don't find in the link discussion about situations in which providers will be forced to do chat detection. My understanding from reading that transcript is that there's no forced requirement on the providers to do this, or am I misunderstanding?

Just for reference, below is the relevant section translated (emphasis mine).

In what form does voluntary detection by providers take place, she asks. The exception to the e-Privacy Directive makes it possible for services to detect online sexual images and grooming on their services. The choice to do this lies with the providers of services themselves. They need to inform users in a clear, explicit and understandable way about the fact that they are doing this. This can be done, for example, through the general terms and conditions that must be accepted by the user. This is the current practice. Many platforms are already doing this and investing in improving detection techniques. For voluntary detection, think of Apple Child Safety — which is built into every iPhone by default — Instagram Teen Accounts and the protection settings for minors built into Snapchat and other large platforms. We want services to take responsibility for ourselves. That is an important starting point. According to the current proposal, this possibility would be made permanent.


My impression from reading the dutch, is that they are opposing this because of the lack of "periodic review" power that the EU would have if they make this voluntary detection a permanent thing. So they aren't worried about services like signal/simplex which wouldn't do detection anyway, but about the services that might opt to actually do detection but might do so without proper care for privacy/security.. or that will use detection for purposes that don't warrant it. At least that's what I understand from the below statement:

Nevertheless, the government sees an important risk in permanently making this voluntary detection. By permanently making the voluntary detection, the periodic review of the balance between the purpose of the detection and privacy and security considerations disappears. That is a concern for the cabinet. As a result, we as the Netherlands cannot fully support the proposal.
Questa voce è stata modificata (3 mesi fa)
in reply to Ferk

Id need to look for it again, but i remember reading she was saying that the current proposal is vague in what it sees as required to prevent what she calls risks. I remember them asking her multiple times if she was against a law to prevent csa and the sharing there off, in which she replied multiple times that she was not, but that the law was too vague about what it constitutes as necessary to prevent it. Did i dream it? ><

Edit: found it!

Mevrouw Kathmann (GroenLinks-PvdA):
Het is niet per se alleen zo dat de huidige praktijk wordt voortgezet. Er zitten bijvoorbeeld ook zinnen in het voorstel die aangeven dat álle risico's moeten worden weggenomen. Het is ongelofelijk vaag, een heel grijs gebied, wat dat betekent. Dat is één. Dat is echt een heel groot risico. Daarnaast noemde de heer Van Houwelingen net al het punt van de leeftijdsverificatie. We hebben niet goed met elkaar kunnen bespreken wat daar nou precies in voorligt en hoe wij daar verder mee om moeten gaan. Dit zijn twee dingen die ik er nu zo uitpik.
Questa voce è stata modificata (3 mesi fa)
in reply to DacoTaco

Ah, I see. Sorry, the text was too long and I'm not dutch so it was hard to spot that for me too.

But I interpret that part differently. I think them saying that there's an ambiguous section about risks does not necessarily mean that the ambiguity is in the responsibility of those who choose to not implement the detection.. it could be the opposite: risks related to the detection mechanism, when a service has chosen to add it.

I think we would need to actually see the text of the proposal to see where is that vague expression used that she's referring to.

Questa voce è stata modificata (3 mesi fa)
in reply to DuskyRo

The thing is.. that even if there are countries publicly rejecting this, once the infrastructure is in place and a backdoor exists due to it being enforced by some other country, how can you be sure it's not being used / exploited?

Even in the (hypothetical) case that the government is not using it (regardless of what they might say to the public), I wouldn't trust that this backdoor would be so secure that nobody else than a government could make use of it.

Questa voce è stata modificata (3 mesi fa)
in reply to Gutek8134

We are essentially manipulated into the belief that centralised internet is good and all. This is a push driven by the governments where the whole infrastructure is redesigned into essentially a police state where the only thing left is fascism.

Decentralisation must stay, and developments towards decentralisation must flow faster than ever. If the whole premise of the internet gets breached then it will be officially over, and we will all suffer in oppression.

in reply to JoeKrogan

I dont see fdroid blocking the app. I think signal is in the guardian project repos. Anyway a repo can just be hosted in switzerland or on tor or something. I would be more worried about govenments blocking access to the signal servers.

All this theatre in the name of protecting kids, Yet the pedo formally known as prince andrew is still walking free.

Questa voce è stata modificata (3 mesi fa)
in reply to CleoCommunist

It’s an open, decentralized protocol used for real-time messaging, so you can find many apps using this protocol, on android there is conversations which is very light and modern, just choose a pseudo and chat, no other registration, it is a paid app on the app store but free on fdroid.
I also used simplex before but it didn't work well enough, the video calls were laggy.
in reply to moretruth

I believe Germany is now in favor of this new proposal, according to fightchatcontrol.eu/

Only Italy, Netherlands, Czech Republic and Poland are against. This seems to be based on "leaked documents from the September 12 meeting of the EU Council's Law Enforcement Working Party".

Questa voce è stata modificata (3 mesi fa)
in reply to Pierre-Yves Lapersonne

For years the plan was to make this scanning mandatory. In early November 2025, however, the Danish government amended the text: scanning is now “voluntary” for individual EU states to decide upon. That small word change was enough for the 27 EU countries to agree on November 26.


If chat control would have been made mandatory, you can bet (and i'd be willing to bet a lot of money on it) that you're going to have AfD in germany and FPÖ in austria (since they're already pretty anti-EU) making a lot of noise about how evil the EU is for infringing on people's privacy. (And they would be right about this, as much as i don't like to agree with them.) This would give them more votes, than they already have.

Making it voluntary is a clever trick of the EU to not make yourself extremely unpopular among the population. Well done, i'd say.

Questa voce è stata modificata (3 mesi fa)
in reply to gandalf_der_12te

It seems the article is misinterpreting things. It's not that it's "voluntary for individual EU states".. but rather "voluntary" for service providers. The service providers don't have to implement this chat detection if they don't want to.

The thing is that if they don't pass something like this, then by April 2026 a bunch of current services that are already doing CP detection would be breaking the law, since the temporary derogation of the e-Privacy Directive will expire. But I don't think this affects services like signal/simplex who voluntarily choose to not try to detect it.

Questa voce è stata modificata (3 mesi fa)
in reply to Pierre-Yves Lapersonne

Dear mods, watch what you remove from these chats, our freedoms are getting fucked, people should be allowed to be indignant.

That being said i hope the legislators sit on cacti all day every day, those fucking assholes are exempt from this bullshit.

They will take my data out of my cold dead hands. It was a matter of time, sure, but I was actually holding on to hope for this one. I am pissed, dismayed even.

Session, signal, simplex are your friends. If those give up the ghost and bend the knee then we are going back to irc and aliases. Fucking shit!

in reply to Pierre-Yves Lapersonne

EU officials are, incidentally, exempt from chat monitoring – which is quite convenient for someone like von der Leyen. Their communication is explicitly NOT to be monitored. The mere fact that those who drafted this law don't want it to apply to them tells you everything you need to know about it.


https://x.com/martinsonneborn/status/1995182586612609241

in reply to Pierre-Yves Lapersonne

Everyone who originally proposed this or otherwise helped in drafting this should be thoroughly investigated under suspicion of foreign affiliation. Chat Control doesn't just start the EU's transformation into a surveillance state. It also weakens its digital defenses. No matter how you look at it, this is treason both towards the European people, as well as towards the individual countries and the Union as a whole.