Yesterday, the EU governments re-enacted the suspicionless mass scanning of private communications (“Chat Control 1.0”) with one vote against (Hungary), one abstention (Belgium) and without the approval of the European Parliament (a majority of voting MEPs had voted against the regulation). As a result, US providers like Meta or Google are once again permitted to conduct the controversial, warrantless mass scans of private chats and messages until 3 April 2028.

A symbolic exemption was adopted for encrypted communications—though in practice, service providers do not scan these anyway, so nothing changes here. Ireland and France nevertheless criticized the symbolic exemption yesterday. While a majority of Members of the European Parliament also voted to restrict the scanning of private communications strictly to suspects identified by the judiciary (322 to 255 votes), this central limitation is not part of the final regulation. The conservative leadership of the EU Parliament had scheduled the vote for the last day before the summer break, and as anticipated, not enough MEPs showed up to reach the required absolute majority to pass this amendment.

Dr. Patrick Breyer, civil liberties activist and former Pirate Party Member of the European Parliament (MEP), comments:

The fact that Chat Control 1.0 is now becoming law without the approval of the elected European Parliament is not what I consider democracy. The tech industry wins, but our children lose out. The so-called ‘protection gap’ is a myth designed to prolong a five-year failure. This system overwhelms the police with false alarms, robbing them of desperately needed capacity to investigate abusers. Instead of protecting children, the Chat Control system harms victims while simultaneously criminalising children themselves en masse. Blanket chat control is just as unacceptable as indiscriminately opening everyone’s physical post.

Trying to protect children with indiscriminate mass surveillance is as ineffective as frantically mopping the floor while the tap is still running. The latest German police data show this system is broken: over half of all US tech industry reports are legally irrelevant, a record 113,000 personal photos, videos and chats were wrongfully leaked last year in Germany alone, and thousands of teenagers were criminalised en masse. The current system doesn’t protect children; it subjects them to algorithmic mass surveillance and criminalisation.

It is time for a paradigm shift away from the illusion of security provided by Big Tech’s mass surveillance towards what actually works. Genuine child protection means targeted undercover police work against perpetrator rings where abuse and exploitation are committed. Genuine child protection means the systematic searching and removal of publicly accessible abuse material at the source, and requiring app providers to implement ‘security by design’ to stop cyber grooming of our children before it starts. Clinging to suspicionless mass scanning sabotages this overdue paradigm shift.

What happens next?

The interim regulation adopted by Council will be published in the EU Official Journal in the coming days, enter into force three days later, and then apply until April 2028, or until an agreement on a permanent regulation is reached. Negotiations for the latter will resume in September. The core dispute between the EU Parliament, member state governments, and the EU Commission remains the scanning of private chats: should it be indiscriminate, or targeted at criminal suspects?

What changes with the return of Chat Control 1.0—and what stays the same

• What is coming back: US tech companies are once again allowed to scan private messages without a warrant or prior suspicion. This affects direct messages on platforms like Instagram, Discord, Snapchat, Skype, and Xbox, as well as emails via Google’s Gmail and Apple’s iCloud.
• What remains unchanged: Public social media posts and files hosted in cloud storage could already be scanned without this exemption law. Furthermore, private messages can, independently of the regulation, always be reported by users, or monitored by authorities using targeted, court-ordered wiretapping under national law.
• What is still NOT being scanned: End-to-end encrypted chats, such as those on WhatsApp, have always been exempt from these scans. Additionally, European providers of messaging and email services have never implemented chat control measures anyway.

Why Chat Control is the wrong approach

• Since 2022, the volume of suspected abuse reports from the US has already dropped by 50 percent due to the growing use of message encryption anyway.
• According to EU Commission figures, mass scanning of private chats accounted for only 36 percent of all abuse reports in 2024 (the majority came from public posts and cloud storage).
• The German Federal Criminal Police Office (BKA) reports that 52 percent of all incoming alerts are not criminally relevant in the first place. Furthermore, under these laws, police are also required to prosecute fictional depictions (such as Hentai) and AI-generated fictional content.
• 40% of “child pornography” investigations in Germany targeted children (ages 10-14) themselves, affecting over 8,000 children in 2025. According to the BKA, children often take the reported photos themselves or share imagery without thinking.
• 53% of German police investigations for “youth pornography” targeted minors, criminalising more than 12,000 teenagers in 2025. The BKA notes: Exploring sexual identity now happens online, regularly involving the creation and sharing of intimate files of themselves or peers (“Sexting”).
• Under the chat control system, an estimated 99 percent of reports generated by the Meta corporation consist of previously known material, which generally does little to stop ongoing, active abuse. Decisive for the identification and rescue of victims are undercover investigations in perpetrator rings and targeted measures against concrete suspects – not the mass searching of private communications of uninvolved persons.
• The EU Commission admits there is no evidence that suspicionless scanning of private communications has led to an increase in criminal convictions or in rescued children.

Talk of an averted “protection gap” is therefore highly misleading: The most effective law enforcement tools—court-ordered wiretaps, user reports, and the scanning of public platforms and cloud storage—were always fully maintained. The only practice that was impermissible since April was the indiscriminate, warrantless searching of private, unencrypted messages of innocent people on a handful of US platforms.

Background: The deadlock over a permanent solution

In parallel, negotiations are ongoing for a permanent regulation to protect children from sexualized online violence (the “CSAM Regulation” or “Chat Control 2.0”). In these talks, the EU Parliament is pushing for a paradigm shift in how we approach online child safety. It demands:

• Mandatory detection orders against suspects, rather than blanket mass scanning of private communications left to the tech industry’s discretion.
• An EU Child Protection Centre tasked with the systematic removal of known abuse material from the public internet.
• Strict security standards for messaging apps (“Security by Design”) to protect children from cyber grooming.

This permanent legislation has not been adopted because EU member states insist on maintaining the old approach of voluntary, suspicionless scanning of private communications. Critics warn that repeatedly extending the interim rules removes the political pressure needed to reach a viable, permanent agreement. Ultimately, prolonging the status quo threatens to derail real progress on child protection.

Patrick Breyer sums up the problem:

As long as EU governments can use procedural loopholes to continually extend their comfortable status quo of voluntary, indiscriminate mass scanning, they have no reason to engage with the Parliament’s targeted, legally sound, and far more effective child protection strategy.

However, the re-enactment of this temporary regulation is merely a setback; the political battle over the permanent ‘Chat Control 2.0’ is just getting started. The resistance we saw in Parliament was so strong that finding a majority for permanent, suspicionless mass scanning in future negotiations remains a complete pipe dream.

The Voices of Survivors: “We need privacy to bring abusers to justice”

Contrary to claims that mass scanning aids investigations, survivors of sexual violence explicitly emphasize that Chat Control does not help victims:

Alexander Hanff, survivor of child sexual abuse and IT expert, clarifies:
“As a survivor I relied on confidential communications to tell my story and find justice for 28 schoolboys—myself included—resulting in the conviction of multiple offenders. We survivors need privacy, because without it we lose our voice. Chat Control was not created to protect children. It was about Big Tech companies like Meta or Google wanting access to our data for profiteering, and states attempting to expand mass surveillance. The EU Commission has wasted five years and millions of euros on algorithms that cannot protect children and were never meant to. This money should have been diverted to real policing and support for survivors, millions of whom have never received any support at all.”

Marcel Schneider* (name changed), a survivor who is currently suing Meta in court over its voluntary Chat Control, adds:
“Anyone mourning the end of Chat Control has not understood what actually helps survivors of sexual violence. Mass surveillance by corporations like Meta does not prevent abuse. Genuine protection means: deleting material at the source, proactive police work on the Darknet, and apps that are safe by design for children from the very start.”

Dorothée Hahne, founding member and board member of the survivors’ initiative MOGiS e.V. (A Voice for Survivors), emphasizes the danger mass surveillance poses to victims themselves:
“As survivors, we see our ‘safe spaces’, our protected areas and communication channels, endangered or destroyed by this. For survivors, this need is existential.”

Full text of the regulation

patrick-breyer.de/en/eu-govern…