Chat Control: the EU and the end of the private message
Since 2022 the European Commission has pushed a law to scan private messages. In November 2025 the Council dropped mandatory scanning of encrypted messages — "voluntary" scanning and risk-mitigation duties remain. EFF: "After Years of Controversy, the EU's Chat Control Nears Its Final Hurdle."
Summary
The Commission’s CSAR proposal (2022) originally mandated scanning of private messages — including end-to-end encrypted apps like Signal. After years of resistance (EDRi, EFF, Signal itself), the Council removed the mandatory scan requirement for encrypted communication from its negotiating position (26.11.2025). What remains: “voluntary” detection (in practice: non-E2EE platforms scanning themselves), risk-mitigation obligations, and detection orders for services. EFF notes voluntary scanning currently lacks a legal basis in the EU, operating under a derogation expiring 2026. The trilogue is pending.
Debunking
False: “Chat Control is dead.” — Only the worst part (mandatory E2EE scanning) was dropped. Voluntary scanning, risk duties, and detection orders remain in the text.
Also false: “Only criminals need worry.” — The scans targeted ALL messages. If message contents are no longer private, private communication no longer exists — for anyone.