A European Union proposal that would require automated scanning of private digital communications has reached a deadlock after six rounds of negotiation, with no resolution in sight before talks resume in November. Known informally as Chat Control 2.0, the measure is framed as a tool to combat child sexual abuse material online. Its scope, however, extends into territory that touches nearly every person who sends a message, photo or file within the bloc's borders.
From Voluntary Scanning to Mandatory Surveillance
The current legal framework, in place since 2021 and set to expire in 2028, allows communication platforms to voluntarily scan content for illegal material. Chat Control 2.0 would replace this opt-in system with a mandatory one. Under the proposal, service providers would be compelled to deploy detection technology across their platforms, scanning messages, images and files before they are sent or stored. The central dispute among EU institutions is not whether this technology should exist, but who it should target. The European Parliament has pushed for scanning limited to individuals already under suspicion. The Council of the European Union has pressed for a broader, population-wide approach - one that would not distinguish between a suspect and an ordinary citizen messaging a friend.
What Scanning Encrypted Messages Actually Means
End-to-end encryption works by ensuring that only the sender and recipient of a message can read its contents - not the platform carrying it, not an internet provider, and not a government. This design is what makes encrypted messaging apps a trusted tool for journalists, dissidents, lawyers and ordinary users who value confidentiality. Chat Control 2.0 would require scanning to happen on the device itself, before encryption is applied - a method often called client-side scanning. In practice, this creates a structural weakness in the system. Any mechanism built to inspect content before it is encrypted can, in principle, be repurposed, misused or exploited by actors other than the intended authorities. Security researchers have long warned that there is no way to build such a backdoor that remains accessible only to the "right" people.
The Problem With Automated Detection
The proposal relies on artificial intelligence to flag suspicious content across the communications of hundreds of millions of people. Automated classifiers of this kind are known to struggle with context, nuance and intent - a medical photo, a joke between friends, or an image shared for entirely legitimate reasons can be misread by an algorithm trained to spot patterns rather than understand meaning. A 2023 study commissioned by the European Parliament itself concluded that such systems would generate high error rates and a substantial volume of false positives. Each flagged message potentially triggers human review, meaning private content could be examined by a person entirely unconnected to any wrongdoing.
Part of a Wider Regulatory Pattern
Chat Control 2.0 does not exist in isolation. It follows the Digital Services Act, which already gives the EU substantial power to compel platforms to remove content deemed harmful, under threat of fines reaching six percent of global revenue. Critics of that law have argued it pressures companies toward over-removal of legitimate speech to avoid penalties. Mass message scanning would add a surveillance layer on top of an already assertive content-moderation regime, combining oversight of what people say publicly with inspection of what they say privately.
What Comes Next
No EU member state disputes the urgency of stopping child exploitation online. The disagreement is over method. Targeted investigation based on judicial authorization is a long-established practice in democratic states; indiscriminate scanning of an entire population's communications is not. With negotiations resuming in November, the outcome will shape whether digital privacy in Europe remains a default right or becomes something granted only to those who are not, for the moment, under suspicion.
