Chat Control 2.0 - the deal collapsed (public pressure stopped mass surveillance, for now), the threat is not over yet. Round two starts in October:
The dreaded "dirty deal" didn't happen. In the September 29 trilogue, EU negotiators failed to reach a final agreement forcing permanent mass scanning of private chats, a direct result of sustained public pressure and the European Parliament's negotiating team refusing to budge on private communications.
This is what happened Tuesday night:
The Irish Presidency wanted a complete political agreement on the whole CSAR (Child Sexual Abuse Regulation) package. That didn't work out because the Council pushed to allow essentially unrestricted mass scanning of private messages and files, and Parliament's negotiators held firm that scanning must stay limited to people actually connected to child sexual abuse cases and not the general population.
There was also a smaller but meaningful technical win: the text will now clarify that authorities can't force voluntary scanning of private chats through the back door of "mitigation measures", closing off a loophole that would have let regulators pressure platforms into scanning without ever issuing a formal order.
Where negotiators did agree was on public content, social media posts and publicly accessible cloud files. The EU Centre's mandate to crawl public spaces for both known and new CSAM (Child Sexual Abuse Material) got a tentative green light, and administrative authorities (not just courts) can now order hosting providers to continuously scan public uploads for known material, regardless of provider size. Notably, this applies to all public uploads, not just those from users already under suspicion, which was Parliament's original, narrower proposal.
It's still an important situation even though nothing is scanned privately, yet:
The proposal combined two mechanisms: a "voluntary" track where providers submit a scanning plan for private chats that goes into effect automatically unless a regulator actively vetoes it, and a "mandatory" track letting administrative agencies, with no court order required, compel providers to scan private messages and emails using AI-based content classification, not just known-image matching. Both tracks used weak thresholds that wouldn't limit scanning to actual criminal suspects.
The other unresolved threat is Chat Control 1.0, the current voluntary scanning regime already running until 2028. Council may try to keep it alive as a parallel loophole even if Parliament blocks the new mandatory powers. German police data makes the stakes concrete: over half of investigations under this regime target minors themselves for consensual sexting, and 75% of all flagged chats turn out not to be criminally actionable.
What comes next
October: technical-level experts continue negotiating rules for non-public detection.
November: a final political trilogue attempt is expected.
The core risk stays open: nothing prevents the Council from returning with the same private-chat scanning demands, or trying to keep Chat Control 1.0 running as a fallback loophole.
Join our subreddit for more relevant news like these: r/xprivo
