Chat Control: EU vote risks private messaging

The EU is advancing a “Chat Control” regulation that would compel messaging services to scan private communications for child abuse content, including on end-to-end encrypted apps like WhatsApp and Signal. The model relies on pre‑encryption, device‑level analysis that turns personal phones into scanning nodes, fundamentally altering the expectation of privacy.

What it is

The proposal enables broad “detection orders” covering messages, photos, voice notes, and files, with scope extending to encrypted services. To make this feasible, providers would implement client‑side scanning that inspects content before it is encrypted or after it is decrypted on devices.

Why it harms privacy

• Normalizes mass surveillance by scanning everyone’s messages without individualized suspicion or judicial warrants.

• Undermines end‑to‑end encryption, creating systemic weaknesses that can be exploited by criminals, abusive partners, or hostile states.

• Produces false positives and over‑flagging, particularly for “grooming” classifiers, sweeping innocuous content into law‑enforcement workflows.

• Sets a precedent other governments can copy, chilling speech and eroding global privacy norms.

Impact on WhatsApp and Signal

Both services depend on end‑to‑end encryption to ensure only senders and recipients can read messages. Mandated scanning would either weaken that guarantee, force intrusive on‑device analysis, or prompt providers to withdraw features or service availability rather than introduce backdoors.

Legal and security risks

Sweeping, suspicionless scanning conflicts with fundamental rights to privacy and confidentiality of communications. Weakening cryptography increases breach risks for citizens, businesses, journalists, and public institutions, amplifying cybercrime, data theft, and disinformation risks.

Better alternatives

• Targeted, warrant‑based investigations and rapid takedown of known CSAM using proven hash‑matching on non‑E2EE platforms.

• Resourcing specialized units, cross‑border cooperation, and survivor‑centered services.

• Safety by design, age‑appropriate tools, and robust reporting channels that don’t break encryption.

What to watch

Member states are finalizing positions under tight timelines led by the current Council presidency. The decision will signal whether Europe pursues proportionate, targeted child protection or adopts broad scanning that weakens security for everyone.