The European Union's long-running debate over digital privacy and child protection has reached a critical juncture. A temporary measure that permits online platforms to voluntarily scan for known child sexual abuse material has been extended until April 2028, but the real battle lies ahead: the permanent legislation known as 'chat control 2.0' could fundamentally alter how private messaging works across the continent.
First introduced by the European Commission in 2021, the temporary rule allows companies to detect and report known abuse images. This framework nearly collapsed earlier this year when it expired on 3 April, was rejected by the European Parliament's civil liberties committee in March, and then survived a fast-tracked vote on 9 July by a narrow margin—a motion to reject it fell just short of the required majority. The extension gives negotiators more time, but the underlying tensions remain unresolved.
The Stakes of Chat Control 2.0
The permanent proposal, often referred to as 'chat control 2.0', goes far beyond voluntary scanning. It would require platforms to conduct mandatory risk assessments, comply with detection orders, and scan user messages—including encrypted ones. Early drafts explicitly mentioned scanning encrypted content, which has sparked fierce opposition from privacy advocates, tech companies, and some member states.
Negotiations between the European Parliament, the Council of the EU, and the Commission have been ongoing since December 2025. The fifth round of talks, held on 29 June, ended in a deadlock over the mandatory scanning requirement. Negotiators will not reconvene until September, leaving the future of the law uncertain. As we previously explored, this has become the EU's defining digital rights battle, pitting child safety against fundamental privacy protections.
Proponents argue that scanning is essential to combat the proliferation of child sexual abuse material online. They point to estimates from the European Commission that over 3 million reports of such material were made in 2023 alone. Opponents, including digital rights groups and encryption advocates, warn that mandatory scanning would effectively end private, end-to-end encrypted communication as we know it. They argue that any scanning system capable of detecting abuse material could also be used for surveillance of political dissent, journalism, or personal conversations.
The debate has also highlighted divisions among member states. Germany and the Netherlands have expressed strong reservations about mandatory scanning, while France and Poland have pushed for more robust measures. The European Parliament's position has shifted over time, with the civil liberties committee initially rejecting the temporary extension before the full Parliament narrowly approved it.
Broader Implications for Digital Rights
The chat control saga is part of a wider European push to regulate the digital sphere. The EU has already enacted the Digital Services Act and the Digital Markets Act, and new transparency rules under the AI Act took effect recently, requiring labelling of deepfakes and chatbots. These laws aim to create a safer online environment, but critics argue that chat control crosses a red line by undermining encryption.
If the permanent law passes in its current form, it could set a global precedent. Europe has often led the way on data protection—the General Data Protection Regulation (GDPR) became a benchmark worldwide. A mandate to scan encrypted messages would represent a sharp reversal of that legacy, potentially forcing messaging apps like WhatsApp, Signal, and Telegram to either break their encryption or withdraw from the European market.
The outcome also has implications for the EU's relationship with the United Kingdom and Switzerland, both of which have their own approaches to online safety. The UK's Online Safety Act, passed in 2023, includes provisions for scanning encrypted messages, but enforcement has been delayed amid similar controversies.
For now, the temporary extension provides a breathing space, but the fundamental question remains: can Europe protect children online without sacrificing the privacy that underpins modern communication? The answer will shape digital life for millions of Europeans—and likely influence policy far beyond the continent's borders.
