On Wednesday, representatives from EU member states reached a pivotal agreement to advance the contentious ‘Chat Control’ legislation aimed at addressing child sexual abuse material (CSAM) across messaging platforms and online services.

“Every year, millions of files are shared that depict the sexual abuse of children… This is completely unacceptable. Therefore, I’m glad that the member states have finally agreed on a way forward that includes a number of obligations for providers of communication services,” said Danish Minister for Justice, Peter Hummelgaard.

This agreement is the result of long-standing divisions among member states and privacy advocates, and it will now move into final discussions with the European Parliament on how platforms can be mandated to scan user content for suspected child sexual abuse and grooming.

The current CSAM framework is expected to end on April 3, 2026, with plans for it to be succeeded by the new regulations after further talks with lawmakers.

EU Chat Control Laws: Major Points

Recently, efforts to implement compulsory scanning of private messages faced challenges when the mandate for client-side scanning was excluded from the latest draft proposal, while adjustments were made to ensure providers are not unduly overburdened by detection obligations:

“Nothing in this Regulation should be understood as imposing any detection obligations on providers.”

In its latest revisions, the EU Council maintains the existing CSAM framework but specifies that service providers are expected to collaborate with a newly created EU Centre on Child Sexual Abuse to facilitate the regulation’s implementation. The renewed draft has eliminated mandatory scanning for all private messages, but extends the legal basis for voluntary CSAM detection indefinitely.

A Compromise That Leaves Many Unsettled

In a bid to resolve the deadlock surrounding Chat Control, Danish negotiators worked to remove the most contentious proposal—the blanket scanning mandate. This had previously required end-to-end encrypted platforms like Signal and WhatsApp to systematically inspect users’ messages for inappropriate content. However, it stands as a compromise that fails to fully satisfy either side. Law enforcement officials have expressed concern that harmful content will persist in fully encrypted applications, while digital rights organizations believe the agreement still enables extensive monitoring of private communications and mass surveillance.

Lead negotiator Javier Zarzalejos has urged immediate negotiations between the Council and Parliament to establish a sound legal framework that will effectively fight online child sexual abuse while respecting encryption rights.

“I am committed to work with all political groups, the Commission, and member states in the Council in the coming months in order to agree on a legally sound and balanced legislative text that contributes to effectively prevent and combat child sexual abuse online,” Zarzalejos stated.

Despite the Council’s praise for these protective measures, former Dutch MEP Rob Roos has criticized it, likening their approach to actions during the ‘East German era’, claiming it infringes upon the privacy rights of 450 million EU citizens. He also cautioned that Brussels was operating under opaque conditions that may lead to a slide towards digital authoritarianism.

Telegram’s CEO, Pavel Durov, highlighted the exemption from message monitoring for EU officials, suggesting that the EU is leveraging emotional appeals regarding child protection to advance mass surveillance and censorship efforts.

“The EU weaponizes people’s strong emotions about child protection to push mass surveillance and censorship. Their surveillance law proposals conveniently exempted EU officials from having their own messages scanned,” Durov remarked.

Broader Implications for Privacy

The progress on Chat Control comes amid a global crackdown on privacy tools, with both European regulators and law enforcement agencies targeting significant privacy projects. In response, Ethereum co-founder Vitalik Buterin has reinforced the need for privacy as a fundamental right, contributing substantial resources to decentralized messaging initiatives, asserting their crucial role in safeguarding our digital privacy.

Alex Linton from Session emphasized that evolving regulatory and technical changes pose serious threats to the future of private messaging, indicating a crucial need for heightened global awareness of these challenges.