Chat Control 2.0: Europe is playing with our digital freedoms

It is one small line in an obscure text. An article barely mentioned in the mainstream press. A closed-door meeting in Brussels. And yet, what is being set in motion could well become one of the biggest authoritarian turning points in Europe's digital history.

Behind the misleading name "Chat Control 2.0" lies an attempt to slip in, through the back door, a mechanism for the mass surveillance of private communications online. A text that, if adopted as it stands, would allow your private messages to be scanned, even encrypted ones, would require proof of identity to create an email account, and would bar millions of young people from social media.

And all of this in the name of protecting children.

What exactly is "Chat Control 2.0"?

Officially, the text is called the CSA Regulation, for "child sexual abuse". The European Commission presented it on 11 May 2022. Its first version imposed mandatory detection orders on messaging services, including in encrypted communications. In November 2023, the European Parliament adopted a mandate explicitly rejecting this indiscriminate surveillance, and several member states blocked the initial "Chat Control" project. You could have believed the matter was closed.

It was not. The Commission is back on the offensive, but with a far more devious method: pushing the same measures through under different terms, vaguer and more ambiguous ones.

The new Article 4 of the text would thus require messaging services (from WhatsApp to Telegram, Signal, and even email) to take "appropriate risk mitigation measures". In plain terms? You are not directly forced to scan your users' messages, but if you do not, you will be considered negligent.

This is not regulation. This is bureaucratic blackmail.

Total surveillance, dressed up as prevention

Worse still, this text broadens the scope of surveillance. It is no longer only about scanning suspicious images in search of illegal content. The project paves the way for the automated scanning of texts, metadata and private conversations. By AI. By algorithms. On all your devices.

This goes beyond every fantasy of the totalitarian societies.

Because no AI today can tell the difference between an anxious message from a teenager to his girlfriend and an attempt at sexual predation. Between dark humor and a genuine incitement to hatred. The result? Thousands of false positives. Private conversations siphoned off. Citizens placed under algorithmic surveillance without the slightest tangible suspicion.

And meanwhile, the real predators adapt their tools. Move to other platforms. Slip past the filters. As always.

Will end-to-end encryption survive?

This is the heart of the problem, and it is where the maneuver reads most clearly. In November 2025, under the Danish presidency, the Council of the European Union finally dropped the idea of mandatory scanning. Its position, settled on 26 November 2025, now rests on "voluntary" detection coupled with "risk mitigation" obligations. Presented as a retreat, it is in reality the same logic moved one notch across.

Because a risk mitigation obligation drawn broadly enough amounts to pushing services to weaken their own encryption, on pain of being deemed negligent. That is precisely what digital rights organizations such as EDRi fear: indirect but very real pressure on end-to-end encryption.

In July 2026, an amendment carried in Parliament did try to explicitly exclude end-to-end encrypted communications. But its reach remains uncertain, and the Council is expected to oppose it. Above all, client-side detection, the kind that analyzes your messages on your device before they are even encrypted, never left the table. Encryption that is bypassed at the source is no longer encryption.

Anonymity in the crosshairs

Another point passed over in silence: to "protect minors", Europe is considering imposing mandatory identification to open online accounts.

Translation: the end of anonymity.

You will no longer be able to create an email account, use a messaging service or browse certain services without proving your age. And therefore your identity. A nightmare for journalists, activists, dissidents and whistleblowers. A dream for every authoritarian state.

And this is not conspiracy-theory fantasy. It is written in black and white in the project.

The icing on the cake: the text proposes an outright ban on access to messaging services, social media, and even online games for anyone under 16. No education. No guidance. No discernment. Just brutal exclusion. A digital lockdown under the pretext of safety. As if you could educate by isolating. As if you could protect by cutting off access to the world.

It infantilizes the young and is one more sign of a legislator completely disconnected from real digital practices.

Where does the text stand in the summer of 2026?

Since this article was published, the facts have confirmed the method. A simple recap of the timeline is enough to make it visible.

On 14 October 2025, interior ministers were due to vote on mandatory scanning in the Council. The vote was pulled from the agenda at the last minute: on 7 October, Germany had joined the opposition and formed a blocking minority. A victory, or so we believed.

On 26 November 2025, the Council nonetheless reached an agreement, dropping mandatory scanning in favor of the "voluntary" regime described above. The same measure, under a gentler word.

Then the calendar did the rest. The interim regulation that already allowed platforms to scan messages, what is known as "Chat Control 1.0", expired on 4 April 2026, after Parliament refused to extend it in March. On 2 July 2026, the Council reintroduced the text as its second-reading position. On 7 July, an urgency procedure sent it straight to the plenary, on the eve of the summer recess. On 9 July, 314 MEPs voted to reject it, a majority of those voting. It took 361, the absolute majority of 720. The text passed by default, extended until 3 April 2028.

A regulation rejected by a majority, applied anyway, for want of clearing a procedural threshold, on a July day when the chamber was emptying. As for the permanent regulation, the one that would make detection mandatory, it is not dead: the trilogue negotiations broke down on 29 June 2026 and resume in September.

Neither conspiracy nor coup. Patience, rules of procedure and a month of July. The mechanism I was describing has not budged an inch.

What this says about us

We often talk about AI, cybersecurity, digital sovereignty. But what this bill shows is that in reality it is our fundamental values that are at stake: privacy, freedom of expression, the presumption of innocence, anonymity.

And all of it is sacrificed on the altar of a legitimate but politically exploited fear: the fear of child abuse crimes.

Yes, these crimes exist. Yes, they must be fought. But you do not fight fire by burning down the whole house.

This is not a compromise. It is a sham.

This text does not protect. It surveils.
It does not empower. It infantilizes.
It does not secure. It betrays.
And above all: it is laying, slowly but surely, the foundations of a model of society where surveillance becomes the norm, and freedom an anomaly.

What I propose

Not a "no" on principle. But a "yes" to intelligence.

• Yes to targeted protection ordered by a court.
• Yes to end-to-end encryption for all.
• Yes to a policy of digital education, not suspicion by default.
• Yes to a Europe that protects its children without policing its citizens.

This is not a security law. It is a test of democratic clear-sightedness.

And that test, Europe is failing.

---

Sources

• CSA Regulation proposal (COM/2022/209), 11 May 2022: European Commission, EUR-Lex.
• Full timeline, the Parliament's November 2023 mandate and the postponement of the Council vote in October 2025: Patrick Breyer, "Chat Control".
• Civil society monitoring and analysis: European Digital Rights, "CSA Regulation Document Pool".
• Council position of 26 November 2025, dropping mandatory scanning in favor of a voluntary regime: eucrim, "CSA Regulation: Council Position Reached".
• European Parliament vote of 9 July 2026 and extension of the interim regime until 3 April 2028: Euronews, 10 July 2026.
• End-to-end encryption and the protection of minors: European Parliament, EPRS.