Could the European Union require messaging apps to scan your private conversations? That question remains unresolved as lawmakers negotiate the proposed Child Sexual Abuse Regulation, commonly known as Chat Control.
During talks on September 29, 2026, EU negotiators reached an agreement in principle on detecting child sexual abuse material in publicly accessible content. However, they failed to reach an agreement on private messages.
Learn what the EU has agreed on, what remains undecided, and what the proposed rules could mean for your online privacy.
Is the EU Planning to Scan Private Messages?
The EU has not adopted a law requiring messaging apps to scan everyone’s private conversations. However, certain voluntary detection activities are already permitted, and lawmakers are still deciding what the permanent rules should allow.
Under the temporary regulation reinstated in July 2026, eligible online service providers can voluntarily use detection technologies to identify and report suspected child sexual abuse. The rules exclude end-to-end encrypted communications and remain in effect until April 3, 2028.
The proposed permanent regulation is where the disagreement lies. The Council of the EU supports allowing voluntary detection to continue permanently. The European Parliament, meanwhile, has proposed targeted detection orders subject to safeguards, with end-to-end encrypted communications excluded.
For now, there is no EU-wide requirement to scan all private messages. Whether the final regulation will introduce additional detection obligations, and how these would apply to private conversations, remains under negotiation.
What Is the EU Child Sexual Abuse Regulation?
The European Commission proposed the Child Sexual Abuse Regulation in May 2022. It aims to tackle the circulation of child sexual abuse material (CSAM) online and the solicitation of children for sexual purposes, known as grooming.
Under the proposal, relevant online services, including messaging and hosting providers, would have to assess the risk of abuse on their platforms and take steps to reduce it. The proposed rules also cover detecting and reporting suspected abuse, removing illegal material, and overseeing how providers comply.
The regulation would also establish an EU Centre on Child Sexual Abuse to review reports from service providers, forward relevant information to law enforcement, and support victims seeking the removal of abusive material.
Where Do EU Chat Control Negotiations Stand?
The September talks produced progress on two aspects of the proposed regulation, both concerning publicly accessible content.
Negotiators provisionally agreed that the proposed EU Centre could search public content for known and previously unidentified child sexual abuse material. They also reached an agreement in principle on detection orders for publicly accessible content containing known abuse material. However, the agreement remains conditional on negotiators reaching a deal on the entire detection package.
Private communications remain the main obstacle. According to a Council presidency report, negotiators have yet to settle the scope of voluntary searches of non-public content or whether detection orders could target specific users.
These agreements remain provisional.
How Could Private Message Scanning Work?
The European Commission has identified several technologies used to detect child sexual abuse online, including digital fingerprinting and artificial intelligence (AI) classifiers. Each works differently depending on the material being examined.
For previously identified abusive images or videos, detection systems compare a file’s digital fingerprint, known as a hash, against a database of verified material. A match can flag the file for further review.
Detecting previously unknown material or possible grooming is more complex. AI classifiers analyse images, videos, or communication patterns for similarities to known abusive material or confirmed grooming conversations. Human review helps assess flagged content and reduce errors.
These are established detection methods, but their use under the proposed permanent regulation remains subject to negotiations. The EU has not agreed on additional scanning requirements for private conversations or how such requirements would be implemented.
Will End-to-End Encryption Be Affected?
No changes to end-to-end encryption have been agreed under the proposed EU regulation. With end-to-end encryption, only the sender and intended recipient can read a message. Even the messaging service provider cannot decrypt its contents.
Detecting abuse in private conversations presents a technical challenge. Messaging providers cannot inspect encrypted messages as they pass through their servers. Scanning messages on a user’s device before encryption is technically possible, but it would allow their contents to be examined despite the protection offered by end-to-end encryption.
The European Parliament wants to exclude end-to-end encrypted communications from detection orders under the permanent regulation. The Council presidency has also indicated that encrypted content would be excluded from proposed voluntary searches of private communications, although the final provisions remain unsettled.
EU Chat Control: The Road Ahead
Another round of negotiations has been reported for December 8, 2026, although the date has not been officially confirmed. Negotiators still need to resolve the rules governing detection in private communications, including the limits of voluntary searches and the conditions for issuing detection orders.
Even if negotiators reach a political agreement, the regulation will not become law immediately. The European Parliament would need to approve the agreed text through its committee and plenary procedures, while the Council must also give its formal approval.
Frequently Asked Questions
The proposed regulation covers messaging services, making apps such as WhatsApp and Signal relevant to the debate. However, no requirement has been adopted for either app to scan its end-to-end encrypted chats. The current temporary rules exclude encrypted communications, while negotiations on the permanent regulation continue.
The proposed regulation covers more than private chats. Its scope includes web-based email, messaging, and hosting services where child sexual abuse material could be shared. The existing temporary rules permit eligible providers to voluntarily detect certain abusive content, including images and videos, but exclude end-to-end encrypted communications.
Yes. Detection software can incorrectly flag legitimate content as suspected abuse. The current temporary rules require providers to minimise errors, correct them promptly, and maintain human oversight. Previously unidentified material and suspected grooming must also undergo human confirmation before being reported to law enforcement or relevant organisations.
The temporary EU rules do not establish a general right for users to opt out of permitted detection activities. However, providers must inform users when they use these technologies and offer complaint procedures. Users whose content is removed or accounts are restricted must also receive information about available remedies.
A VPN like PureVPN encrypts internet traffic between your device and the VPN server, helping protect your connection from snooping, particularly on public WiFi. However, it cannot prevent messaging services from examining content they can access, stop scanning performed on your device, or override lawful detection requirements.
