Chat Control 1.0 and 2.0: what the EU wants to scan

Chat Control is the shorthand for the set of European rules that allow, and may soon require, the automatic scanning of our private messages for child sexual abuse material. Since 9 July 2026, its first version, known as Chat Control 1.0, is back in force: large unencrypted messaging services may scan every user's exchanges, without any prior suspicion. Its successor, Chat Control 2.0, is still under negotiation and crystallizes a much wider battle, the one over encryption.

Chat Control 1.0: a "voluntary" scan that came back

Before it became an activist slogan, Chat Control 1.0 was a precise piece of law: Regulation (EU) 2021/1232, adopted in 2021. It creates a temporary derogation from the ePrivacy Directive, the one that protects the confidentiality of electronic communications. In practice, it allows messaging and email providers to voluntarily analyze their users' unencrypted content in order to spot already-known images of child sexual abuse.

In reality, it was mostly US-based services that took it up: Gmail, Facebook Messenger and Snapchat compare shared files against a database of digital fingerprints of identified content. This process, called hashing, does not read the meaning of a conversation, it looks for an exact match against a catalog. The nuance matters: the text forces no one, it merely lifts the ban on scanning.

The derogation was meant to stay temporary. In March 2026, the European Parliament refused to extend it, and it expired on 3 April 2026. You might have thought the case was closed. It was not.

The 9 July 2026 vote: the majority says no, the law passes anyway

On 9 July 2026, MEPs had to vote on a fast-tracked reintroduction of the text, pushed by the Council of the European Union. The outcome is disconcerting: 314 members voted to reject Chat Control, against 276 to keep it. A majority of those voting therefore came out against scanning. And yet, the text went through.

The explanation lies in a procedural rule. To block the Council's position, MEPs needed an absolute majority of 361 votes, half of Parliament's 720 seats, not a simple majority of those present. The 314 opponents fell short of that threshold. Chat Control 1.0 is therefore reactivated, this time until 3 April 2028.

Two amendments came with the vote, and met opposite fates. The first, which sought to limit scanning to people already identified by a judicial authority, failed: the sweep remains indiscriminate, with no warrant and no individual suspicion. The second, however, secured a majority: end-to-end encrypted services are, for now, excluded from the scheme. A real safeguard, but a fragile one, because that is exactly the point the next version puts back on the table.

Chat Control 2.0: from voluntary to mandatory

Chat Control 2.0 is not a mere update. It is a permanent regulation, proposed by the European Commission in May 2022 under the name CSAR, for Child Sexual Abuse Regulation. Where version 1.0 simply permits, version 2.0 aims to require: detecting and reporting child sexual abuse material would become a legal obligation for platforms.

The friction point is encryption. To scan end-to-end encrypted messages, their content would have to be analyzed before it is encrypted, directly on the user's device. This is what is known as client-side scanning. Digital rights advocates see it as a universal backdoor: once the mechanism sits on every phone, nothing guarantees it will stay limited to child abuse imagery.

Criterion	Chat Control 1.0	Chat Control 2.0 (CSAR)
Nature	Temporary derogation	Permanent regulation
Legal basis	Regulation (EU) 2021/1232	May 2022 proposal
Scanning	Voluntary	Mandatory, detection required
Encryption	Not affected, scan excluded	Threatened by client-side scanning
Status in July 2026	In force until 3 April 2028	Stuck in trilogue

The timeline, meanwhile, keeps slipping. Five rounds of trilogue negotiations, between Parliament, the Council and member states, have followed one another without agreement. The 29 June 2026 round, billed as final, ended in yet another failure. A sixth round is expected under the Irish Council presidency, most likely in September 2026. In the meantime, some observers, including former MEP Patrick Breyer, warn of a disguised reintroduction: wording requiring providers to take "all appropriate risk-mitigation measures" would, in effect, impose scanning without ever naming it.

What it changes, for you and for your studio

For an individual, the consequence is direct: on large unencrypted messaging services, your exchanges can be continuously matched against a database, without your being suspected of anything. The very principle of private correspondence, long protected by default, becomes an exception that the law can lift. End-to-end encrypted apps such as Signal or WhatsApp stay out of scope for now, but their protection now depends on how Chat Control 2.0 turns out.

For a business, and especially for a creative studio, the stakes shift toward the confidentiality of the work itself. An embargoed client brief, a contract, unreleased visuals, a project mockup: all of this often travels through messaging tools. If client-side scanning were to take hold, even the channels considered watertight would become porous. The question is no longer merely ethical, it becomes strategic.

It is also an invitation to look at your own tool chain with clear eyes. Where do your sensitive files travel? Which services host them, and under which jurisdiction? At AB-Arts, we tackle these questions in our stack and process audits, where we map out what costs, what blocks and what exposes. For teams who want to build up their skills on these topics, The Academy offers training on AI and creative tools, and our contact page stays open for a conversation.

Key takeaways

In short, three markers to follow the file:

• Chat Control 1.0, reactivated on 9 July 2026, allows voluntary scanning of unencrypted messaging until 3 April 2028.
• A majority of the MEPs present voted against the text, with 314 votes, but the rejection threshold of 361 votes was not reached.
• Chat Control 2.0, the permanent CSAR regulation, remains stuck in trilogue and will play out again from September 2026, with end-to-end encryption as the main battleground.

From now on, the confidentiality of our exchanges no longer goes without saying: it is decided, text after text, in Brussels. Following it closely is already a form of protection.