EU states approve extension of chat control until April 2028

The EU Commission itself sees no compelling arguments for the measure in its evaluation report. Nevertheless, Germany in particular and the European People's Party (EPP) faction, to which the CDU and CSU also belong, had advocated for another extension. The German government, including Chancellor Friedrich Merz (CDU) and Federal Interior Minister Alexander Dobrindt (CSU), as well as the Federal Criminal Police Office (BKA), had previously criticised the lack of a legal framework and pushed for an extension.

An extension of the original regulation initially failed due to resistance from the EU Parliament. In April, the exception regulation had expired because Parliament had not agreed to a further extension. The EU countries and the EPP then pushed the topic back onto the agenda using a procedural trick and with the help of Parliament President Roberta Metsola in an expedited procedure and against a simple majority. Parliament could only have rejected the renewed attempt with an absolute majority – that majority did not materialise.

Procedure and political pressure

The European Parliament had, in its last session before the summer break, agreed to a temporary extension until 2028 and adopted two amendments: the practice is to be limited to unencrypted messages and so-called client-side scanning on end devices is to be excluded. The EU countries have now adopted these restrictions. The regulation is explicitly not to allow the breaking of end-to-end encryption, which is now standard in services such as WhatsApp or Signal.

Until April, "client-side scanning" was still possible. In this procedure, software on the smartphone or computer checks the content of messages, photos, and videos directly before they are encrypted and sent. This method is no longer permissible under the agreement now reached.

Supporters emphasise that this was not a matter of controlling private chats, but that searches were only conducted for images based on known patterns. Major tech companies such as Meta, TikTok, and Snapchat had supported the approach. Microsoft, Google, and Meta are also already scanning content for indications of child abuse under the voluntary rules. The tech companies may only forward suspected cases discovered by software to authorities once a human has verified them as such.

Criticism from data protectionists and child protection advocates

Data protection advocates have been fighting the planned project for years and describe the possibility of comprehensive searches as suspicionless mass surveillance that is neither effective in protecting children nor safeguards fundamental rights. They argue that existing EU data protection rules do not permit such an intrusion into private communication.

Opponents of chat controls such as the German Child Protection Association (Deutscher Kinderschutzbund) argue that depictions of sexual violence are usually not exchanged via private messengers but via file hosting services. "Chat controls," on the other hand, intrude deeply into the privacy of children as well. Instead of suspicionless surveillance, targeted measures such as prevention and education are needed. Providers should be obliged to comply with binding security requirements, risk analyses, and the scanning of unencrypted content.

Observers assess the amendments now pushed through by Parliament as cosmetic, since the platforms already carry out such scans voluntarily and without legal obligation. The parliamentarians did, however, demand restrictions on encrypted messages, to which the EU countries now want to agree.

Outlook: Negotiations on Chat Control 2.0

In parallel to the transitional solution now adopted, the Council of the EU states and the European Parliament are still negotiating the legislative text for a long-term regulation, the so-called "Chatkontrolle 2.0." These negotiations had recently stalled. Only once both institutions reach an agreement can the new rules enter into force and definitively replace the transitional solution.

The compromise now reached continues to allow providers to check content for known patterns of child sexual abuse but limits the measure to unencrypted communication. This is intended to keep encrypted messengers such as WhatsApp or Signal exempt from automated scanning. At the same time, the practice remains voluntary, as no legal obligation to scan has been introduced.

The initiative is part of the EU strategy to combat child sexual abuse online. The platforms should be able to detect suspected cases and report them to law enforcement authorities without violating the GDPR. However, the transitional solution only applies on a temporary basis and must be replaced by a permanent regulation in the coming years.

For the German government, the extension is a success: Interior Minister Dobrindt and Chancellor Merz had portrayed the lack of a legal basis as problematic and pushed for a solution. The BKA had also advocated strongly for the continuation of the exception regulation in order to continue accessing the corresponding findings from the voluntary scans.

The political debate on chat control thus remains open. Data protection advocates and child protection organisations pursue different approaches: while the former reject the measure as an encroachment on fundamental rights, the latter call for more targeted instruments and prevention instead of suspicionless surveillance. The final political and legal assessment will only take place with the future permanent regulation.

With the agreement of the EU countries, a significant interim step has been achieved, but the final vote in the European Parliament on the future permanent solution is still pending. Observers expect that negotiations on the "Chatkontrolle 2.0" will resume after the summer break.