Chat Control Rejected: Victory or Brief Respite?
TL;DR
The EU’s ‘Chat Control’ (CSAR) proposal has been the greatest threat to digital privacy in Europe, aiming to force providers to scan all private messages and break end-to-end encryption.
On October 31, 2025, Denmark backed away from this mandatory scanning after massive public protest and a firm “no” from Germany. This is a major victory, but it’s the third delay — not an official withdrawal.
With voluntary scanning rules expiring in April 2026 and Poland taking the EU Council Presidency in January, the battle over encrypted communications is far from over. The threat has just changed shape. We at Atomic Mail believe the real choice is between targeted investigations and the wholesale, automated surveillance of everyone.
What Is “Chat Control”?
On 11 May 2022, the European Commission proposed the CSAR, quickly dubbed ‘Chat Control’. It was designed to replace a 2021 temporary measure (‘Chat Control 1.0’) that only allowed voluntary scanning. This new ‘Chat Control 2.0’ was a massive escalation, aiming to make scanning mandatory for all providers, including those using end-to-end encryption (E2EE).
Where it applies (scope that remains relevant under any model):
- Messengers (Signal, WhatsApp, iMessage).
- Email (Atomic Mail, Proton Mail, Tuta).
- Cloud storage (iCloud Photos/Drive, Google Drive, OneDrive, Dropbox).
- Platforms hosting user content (Discord, Reddit, X/Twitter, Facebook, Instagram, TikTok).
Why it’s controversial: even if aimed at child protection, scanning systems create generalized monitoring. The EDPB/EDPS warn of conflicts with the EU Charter’s rights to privacy and data protection and question proportionality. See their joint opinion.
The new “voluntary” proposal (the current threat)
On Oct 31, 2025, Danish Justice Minister Peter Hummelgaard announced a Council “compromise” to strip mandatory detection orders and codify voluntary detection within CSAR. This move seeks to pass something before the April 2026 expiry of the current voluntary derogation.
Bottom line: the EU chat control proposal didn’t die; it pivoted. “Voluntary” frameworks can still normalize scan-by-default if reinforced by app-store policies or “safety labels.”
Why Did It Happen?
The stated goal of chat control is to fight the spread of CSAM, as reporting volumes have increased. Policymakers argued that voluntary systems were inconsistent, so the EU chat control law tried to make detection mandatory.
The urgency now comes from a political deadline: the current ‘Chat Control 1.0’ (which allows voluntary scanning) expires in April 2026. Proponents are manufacturing a false crisis, claiming this will create a “regulatory gap.”
According to Danish Justice Minister Hummelgaard: “Right now we are in a situation where we risk completely losing a central tool in the fight against sexual abuse of children… We owe it to all the children who are subjected to monstrous abuse.”
Privacy advocates argue this framing is dishonest. The voluntary system allows Meta to scan, but it doesn’t force encrypted services like Atomic Mail and Signal to break their security. This “crisis” is a political deadline being used to rush some permanent surveillance framework into law.
What the Mandatory Chat Control Law Would Have Done
(This is the version just paused. Understanding it matters because elements may re-appear.)
Mandatory detection orders & scope
The core idea was detection orders — legal tools forcing providers to scan messages, images, videos, and links. These orders could target an entire service, user cohorts, or specific features. They were indiscriminate compared to targeted warrants and would have applied to E2EE services.
Client-side scanning: technical linchpin for breaking encryption
To scan E2EE content, the law would have forced Client-Side Scanning (CSS). This tech scans content on your device before it’s encrypted. It creates a digital fingerprint (‘hash’) and compares it to a government database. A match triggers an automatic report. Experts agree this architecture is essentially spyware, creating a “backdoor” vulnerability for hackers and hostile states.
Age checks and platform obligations
The law also pushed for mandatory age verification (via ID, facial scan, or other methods), a huge blow to online anonymity. Not all providers can secure this data. We saw this with the catastrophic Discord Breach 2025, where 2 million user IDs leaked as a direct result of forced age verification by the UK government.
Data retention, reporting, oversight
A detection regime implies large-scale logging, retention, and reporting of “hits” to hotlines and law enforcement. In reality, false positives would flow into evidence systems; vendor secrecy and trade-secret claims reduce transparency; and human review amplifies exposure risks.
Why Chat Control Failed: Privacy, Encryption, and Fundamental Rights
The entire fight chat control movement exists because this proposal was an existential threat — legally toxic, technically unworkable, and humanly catastrophic. This is why it was blocked three times by a “blocking minority” (led by Germany, Poland, and others).
The legal challenge: Charter violations
The EU’s own legal bodies warned that the chat control law violates its highest laws, including Article 7 (respect for private communications) and Article 8 (data protection). The EU’s top privacy watchdogs (EDPB/EDPS) called it “a form of generalised and indiscriminate surveillance” that would “lead to the end of confidentiality of communications.”
Breaking encryption: the security catastrophe
This technical argument united the security world. Proponents claimed they could scan before encryption, a cynical lie. Experts warned this creates a systemic weakness (a ‘bug’ mandated by law that’s a backdoor for everyone) and an unmanageable target (a hacker could add a trade secret to the database and use the system to find it).
Algorithmic inaccuracy: false positives at scale
The proposal also failed the human test. Algorithms lack context and can’t tell a crime from an innocent family photo. The Swiss Federal Police noted that as many as 80–90% of automated reports are not illegal CSAM. This means for every real case, up to nine innocent people could be flagged.
Businesses and critical sectors
Finally, the law was a direct assault on the economy. How can businesses discuss patents, lawyers guarantee client privilege, doctors protect patient data, or journalists protect sources? They can’t. The EU chat control law makes a joke of GDPR, chilling free speech and crippling journalism.
The Political Battlefield: Who’s For, Who’s Against?
Supporters: arguments & promised safeguards
The main supporter is the European Commission (specifically Ylva Johansson), backed by countries like Spain and France. Their argument is “We must do something.” Now that the mandatory plan failed, they are pushing the “voluntary” plan as a “reasonable compromise” to meet the April 2026 deadline.
Opponents: the coalition that won the battle
Their core critique is that generalised scanning is incompatible with E2EE and the EU Charter. This is the group that stopped the mandatory proposal. The “blocking minority” of countries firmly opposed includes Germany, Poland, Austria, Estonia, Slovenia, Luxembourg, the Netherlands, Finland, and the Czech Republic. Their firm opposition forced Denmark to back down.
The citizen movement that stopped chat control
This victory wasn’t just politicians. The Fight Chat Control movement became a central hub for this successful campaign, driven by grassroots pressure, technical expertise from 500+ cryptographers, and industry alignment.
Current State: The “Poland Factor”
As of November 2025, the mandatory chat control proposal is on hold, but NOT dead. This is the third time it has been blocked since May 2022 (after failing under the Hungarian, Belgian, and Swedish presidencies). Denmark’s retreat is tactical. The new battle is to pass a law codifying voluntary scanning before the April 2026 cliff.
Get Atomic Mail’s stories in your inbox
Join Medium for free to get updates from this writer.
On Jan 1, 2026, Poland takes the EU Council Presidency — three months before the derogation expires. Expect renewed pressure framed as child safety and “avoiding a gap.”
Likely Polish strategy:
- Narrower start (e.g., known CSAM hash-matching first).
- “Risk-based” targeting (E2EE often labeled high-risk).
- Voluntary-to-mandatory pipeline (codify now, compel later).
Ripple Effects on Privacy-First Apps
With the mandatory scan paused, the privacy ecosystem swerved away from a cliff. But the new “voluntary” proposal is a different trap. It creates a “two-tiered” internet: insecure “cooperative” apps that scan, and secure “uncooperative” apps.
What if this becomes de-facto compulsory? What if Apple and Google are pressured to use App Store “safety labels” to punish apps that don’t “voluntarily” scan? The impossible dilemma returns: ship a scanner or leave. This isn’t theoretical. The math of E2EE is a hard line.
The Signal precedent: “We will leave”
Signal’s president has been very clear: if they’re forced to scan, they’ll stop operating in the EU. This principled stand is one of the reasons the mandatory proposal failed.
Our stance at Atomic Mail
We share the same philosophy. For your encrypted emails, Atomic Mail uses a zero-knowledge architecture. We don’t hold your private decryption keys; we physically cannot read your encrypted email content. The chat control proposal asks us to do something that is technically impossible without destroying the product you chose us for.
Post-April 2026 scenarios
- Scenario 1: Voluntary Framework Codified. The current system continues. E2EE services remain intact, but face political pressure.
- Scenario 2: No Agreement Reached. The voluntary scanning rules expire in April 2026, creating legal uncertainty for Meta and Google.
- Scenario 3: Mandatory Framework Returns Under Poland. A new push begins, and secure services must choose: implement scanning, exit the EU, or challenge the law in court.
Your Options: How to Protect Your Privacy and Take Action
October’s pause proves public engagement works. To fight chat control and any repackaging:
Political action
Join campaigns like EDRi’s “Stop Scanning Me” and Fight Chat Control. Most importantly, write your representatives using tools like DearMEP.eu. Tell them to oppose the new “voluntary” proposal and let the temporary rule expire in April 2026. Spread awareness; people think the fight is over. Follow primary sources like Patrick Breyer’s Blog and EDRi.
Technological choices
Your main defense is your technological choice. This “voluntary” proposal makes your provider choice critical. You must now assume that services like Gmail or Facebook Messenger may be scanned. Do not use them for anything private.
Your only defense is to choose privacy-first providers that use zero-access encryption and don’t apply voluntary scanning — like Atomic Mail. We’ve built our service so we cannot read your encrypted emails. We can’t scan what we can’t see. Your choice of provider is now your best line of defence.
Why This Matters Now
The EU’s chat control proposal is a zombie. It’s been blocked three times, and it keeps coming back. The October 2025 “pause” isn’t a victory; it’s a ceasefire.
This chat control law is a Pandora’s Box. If we allow an infrastructure that can scan every message — even “voluntarily” — the debate is over. The only question left is what they scan for next. New categories will creep in: terrorism, copyright, “harmful” speech. This would change the internet’s trust model from private-by-default to inspected-by-default.
Our commitment to secure, private communication
Atomic Mail follows strict data minimization, uses end-to-end encryption, and has zero access to your encrypted emails. We don’t keep the keys. We don’t scan your inbox. Privacy is not a feature tier — it’s our foundation.
✳️ Create your Atomic Mail account and join our updates — because the best time to protect your privacy was yesterday; the second‑best time is now.
Quick FAQs (People Also Ask)
What is chat control?
A shorthand for CSAR, the EU chat control proposal to detect/report CSAM across services — including, in its earlier form, via client-side scanning of private communications.
Is chat control dead?
No. The mandatory model is on hold after Denmark’s retreat and Germany’s blocking minority, but not withdrawn. A voluntary proposal is being pushed before April 2026, and the Polish presidency could repackage mandates in 2026.
Which countries formed the blocking minority?
Current positions show Germany, Poland, Austria, Estonia, Slovenia, Luxembourg, the Netherlands, Finland, and the Czech Republic resisting mandatory, encryption-breaking elements.
Does this mean platforms won’t scan at all?
No. The voluntary regime continues for unencrypted services; the question is whether the EU chat control law will codify and expand that model.
What changes if I use a privacy-first email like Atomic Mail?
Everything. The new “voluntary” proposal creates a two-tiered internet: “free” services (like Gmail) that scan you, and secure services that can’t. Atomic Mail uses zero-access encryption. We cannot scan your encrypted emails because we do not have your encryption keys. The EU chat control law, in all its forms, is an attempt to push mass surveillance. Our message is simple: Do not use services that accept “voluntary” scanning.
🔐 Read the full article on our blog to get the complete story!
Follow us on social media!
