Chat Control 2.0 is one step closer. What exactly did the EU approve – and what does it mean for privacy?
Let's go through what the Council actually adopted, what is not in the text, and why it's wise to be cautious but not panic.
The European Union has moved forward again in the debate over regulation known as Chat Control. And as with similarly sensitive topics, the internet was immediately flooded with headlines about „approved spying on messages“. But the reality is different.
The Council of the European Union did not approve the final law, but only its negotiating position. Now the key phase starts – negotiations with the European Parliament.
Let's go through what the Council actually adopted, what is not in the text, and why it's wise to be cautious but not panic.
What exactly the EU Council adopted
On 26 November 2025 the Council of the EU agreed on its position on the proposal for the regulation Regulation to Prevent and Combat Child Sexual Abuse – the proposal that the media call „Chat Control“.
This position is a starting point for negotiations with the European Parliament and does not mean that conditions for private communication in the EU would change.
The basis of the current compromise contains:
- No blanket mandatory scanning of messages.
- Obligation for service providers to carry out risk assessments, to determine whether their platform could be abused for spreading CSAM or grooming.
- Implementation of appropriate mitigation measures, if a service falls into a risk category.
- Establishment of the EU Centre on Child Sexual Abuse, which will collect indicators of harmful content and support states in assessing risks.
- Permanent retention of the voluntary scanning regime, which was supposed to end in the EU in April 2026.
The last point is crucial. Voluntary scanning, which some firms use today to detect CSAM, was supposed to be discontinued. The Council's position says: the voluntary regime will remain and be legally anchored permanently.
What is not in the text (and it's important to say out loud)
- There is no order to mandatorily scan all messages.
- There is no obligation to break or circumvent end-to-end encryption.
- No system of mass surveillance over communication in the EU is being created.
These are often mentioned myths – but they are not found in the Council's adopted text.
Why the proposal still draws criticism from experts
Although the text is formally milder than earlier versions, several problematic points remain.
1. The infrastructure for scanning will be preserved
Once the EU creates a legal framework for permanent "voluntary" scanning, an infrastructure arises that can be expanded in the future. History shows that voluntary mechanisms can gradually become an informal standard.
2. Risk of pressure to weaken end-to-end encryption
Although the proposal does not directly undermine encryption, the obligation to "reduce risks" combined with vague formulations can create pressure for client-side scanning, i.e. scanning on the user's device.
3. Possibility of future mission creep ("mission creep")
Once the control infrastructure exists, it can be easily extended in the future to other areas – for example under pressure from politics or security forces.
What this means today for ordinary users
From the perspective of everyday communication, nothing changes:
- WhatsApp, Signal or Messenger are not starting to scan anything.
- End-to-end encryption continues to work.
- There is no new surveillance of messages.
- Nothing has been finally approved.
The proposal now moves into the trialogue – joint negotiations:
- Council of the EU
- European Parliament
- European Commission
And especially the Parliament will be the guardian to ensure that the final text protects encryption and privacy.
What are the next steps
The decisive phase of the legislative process begins:
- The Parliament will present its own position – usually more in favor of E2EE.
- Trialogues will take place – seeking a compromise final text.
- The final wording will be approved by both institutions.
The outcome may be:
- stricter than the Council's version,
- or on the contrary significantly milder.
At this moment everything is open.
Conclusion: Let's watch it, but without panic
Chat Control 2.0 is not an approved law. It does not mean any immediate change for users of encrypted apps.
But it is true that the Council's position opens space for technologies that could have a fundamental impact on privacy in the future.
Therefore it is right to look at it soberly:
- without catastrophic headlines,
- but with maximum attention.