EU Council approves Chat Control mandate for negotiation with Parliament
EU plans to negotiate a “Chat Control” regulation that would encourage or require platforms to scan private communications for child sexual abuse material are raising alarms over privacy, encryption, and the scope of EU power. Commenters note that while the latest Council position frames scanning as voluntary and explicitly protects end-to-end encryption in law, risk-based obligations and bureaucratic pressure could evolve into de facto mandatory surveillance over time. The debate also exposes deeper tensions over EU democratic legitimacy, institutional design, and the balance between child protection, civil liberties, and technological innovation.
Legislative Status and What Was Actually Decided
- The Council agreed on its position to take into trilogue with Parliament; this is not yet law.
- Scanning is framed as “voluntary” and focused on providing channels for victims, with no explicit obligation to break or bypass encryption.
- The draft explicitly states it must not weaken or require access to end‑to‑end encryption, nor mandate decryption.
- Some commenters see this as a significant win compared to earlier drafts that aimed at mandatory chat scanning; others see it as only a tactical retreat.
Privacy, Encryption, and “High-Risk” Providers
- The core concern is the new regime of “risk assessments” and “high-risk” classifications overseen by authorities.
- “High-risk” criteria include encrypted messaging, P2P, anonymous/pseudonymous accounts, lack of identity verification, lack of pre‑moderation, and strong privacy jurisdictions.
- Providers designated “high risk” must “contribute to technologies to mitigate risks,” widely interpreted as a path to client-side scanning and de facto backdoors via regulatory pressure, not explicit text.
- Many warn of a slow “boiling the frog” dynamic: voluntary today, functionally mandatory over time through compliance ratchets and a growing enforcement/compliance industry.
EU Governance, Democracy, and Scope
- Large subthread debates whether the EU was meant as a trade bloc or an “ever closer union,” and whether this extends legitimately to regulating private communications.
- Strong disagreement over how democratic the EU is: some emphasize Parliament, Council, and national governments’ roles; others point to the Commission’s agenda-setting power, trilogues, and perceived “rubber stamp” dynamics.
- Tension between EU‑level rules and national constitutions is highlighted; some expect courts like the ECJ/ECHR and national constitutional courts to be crucial checks.
Civil Liberties, Effectiveness, and Activism
- Many see mass scanning proposals as disproportionate, especially given existing laws against CSAM and examples of lenient sentencing offline.
- Frequent fear that “protect the children” is being used as political cover for generalized surveillance, potentially usable against “enemies of the state.”
- Some describe the current outcome (no mandated scanning, E2EE still legal) as democracy working under pressure; others see an ongoing legitimacy crisis and expect the issue to keep returning.
- Suggested responses include protests, supporting digital rights NGOs, relying on open-source, decentralised, E2EE tools, and preparing for jurisdictional workarounds via private or non‑public communication systems.