What is Chat Control? The EU's new message-scanning proposal explained

The European Parliament has advanced a version of a long-running proposal known informally as "Chat Control," aimed at requiring messaging platforms to help detect child sexual abuse material shared through their services. The vote marks a significant step forward for legislation that has been debated and revised for several years.

The underlying goal of the proposal is uncontroversial: giving law enforcement better tools to detect and stop the sharing of child sexual abuse material online, a serious and persistent problem that has grown as messaging apps have become the primary way people share images and files privately.

The controversy centers on how that detection would actually work in practice. Earlier versions of the proposal would have required messaging services, including those offering end-to-end encryption, to scan message content before it is encrypted or after it is decrypted on a user's device, a method known as client-side scanning.

Critics, including privacy advocates, technologists and some members of the European Parliament, argue this approach amounts to built-in surveillance infrastructure inside otherwise private communications, since the same scanning mechanism could, in theory, be expanded or repurposed to search for other kinds of content beyond its original intended target.

Supporters of the measure argue that voluntary detection efforts by tech companies alone have not been sufficient, and that a legally mandated, coordinated approach across the EU is necessary given how widely such material circulates across borders and platforms.

The version passed by Parliament, described as "Chat Control 1.0" by some commentators, reflects a compromise reached after previous drafts faced strong pushback, though critics including the digital rights advocate and former member of the European Parliament Patrick Breyer argue that even the revised version fails to adequately protect user privacy and could still weaken the encryption that protects everyday communications.

Encryption experts have repeatedly warned that any mechanism allowing a third party to scan supposedly encrypted messages effectively creates a vulnerability that could, in principle, be exploited by bad actors beyond the intended law enforcement use, undermining the security guarantees encryption is designed to provide.

The legislative process for the measure is not yet finished. The version approved by Parliament must still go through further negotiation with the Council of the EU, representing member states' governments, before any final law is agreed and enters into force across the bloc.

Several major messaging platforms, including some that rely heavily on end-to-end encryption as a core feature, have previously signaled they would consider withdrawing services from the EU market entirely rather than comply with mandatory scanning requirements they view as incompatible with their privacy commitments.

The debate over Chat Control reflects a broader, recurring tension in technology policy between child-safety objectives and digital privacy protections, one that regulators in the EU and elsewhere are likely to keep revisiting as messaging platforms continue to play a central role in how people communicate privately online.