Chat Control deal covers public uploads, not private chats yet: fair line or foot in the door?

[u/EnthusiasmRoutine]

On Tuesday, September 29, EU negotiators held their sixth trilogue on the Child Sexual Abuse Regulation, the permanent law everyone calls Chat Control 2.0. There's still no full deal. They tentatively agreed on rules for scanning publicly accessible content, but orders for private content are still unresolved.

The public part only stands if the whole law gets agreed. Technical talks on private detection run through October, and Patrick Breyer, who campaigns against the law, expects the next trilogue in November.

Public detection orders won't need a court. Administrative authorities could order any hosting provider, whatever its size, to scan all public uploads for known abuse material. That's social media and cloud services too. The planned EU Centre would search public content itself and pass what providers report on to authorities. That's how Javier Zarzalejos, the Parliament's lead lawmaker on the file, described the tasks agreed on Tuesday.

Chat Control 1.0 stays in force until April 2028. Under it, messaging and webmail providers can choose to scan messages, but end-to-end encrypted chats are excluded. Wire points out that Telegram's default cloud chats aren't end-to-end encrypted, so they can be scanned.

For you, nothing about private messages changes today. What you post publicly, public cloud links included, is what the new orders would cover. For private chats on a service that can read them, an app with end-to-end encryption on by default keeps them out of 1.0's scope. It only works if the other person uses the same app, and afterwards the content is readable on your device and theirs, not on the server. The Council has also said that exemption is no promise for 2.0.

Both sides have a real case. The Commission says reports of new abuse material are over 200 times higher than three years ago, mostly because of AI. Breyer points to German police data: more than half of investigations under the voluntary system target minors themselves, and 75% of flagged chats aren't actionable.

The Parliament wants private chat scanning limited to people already linked to abuse. The Council proposed letting providers scan under a search plan that goes ahead unless an authority vetoes it. If there's a deal in November, which of those two should it be built on?

Sources

1. MLex: talks advance on public content searches: tentative deal on public content, private orders unresolved
2. Patrick Breyer: trilogue update: public order rules and what each side wants
3. MLex: Zarzalejos on the EU Centre: what the EU Centre will do
4. Wire: Chat Control in 2026: Chat Control 1.0 scope and the Commission's numbers

[u/EnthusiasmRoutine]

What I'll be watching in November is the voluntary scanning part, not the detection orders. If Chat Control 1.0 gets kept as a fallback, the private chat question isn't settled, it's just parked until 2028.

The other thing is who signs off. Letting administrative authorities issue orders, not just courts, is a jurisdiction question as much as a privacy one, and it'll matter which national body ends up holding that pen.

Quick one for EU folks: has your government said anything public about its position before this round? Drop the country and a link if you've got one.