EU states agree on voluntary chat control, but ban breaking end-to-end encryption

Source: Fabian Sommer/dpa

The EU member states have cleared the way for voluntary chat control once again. Messenger services will soon be permitted to automatically search for abuse material, though with a crucial restriction.

Key Developments

In the fight against child sexual abuse, messenger services in the EU will soon be allowed to search private chats for evidence. Representatives of the member states agreed on a temporary exemption from European data protection rules, several diplomats told the German Press Agency. This follows a prior vote by the EU Parliament in favor of the project.

Members of the European Parliament had demanded restrictions on encrypted messages, which EU countries now intend to accept. This move aims to reactivate a transitional regulation until April 2028, whose extension had previously been considered to have failed in Brussels.

Formal Decision Pending

The formal decision by EU states must now be taken through a written procedure, expected to be completed on Thursday afternoon.

Background and Pressure

Pressure had come from the CDU and CSU group in the European Parliament (EPP), as well as Germany and other member states, to reinstate the expired exemption for child protection. Chancellor Friedrich Merz (CDU), Interior Minister Alexander Dobrindt (CSU), and the Federal Criminal Police Office had criticized the lack of a legal basis.

Data protection advocates, however, have been trying to prevent the project for years, describing the possibility of blanket scanning as indiscriminate mass surveillance that is ineffective in protecting children.

Scope of the Exemption

With the temporary exemption, companies such as Microsoft (Outlook), Google (Gmail), and Meta (Instagram) can again use software to automatically search for images or videos of child abuse. The checks are voluntary. Under EU rules, tech companies may only forward suspected cases to authorities after a human has verified them, to prevent individuals from falling under suspicion due to program errors.

Encryption Remains Protected

The regulation explicitly does not allow breaking end-to-end encryption, which is now standard for WhatsApp, Signal, and similar services. Unlike originally proposed by member states, this protection also applies to messages that are still being encrypted. This limits the possibilities for automated scanning on end devices.

In particular, "client-side scanning" is excluded. This process involves software on a smartphone or computer directly checking the content of messages, photos, and videos before they are encrypted and sent. Under the transitional regulation that was in effect until April, this was still permitted. However, the European Parliament recently voted against granting companies this option any longer.

Previous Negotiations Had Failed

The Council of member states had previously been unwilling to agree to such restrictions. In a vote over three months ago, MPs largely insisted on their position of not supporting an unconditional extension of the exemption. The negotiations were considered to have failed, and the transitional regulation expired.