Chat Control 1.0 and 2.0, Explained

On April 4, 2026, Europe's mass-scanning rule for private messages died, and this Thursday, July 9, the Council is voting to bring it back.

What Chat Control 1.0 actually was

The regulation everyone in Brussels calls "the CSA file" and everyone outside Brussels calls Chat Control is not one law. It is two. The first, formally known as Regulation (EU) 2021/1232, was adopted on July 14, 2021 as a temporary derogation from the ePrivacy Directive. The word derogation matters. Under ePrivacy, providers of interpersonal communications services in the bloc are prohibited from reading the content of user messages. The 2021 regulation carved out a specific, time-limited exception so that Gmail, Facebook Messenger, Instagram Messenger, Skype, iCloud Mail, Snapchat and Xbox messaging could voluntarily scan chats for child sexual abuse material and report matches to law enforcement.

The rule was written to expire on August 3, 2024. It did not. On April 29, 2024, the Council and Parliament agreed a first extension that ran the derogation through April 3, 2026. On December 18, 2025, the European Commission proposed a second extension that would have carried it all the way through April 2028. That second extension is the trigger for everything that followed.

The one-vote spring

The parliamentary drama between March and April 2026 was among the tightest in recent EU memory, and worth walking through in the order it happened.

On March 2, 2026, Parliament's Civil Liberties, Justice and Home Affairs committee, known by its French acronym LIBE, rejected the Commission's proposed extension by 38 votes to 28. The full Parliament plenary reversed the committee just nine days later. On March 11, 2026, MEPs approved a conditional extension by a wide 458 to 103 margin, apparently settling the file for another two years.

That settlement lasted fifteen days. On March 26, 2026, the Parliament reopened the vote and killed the extension. Amendment 34, the amendment that stripped the extension from the text, passed by a single vote: 307 to 306. The underlying compromise text was then voted down 311 against. On April 4, 2026, Regulation (EU) 2021/1232 expired on schedule, and for the first time since 2021 there was no EU legal basis for messaging providers to scan private chats for CSAM inside the bloc.

That vacuum lasted from April 4, 2026 to June 26, 2026.

The Council's written-procedure revival

On June 26, 2026, the Council of the EU proposed to resurrect Chat Control 1.0 through an expedited written procedure, a mechanism that skips normal committee review. The Council formally adopted its position on July 2, 2026 through that same procedure. On July 7, 2026, the European Parliament approved the urgency track by a narrow 331 to 303 vote. A shift of fifteen MEPs would have blocked it.

The binding vote on the revived text is scheduled for July 9, 2026, one day after this video is being made. Under Parliament's rules, an absolute majority of 361 MEPs is required to stop or amend the revived regulation. Silence effectively means adoption. The Council presidency that drafted the June revival, held by Denmark, hands the file to Ireland in July, which inherits both this file and the still-unresolved 2.0 negotiations.

Chat Control 2.0 and the trilogue that would not close

The second law, formally proposed by the European Commission on May 11, 2022, is a different beast. Chat Control 2.0, the CSA Regulation proper, would make scanning mandatory rather than voluntary, and would apply to a broader set of services. This is the version that has been stuck.

Between December 9, 2025 and May 11, 2026, EU institutions held four trilogue rounds on the 2.0 file. A fifth trilogue on June 29, 2026 collapsed without agreement. The Council's own Legal Service had, three weeks earlier on June 10, 2026, filed formal concerns that mandatory scanning conflicts with EU fundamental rights case law. That legal-service warning is important. It is not campaign material from an NGO. It is the Council's own lawyers telling the Council its text will not survive Luxembourg.

The reason 2.0 stalled at Council is arithmetic. On November 26, 2025, the Council endorsed a position that would keep mandatory client-side scanning on the table. But in October 2025, Germany publicly reversed its position and announced opposition to mandatory scanning, breaking the Council's blocking minority math. That reversal happened against a longer backdrop: on April 27, 2023, ten EU Member States had already issued a joint "like-minded group" position warning that client-side scanning breaks the security guarantees of end-to-end encryption.

The false-positive problem the Commission never solved

The strongest case against Chat Control has never been ideological. It has been operational, and it has been made in numbers by police and regulators, not activists.

A Republik investigation, cited publicly by former MEP Patrick Breyer, reported that the Swiss Federal Police found 80 percent of machine-reported content was not actually illegal. Ireland confirmed in 2020 that 20 percent of NCMEC reports it received were actual child sexual abuse material. Germany's Federal Criminal Police Office, the BKA, has said that around 50 percent of Chat Control 1.0 reports are criminally irrelevant. Ylva Johansson, then EU Commissioner for Home Affairs, publicly admitted the ceiling: "75% of NCMEC reports are not of quality that police can work with."

Patrick Breyer's summary of what the regulation actually does has been the campaign's most quoted line: "Mass surveillance by means of fully automated real-time surveillance of messaging and chats and the end of privacy of digital correspondence."

Encryption, and what the platforms have said

The single technical distinction that separates the two files is the treatment of end-to-end encryption. Chat Control 1.0 formally excluded end-to-end encrypted communications from its scanning regime. Chat Control 2.0 is silent on this exclusion. That silence is why Signal and WhatsApp have publicly threatened to leave the EU market rather than implement client-side scanning before encryption.

The non-encrypted providers took the opposite position. After the April 4 expiry, Google, Meta, Microsoft and Snap all publicly said they would continue scanning under other legal bases regardless of the EU's decision. The fight, then, is not really about whether Gmail scans attachments. Gmail will scan attachments either way. The fight is about whether the law can require a messenger to inspect a message before the message is encrypted, which is the design point at which "scan before send" and "private message" become the same object seen from two sides.

The Council chamber will fill on Thursday. The Irish presidency inherits the 2.0 file from Denmark. The 361-vote threshold either holds or it does not.

Sources

• fightchatcontrol.eu overview of Chat Control 1.0 expiry
• Regulation (EU) 2021/1232, the temporary derogation from ePrivacy
• European Commission proposal for the CSA Regulation, May 11, 2022