Chat Control Secria

Chat ControlHow it works

How would Chat Control scan messages?

By comparing images with fingerprints of known abuse material, and by using software that flags likely new material or grooming. On encrypted apps, that check would have to run on the phone itself.1, 2, 5

Checked 29 October 2026 against the sources.

Three things a scanner can look for

The Commission's 2022 proposal let detection orders cover known material, new material and grooming.1 Each needs a different technique.

TargetTechniqueHow it works
Known materialHash matchingAn image or video is turned into a short digital signature, a "hash", and compared with a database of hashes of verified abuse material.2
New materialClassifiersSoftware that estimates whether material not seen before is likely to be abuse material, instead of matching a known fingerprint. The temporary rules describe classifiers and artificial intelligence in use today.2
GroomingText analysisSoftware that looks for patterns in conversations. Under the current temporary rules it must rely on key indicators and risk factors "such as age difference".3

Under the 2022 proposal, providers could only detect using indicators verified and supplied by a new EU Centre.1

Where the scanning happens

On an ordinary service, the server can read messages, so it can scan them there. With end-to-end encryption it cannot, so the only place left is the device.

End-to-end encryption: the message is locked on your phone, the server passes on data it cannot read, and the other phone unlocks it. Hi Your phonelocks the message server sees scrambled data Hi Their phoneunlocks it
End-to-end encryption. Only the two phones hold the keys. A scanner on the server has nothing it can read.
Client-side scanning: your phone checks the message before locking it. A possible match can be reported. The rest of the path is unchanged. Hi Your phonechecks, then locks server sees scrambled data Hi Their phoneunlocks it possible match: a report can be sent
Client-side scanning. The encryption itself is unchanged, but a check runs on the phone before the message is locked. Critics and supporters disagree on whether that keeps the promise of end-to-end encryption.5, 6

The two sides of the technical argument

Both sides agree on how the pieces work. They disagree on what the scanning costs and what it achieves.

The case that it can be done safely

The 2022 proposal required detection technology to be effective, unable to extract any other information than needed, the least intrusive available and "sufficiently reliable".4 It called end-to-end encryption "an important tool" and said the law should not favor or disfavor any technology.4

The EU Centre would check providers' reports before passing them to police, to limit errors.1

The case that it cannot

The EU's data protection authorities said orders could in practice amount to "general and indiscriminate" monitoring, and that detection, including client-side scanning, could be evaded by encrypting content with a separate app.5

A 2021 paper by 14 security researchers argues that client-side scanning "neither guarantees efficacious crime prevention nor prevents surveillance".6

What each text says about encryption

TextOrdered scanningEnd-to-end encryption
Commission proposalMay 2022Yes, by detection orderNo exception: orders apply "regardless of the technologies used".4
Parliament positionNovember 2023Yes, as a last resortExcluded from detection orders.7
Council mandateNovember 2025No; voluntary scanning made permanent, with a review clause8In September 2026 the presidency said encrypted content would be excluded from searches.9
Temporary rulesRegulation 2026/1881No, voluntary onlyDo not apply to communications to which end-to-end encryption "is, has been or will be applied".3
 As of 29 October 2026. The permanent text is still being negotiated.

Voice and email

Voice

Negotiators provisionally agreed in June 2026 to leave voice calls out of the permanent law, and to keep voice messages in scope but out of detection.10 The temporary rules do not apply to the scanning of audio at all.3

Email

The temporary rules name webmail alongside messaging as the kind of service that scans voluntarily.2 Email that is not end-to-end encrypted can be scanned on the provider's servers. How to protect your messages

This page explains technology and draft law. It is not legal advice.

Sources 10
  1. Summary of the legislative proposal COM(2022) 209, European Parliament Legislative Observatory. Read 29 October 2026.
  2. PE-CONS 14/1/26 REV 1, Regulation (EU) 2026/1881, recital 7, European Parliament and Council. Read 29 October 2026.
  3. PE-CONS 14/1/26 REV 1, Regulation (EU) 2026/1881, Articles 1 and 3, European Parliament and Council. Read 29 October 2026.
  4. 9068/22, the Commission's proposal COM(2022) 209, recital 26 and Article 10(3), Council of the EU. Read 29 October 2026.
  5. EDPB-EDPS Joint Opinion 04/2022, paragraphs 45 and 53, European Data Protection Board and European Data Protection Supervisor. Read 29 October 2026.
  6. Bugs in our Pockets: The Risks of Client-Side Scanning, 14 October 2021, Abelson and others, arXiv. Read 29 October 2026.
  7. Summary of the LIBE committee report A9-0364/2023, European Parliament Legislative Observatory. Read 29 October 2026.
  8. 14032/25, Presidency note on a partial mandate, 30 October 2025, Council of the EU. Read 29 October 2026.
  9. WK 15082/2026, outcome of the 6th trilogue, 30 September 2026, Council of the EU. Read 29 October 2026.
  10. 11501/26, outcome of the trilogue on 29 June 2026, Council of the EU. Read 29 October 2026.

Every fact here comes from the legal texts, the EU's own records or named research, checked again and dated. How we check