Chat Control timeline

1. Dec 2020New EU telecoms rules, due by 20 December 2020, bring webmail and messaging services under the ePrivacy Directive. From 21 December 2020 they can no longer rely on general data protection law to scan messages voluntarily.¹
2. 14 Jul 2021Regulation (EU) 2021/1232 creates a temporary exception that lets these services keep scanning for abuse material, pending a long-term law.¹
3. 11 May 2022The Commission proposes the permanent regulation, COM(2022) 209: risk assessments, an EU Centre, and detection orders for known and new abuse material and grooming.^{2, 3}
4. 28 Jul 2022The EU's data protection authorities, the EDPB and EDPS, publish a joint opinion raising "serious concerns" about the proposal's proportionality.⁴
5. 14 Nov 2023The Parliament's civil liberties committee adopts the report of rapporteur Javier Zarzalejos. It excludes end-to-end encryption from detection orders.^{2, 5}
6. 22 Nov 2023The plenary confirms the committee's decision to open negotiations with the Council.²
7. 29 Apr 2024Regulation (EU) 2024/1307 extends the temporary rules until 3 April 2026.¹

1. Jul to Sep 2025The Danish Council presidency tables compromise texts that include obligations for high-risk providers to detect known and new abuse material.⁶
2. 8 Oct 2025The presidency notes that its text lacks enough support for a Council position, mainly over the detection obligations.⁶ The same day, Germany's justice minister says Germany will not agree to proposals that force messengers to scan messages en masse before sending.⁷
3. 30 Oct 2025The presidency proposes a narrower mandate: remove detection obligations, make voluntary scanning permanent, and add a review clause on detection for the future.⁶
4. 26 Nov 2025EU ambassadors (Coreper) agree a partial mandate for negotiations.⁸ Hungary, Italy and the Netherlands put critical statements on the record.⁹
5. 9 Dec 2025First trilogue between the Council and the Parliament.⁸
6. 19 Dec 2025The Commission proposes extending the temporary rules by two years, to 3 April 2028.^{1, 10}

1. 26 Feb 2026Second trilogue. Further rounds follow on 16 April and 11 May.⁸
2. 11 Mar 2026The Parliament votes 458 to 103, with 63 abstentions, for a shorter and narrower extension of the temporary rules, until August 2027, and sends it back for negotiations.¹¹
3. 26 Mar 2026The Parliament rejects the Commission's extension proposal, closing its first reading.^{12, 13}
4. 3 Apr 2026The temporary rules expire. No EU exception for voluntary scanning is in force until the new rules take effect.^{1, 13}
5. 29 Jun 2026Fifth trilogue: provisional agreement on almost all of the permanent regulation except detection. Voice calls are left out and age verification is removed from this law.¹⁴
6. 9 Jul 2026Second reading in the Parliament. A motion to reject the Council's text gets 314 votes to 276, with 17 abstentions, short of the 360 needed. MEPs add an exclusion for end-to-end encrypted communications.¹³
7. 23 Jul 2026The Council approves the Parliament's amendments: 25 governments in favor, Hungary against, Belgium abstaining.¹⁵ The vote by country
8. 28 Jul 2026Regulation (EU) 2026/1881 is published in the Official Journal. It enters into force on the third day after publication and applies until 3 April 2028.^{1, 10}
9. 29 Sep 2026Sixth trilogue: agreement on the tasks of the new EU Centre. No breakthrough on searches and detection in non-public content.^{16, 17}
10. Dec 2026Seventh trilogue, tentatively planned by the Council presidency.¹⁶ What happens next

This page records what happened, not what should happen. It is not legal advice.

Every entry is dated from an official record and checked again. How we check