Chat Control: the end of private correspondence in Europe?

The end of private correspondence in Europe?

The adoption of what is known as "Chat Control" in the European Parliament has sparked fierce controversy. At the heart of the criticism lies a procedural paradox: a majority of the MEPs present reportedly voted to reject the text, without reaching the threshold needed to block its adoption. The issue goes beyond parliamentary technicalities. It concerns the democratic functioning of the institutions and the protection of private correspondence.

Chat Control is one of the most controversial measures in recent European history. It faces opposition from many MEPs, human rights defenders and developers of confidential communication software such as the Signal messenger. Yet its temporary version, commonly called Chat Control 1.0, is in force. Europe's influence on the global market makes its consequences significant well beyond its borders, including for Russian users. For IBCSC, this debate directly concerns the confidentiality of communications and citizens' ability to communicate freely.

Chat Control 1.0: an exception to confidentiality

Two different initiatives are often lumped together and confused under the name "Chat Control". Both aim to increase control over personal correspondence and, in IBCSC's analysis, run counter to European privacy and data protection rules. But their mechanisms are very different. Understanding these mechanisms also requires looking back at the legislative battle that accompanied their discussion.

The adoption of Chat Control turned into a genuine legislative drama, with an aftertaste of backroom dealing all too familiar to Russians. And we cannot skip over that story. What has just been adopted, against the will of the European Parliament, is what is known as Chat Control 1.0. It introduces temporary exceptions to Directive 2002/58/EC, also known as ePrivacy: the directive on privacy in electronic communications.

This directive imposes a number of requirements on the processing of user data. In particular, it guarantees the confidentiality of phone calls, text messages and other communications carried by traditional telecoms operators. Their content may not be intercepted, listened to or analysed without the consent of the participants or a specific legal basis.

Messaging services that are independent of a phone number and other means of electronic communication, such as email and voice calls, did not originally fall within the scope of ePrivacy. In other words, private correspondence on these services did not enjoy any special protected status. Instead it was treated under the General Data Protection Regulation, the GDPR, which in some cases allows service operators to analyse their users' data themselves.

Most often, this was done on the pretext of combating illegal content, such as child sexual abuse material, or CSAM. Many large platforms voluntarily checked part of the uploaded files and messages. They searched for already-known content using digital fingerprints, and for potentially new images and signs of grooming using algorithmic classifiers.

Although fighting child exploitation is a good thing, the methods used raised many questions from the outset. To find the tiny proportion of users who were actually spreading such content, tech giants analysed all private correspondence and all data stored in the cloud. IBCSC considers that this logic resembles extrajudicial mass surveillance more than genuine protection of children's rights and the fight against criminals. Yet for a while, all of this seemed to have a legal basis.

How the temporary exception took hold

In 2018, the European Union revised the European Electronic Communications Code and broadened the definition of communication services. It included messaging apps, webmail and voice over IP. From then on, these services also fell within the scope of ePrivacy.

Pressure began to mount on European leaders. On one side were NGOs and human rights defenders genuinely concerned about protecting children's rights. On the other were the tech giants and surveillance technology vendors, interested in access to users' private data. The European Commission then proposed a temporary derogation: an exception to the rules that allowed companies to continue voluntarily analysing content.

The derogation was adopted in 2021. That is precisely the famous Chat Control 1.0. Meta, Google, Microsoft and LinkedIn, for example, made use of it. Surveillance of private communications in the European Union therefore did not appear in the summer of 2026. Many large services had been doing it for a very long time, including platforms used every day.

But if an exception is temporary, it is precisely because it is not supposed to last forever. Its deadline was set for 3 August 2024. In the meantime, the European Commission was to propose a permanent law to replace it, and the European Parliament was to agree on its adoption.

Chat Control 2.0: from voluntary to mandatory

In 2022, the European Commission, driven by Home Affairs Commissioner Ylva Johansson, presented a draft permanent regulation to prevent and combat child sexual abuse: the CSAR. This is what is informally called Chat Control 2.0.

Unlike the temporary derogation that is Chat Control 1.0, the draft was to create a comprehensive, permanent system allowing authorities to compel services to detect known and new content as well as signs of grooming. In other words, whereas some companies could previously do this voluntarily, analysis would now become mandatory for everyone.

Chat Control 2.0 is a deeply odious text, fundamentally incompatible with the confidentiality of correspondence and the inviolability of private life, down to their very principle. In its initial form, the document provided that operators of communication services would, on the order of the authorities, have to analyse users' correspondence and hand over everything it contained.

The text contained no exception for end-to-end encryption. Had it been adopted, private communication as such would therefore have ceased to exist overnight in the European Union. Messaging services would have had to either build in interception of exchanges or go underground. That is exactly what the president of the Signal Foundation promised: if the law is adopted, Signal will leave Europe.

Fortunately, under an avalanche of criticism, it proved possible to push back this arbitrariness somewhat. A later version therefore only covered the analysis of links, videos and images. As for removing encryption, it was made "voluntarily mandatory" so as not to breach existing legislation. Either users agree of their own accord to total surveillance, or the messaging service must take away their ability to send those very links, images and videos.

An extension, then a new battle

Despite everything, it was not possible to agree on Chat Control 2.0, even in this form, thank God. Meanwhile, the first version's period of validity was drawing to a close. In April 2024, the derogation was therefore extended until 3 April 2026. And this year, it finally ceased to apply.

Throughout this time, the Chat Control 2.0 draft remained in limbo. Despite constant attempts to push it through, nobody succeeded. And when the question of a further extension of the derogation arose, MEPs demanded that it include exceptions for communications protected by end-to-end encryption.

Most of the member states represented in the Council of the European Union rejected Parliament's restriction, considering that it made the measure itself ineffective. In the months that followed, the parliamentarians therefore failed to reach an agreement. That is why, in July, the European People's Party, which had supported Chat Control from the start, decided to resort to a trick.

The urgent procedure and the 360-vote threshold

After the first reading, the European Parliament transmits its position to the Council of the European Union. If the Council amends the text, a second reading begins. Usually, the document returns to the competent committee, which examines it, prepares amendments and recommends that Parliament approve, amend or reject the Council's position.

But the European People's Party called for Rule 170 to be applied: an urgent procedure intended for unforeseen events, which allows a matter to be put to a plenary vote without the usual committee report.

Triggering the urgent procedure only requires a majority of the MEPs present. Those in favour of speeding things up obtained it. By contrast, rejecting the Council's position outright at second reading requires an absolute majority of all members of the European Parliament: 360 votes, regardless of how many MEPs are present.

Had the draft law been sent to the competent committee, its examination would probably have taken several more weeks, if not longer. The second reading would have had to be postponed until the autumn, when all MEPs were back from holiday.

But thanks to the urgent procedure, the second reading was scheduled for the very last day before the summer recess, when more than a hundred MEPs had already left on holiday and could not vote. And every absent MEP reduces the chances of gathering the 360 votes needed. The result: Chat Control 1.0 could not be rejected, even though a majority of those present voted against it.

Of course, we cannot say with certainty that the draft law would have been rejected again in the autumn. But when a political group schedules a vote for a date on which its opponents physically cannot vote, it smells bad.

Here, for example, is how the president of the NGO Open Dialogue Foundation, Lyudmyla Kozlovska, assessed the situation:

"The bar for blocking the text was set higher than the bar for adopting it. The vote took place on the last day before the summer recess, when barely 600 of the 720 MEPs were in the chamber. What Parliament had rejected in March passed today in an empty room, thanks to a procedural imbalance. This should worry anyone who cares about how democracy works, not just about privacy."

What confidentiality means for people at risk

The case of Konstantin Kachanov, an electrician from Moscow, illustrates what is at stake in concrete terms. When Vladimir Putin launched the full-scale invasion of Ukraine, Konstantin, like several thousand Russians, was horrified and did not know what to do. In case he was mobilised, Kachanov contacted the Ukrainian project "I Want to Live" in advance to find out how to surrender and be taken prisoner.

He was then offered the chance to carry out an action: painting graffiti in public places. A few slogans and some crosses. It was for these small crosses that Kachanov was arrested by the FSB. Investigators immediately told him that criminal proceedings for high treason awaited him. The maximum sentence: life imprisonment. A whole life in prison for six strokes of paint on the asphalt.

Fortunately, that did not happen. The investigators made a mistake that allowed Kachanov to leave the pre-trial detention centre for exactly one day. Human rights defenders reacted immediately. At the time of publication, Konstantin was safe and starting a new life abroad.

This story is a reminder that legal aid and, where possible, help to leave the country for people being prosecuted may require absolute discretion. The successes made public represent only part of this work. For IBCSC, this example highlights the human stakes of confidentiality: some exchanges directly concern the safety of people exposed to repression.

Why so much opposition to Chat Control?

Beyond the procedure, a question remains: why such strong opposition to Chat Control? In the fight against child exploitation, aren't all means justified? The question is understandable, but it is fundamentally the wrong one.

In democratic countries, citizens enjoy the presumption of innocence. In Europe, the police cannot open every letter "just in case", in the hope of finding something. They cannot burst into any house simply because a criminal could, in theory, be hiding there. Nor can they force every citizen to show their family albums or the videos on their phone.

Everyone has the right to the confidentiality of their correspondence and to respect for their private life. People do not have to prove anything to anyone in order to exercise these rights. It is the law enforcement authorities who must show a court that there are sufficiently serious suspicions about a person to intervene in their life. But digital platforms work on the principle that "if it goes through an app, it doesn't count". Chat Control 1.0 effectively entrenches this state of affairs.

Questions about effectiveness and false alerts

And that is without even mentioning the problems with the scanning technology itself. Criminals have long used a whole range of methods to get around automated CSAM scanners. This was explained in an open letter to the European Parliament and the Council of the European Union, signed by several hundred security and cryptography experts. The question of effectiveness therefore remains open.

The European Commission itself has acknowledged that the data available to it does not make it possible to determine how many convictions are specifically linked to reports from platforms that filter CSAM:

"At present, the available data also does not allow a clear link to be established between these convictions and the reports submitted by service providers and organisations acting in the public interest against child sexual abuse during the relevant reporting periods."

The question arises: if it is impossible to demonstrate the effectiveness of years of interference in users' private lives, why extend it? Is there any justification other than the interests of the companies that supply surveillance systems?

On the other hand, these same scanners regularly make mistakes and automatically send police reports about law-abiding users who are not involved in any child exploitation. And, to this day, no company has been held accountable for this.

Protecting children beyond "security theatre"

Another problem lies in trying to fit the problem into a predefined solution. CSAM is not the abuse of children itself: it is the trace of that abuse. Searching for it does not replace preventing the abuse itself, helping victims, identifying perpetrators or dismantling distribution networks. And very often, the police simply do not have the resources to deal with it.

That is the real problem that human rights defenders at European Digital Rights, among others, propose to tackle: giving law enforcement more resources to investigate the organised criminal networks that profit from abuse, and to deal with its consequences, rather than playing security theatre. Working within the framework of European law and procedural rules, rather than trying to get around them on the grounds that "if it goes through an app, it doesn't count".

Incidentally, the term "Chat Control" was popularised by the lawyer and former MEP Patrick Breyer, who has consistently fought against the introduction of this surveillance. After the vote in which Chat Control 1.0 was imposed, he said:

"Trying to protect children through mass surveillance without any grounds for suspicion is like mopping the floor while the tap is still running. Blanket screening of conversations is just as unacceptable as indiscriminately opening all the post. For five years, this flawed system has served as a smokescreen to delay real measures, while overloading the police with false alarms. We need more protection for children, not less. But we need effective protection, not an illusion of safety."