3. 8. 2026

What is EU Chat Control and why should you care?

Author: Tomáš Bořek

Tags: politics

The European Parliament has failed to stop the extension of a temporary derogation that allows technology providers to scan digital communication for the purpose of identifying and reporting Child Sexual Abuse Material (CSAM). Despite some media reporting, the EU did not really green-light anything – it's mostly just a preservation of the status quo.¹

What's unusual is that the European Parliament had rejected this proposal twice in March, and yet it has still found itself back in the second reading following an urgent procedure request from the largest parliamentary party and the main ambassador of Chat Control, the European People's Party (EPP). An absolute majority of the Members of the European Parliament (MEPs) is required to reject a second reading proposal. Tough condition for a pre-holiday Parliament.

This derogation, colloquially known as "Chat Control 1.0", was originally adopted in 2021, and the scanning it allows was legal even before that. In this article, I want to explore the reason for the existence of Chat Control, clarify common misconceptions, outline why it's bad, why some politicians push it so aggressively, and what we can do instead.

Prepare for trouble; and make it double

If you're among the ~21% of EU citizens aware of Chat Control, you might've heard that there are actually two of them, usually differentiated with 1.0 and 2.0 denotations. To understand the relationship and difference between them, let's take a step back and understand the problem at hand.

As briefly mentioned in the introduction, Chat Control 1.0 is a temporary exception; specifically from an EU law called the ePrivacy directive – an old law establishing some general rules sconcerning communication in the digital sphere. Its purpose is to enforce the fundamental right to privacy and confidentiality while engaging in electronic communication.

Member States [...] shall prohibit listening, tapping, storage or other kinds of interception or surveillance of communications and the related traffic data by persons other than users, without the consent of the users concerned, except when legally authorised to do so...

ePrivacy directive, Article 5, paragraph 1

Saying that Chat Control 1.0 was adopted in 2021 suggests that scanning of digital communication had been illegal prior under the ePrivacy directive, but I admit that's misleading.

The ePrivacy directive didn't apply to most providers facilitating communication over the internet (messaging platforms, webmail providers, etc.) until the adoption of the European Electronic Communication Code (EECC) at the end of 2020. This directive introduced changes to some of the outdated definitions that the ePrivacy directive worked with, and it effectively pulled all the previously out-of-scope apps under the directive's authority overnight. All of this means that scanning of unencrypted communication was completely legal and common practice pre-2020.

Ad infinitum

This redefinition had suddenly made scanning for CSAM online illegal. Child-protecting institutions that observed a significant drop in suspected child sexual exploitation reports coming from the EU started to push against it. EU swiftly adopted the exception that re-established the legal basis for internet communication scanning, as long as it was for the purpose of revealing and reporting CSAM. Even in this legal vacuum that had emerged after the adoption of the EECC and lasted until the adoption of the exception, some companies – like Microsoft, LinkedIn or Google – openly proceeded with scanning.

This "temporary" regulation was supposed to buy the EU some time to craft better, long-term legislation around this issue. The expiration date for the derogation was set for August 2024.

The European Commission kicked off a legislative procedure officially known as the Child Sexual Abuse Regulation (CSAR), but usually referred to as "Chat Control 2.0." This legislation was first proposed by then-Commissioner for Home Affairs Ylva Johansson in 2022. Rather than trying to find a balance between the interests of child-protection groups and the privacy and human rights camp, this legislation pushes for even larger violations of the right to privacy. Put simply, according to this proposal, scanning shouldn't be optional, it must be mandatory and work around encryption. This polarizing proposal led to widespread criticism, and the Commission and Parliament still haven't reached an agreement on the form of the law.

Due to the impasse, Chat Control 1.0 has been reinstated twice to buy more time. The temporary nature of it is what helped it get pushed through the European Parliament and the Court of Justice (ECJ) in the first place, but the recurring extensions put the entire concept of a temporary law into question – is a law really temporary if we extend it every time it expires?

Follow the money

Before we dive into the substantial problems with Chat Control 2.0 and the general issue with disproportionate blanket surveillance, let's stop and consider some peculiar behavioral patterns. The opposition to this idea is not fringe; a lot of people find it absurd that some European politicians push this generally unpopular law so hard. Part of it can be accounted for by authentic interest in this ethically and emotionally loaded topic, part by a lack of knowledge about the digital world (more on that later); I'd like to bring a much more familiar element to any sketchy initiative rousing seemingly unreasonably intense interest from a particular group of people – money!

The societal benefit of Ashton Kutcher isn't limited to his roles in the hit "Dude, Where's My Car?" and "Two and a Half Men." Upon joining forces with Demi Moore, who felt inspired to act when she learned that it's not just poor countries that traffic children, they founded Thorn. Thorn is a for-profit organization registered as an NGO that develops software for detecting child sexual abuse material online.

The Commissioner who kick-started the proposal, Swedish politician Ylva Johansson, and her staff have had suspicious ties with Thorn, which would, as a vendor for software detecting child sexual abuse content, benefit commercially from this initiative. In turn, Thorn has spent a lot of money financially supporting lobbying groups around Johansson's proposal and was allowed to have influence over the emerging law, attending crucial decision-making meetings attended by ministers and EU representatives.

We then have to ask: who benefits, and is it really the children?

How internet allows disproportionality

Although resembling a decentralized network, the internet has become vastly dependent on a small number of technological giants that – due to a large infrastructure, data ownership, or other advantages – play an important role in all of its communication. This makes the internet one of the most potent surfaces for unintentionally or intentionally disproportionate policies.

By disproportion I mean the unbalanced ratio of the value that a policy brings to the damage or risk it introduces. Oftentimes, this is born out of ignorance of state officials while crafting these policies.

In 2025, Spanish football league LaLiga pushed a peculiar policy through the court. It was intended to prevent illegal livestreaming of football matches by blocking particular IP addresses but resulted in collateral damage, blocking access to a significant chunk of the internet from Spain. This meant that a number of completely unrelated services were inaccessible during football matches. People lost access to government websites and personal data in the name of one company's commercial interests.²

I invoke this example to show how easy it is to implement policies with insane blast radii when officials with limited digital knowledge hold the helm.

Microsoft, an eagerly compliant company, reported scanning 11.7 billion content items globally, of which 32 thousand were flagged as potential CSAM. That's a rate of 0.0000027% or 1 suspicious content item per 356 thousand scans. We don't have any data about how many of those flagged cases were legitimate criminal activity, but just think of the number of Marks³ among the 32 thousand reports.

Why mass scanning is bad

I want to be as practical as I can be here. Like many, I might have nothing to hide, but the notion of all my communication passing through AI systems built by Ashton Kutcher raises an icky feeling in me. However, throughout some of my conversations on this topic, I've found out that this is a purely subjective feeling, and many don't feel this way or are willing to bear it for the greater good of child protection. Let me offer three practical areas outlining why Chat Control is a suboptimal solution approaching the problem from the wrong direction, and why we want to boycott it even if we're fine with our personal communication being intercepted.

First, there's no democracy without privacy. An infrastructure put in place by a democratic process doesn't guarantee that the democracy that built it will steer it in forever. Once these tools are in place, it's just a political matter how they're used. The idea of alternative intentions – outside of CSAM-scanning – is not a wild figment coming out of the disturbed paranoiac's mind – it's on the table and Europol has been playing with it.

Databases mapping communication and identities are a treasure for anyone commercially interested in data extraction (most tech giants) or anyone looking to hunt down, oppress, and target a social group based on a trackable attributes – class, race, gender, etc. No wonder the first place Nazis visited in a town was the civil registry. Any encryption bypass inherently introduces vulnerabilities, no matter which software wizard devises it. Misuse of this data for profit or as a political or violent tool is a real threat – if we ever face further erosion of human rights and subversion of democracy, privacy would be a sorely missed weapon in this battle.

Second, Chat Control won't work nearly as well as expected. Between 2022 and 2023, the European Parliament commissioned a study estimating the impact of the proposed legislation. The results were... not good at best and concluded that Chat Control would be a very ineffective measure for combating child sexual abuse. Among many problems, the study emphasizes weak problem definition, the shortcomings of today's technology, the displacement effect, and reinforces the disproportionality and seriousness of the complete violation of the right to privacy online.

There are other, direct ways in which a child might be compromised online; sharing and demand for explicit material isn't the only mechanism driving sexual abuse. "Grooming" is a prelude to real-world sexual abuse that very often originates on the internet. Even state-of-the-art AI systems aren't realistically capable of picking up the nuanced, context-dependent contours of the often months-long conversations between the predator and the child. There doesn't seem to be a clear plan to tackle challenges like these, in spite of their undeniable urgency and rightfully earned place on the priority list of anyone claiming to be concerned with children's safety and well-being.

Outlaw anything and watch it crawl and retreat into a deeper, even less accessible space, where it slips completely out of reach. We already have effective systems of targeted judicial-order scanning, open-source intelligence (OSINT), and practices of deliberate infiltration by authorities following legal, publicly available cues. These methods are precise, proven, and effective. Introducing such a law as Chat Control 2.0 will cause illegal activity to disappear from places where authorities have any chance of tracking it down, e.g. the "dark net." This is not black and white. As I'll mention later, consumption of child pornography is often manufactured and initiated by the vast supply and presence of it on the legal web, not the other way around. Displacement might decrease random encounters that create many CSAM offenders, but it also buries the big fish even deeper in the abyss.

Third, we must not forget that initiatives like this are technologically demanding, only feasible for large companies with large teams of developers and legal people keeping up with and implementing the legislation. Smaller or open-source alternatives to big tech might not be able to conform to the demands, ceasing to exist. Along with them, a number of privacy-conscious apps simply unwilling to adopt this law would leave the EU market. I've already mentioned that the internet is a dangerously centralized place, with power concentrated in the hands of a few. Technologically demanding laws favoring only those who already have the resources further curtail the software and infrastructure ecosystem.

Investing millions of euros into esoteric tech systems before increasing budgets for cybercrime departments, supporting child-protecting organizations, or investing in tools that help fight CSAM spreading via ethical methods (like PhotoDNA) brings up an important question: have we really exhausted all options to bring in the artillery?

In short, we're sacrificing the right to privacy – a pillar of democracy – for a system that has been proven to be ineffective, inaccurate, and disproportionate at revealing a certain subset of child sexual abuse online, and by that we further concentrate power in the digital space in the hands of the already powerful. That doesn't sound right.

Hate the game

Child-protection agencies are often painted as the antagonists of this story, but their concerns should be our concerns – we need to fight the sexual exploitation of children. There's no doubt that full-blown blanket scanning would catch more perpetrators, but a conversation about manufacturing and distribution of child porn, sexual abuse online and protection of children in these digital realms cannot be led in a vacuum.

Emphasis must be placed on the level of fatalism in the framing of the issue. Specifically, how technology is portrayed as either a force of nature, destroying what stands in its way on the one hand, or a very sad reflection of humanity itself on the other. Both cases are soaked with impotency, helplessness, and resignation.

Think of how the profit-driven models of internet platforms, equipped with experts and years of behavioral research, tear the fabric of society by capitalizing on the deepest psychological inclinations humans are inherently cursed with.

While the exact figures of adults frequently consuming child pornography are unknown, experts and data agree that the problem keeps getting worse. The US-based NCMEC reported 47% increase in CSAM reports between 2020 and 2022. Most CSAM offenders report that they got into this illicit content through an escalation in their addiction to legal pornography or by discovering it by accident while browsing legal adult websites. This is what Richard Wortley calls a classic example of "supply-led" demand. Porn is addictive and portals offering pornographic material are notoriously bad at curation, offering multitudes of rape and minor-depicting content. Even among legal content, categories like "teen" or "hentai"⁴ remain some of the most popular and suggested. This is hardly an aberration; addictive algorithms trying to steal as much of the users' attention as possible, using stimulating, gratifying, often shocking content is what the modern internet runs on. It's clear that porn, or "soft porn" featuring suggestive images and videos even beyond the boundaries of adult websites, captures otherwise healthy adults, causes addiction and creates or amplifies sexual deviations, including orientation toward children.

Algorithms capturing attention affect children, too. Experts have observed children spending more time on the internet, and research suggesting serious developmental impacts, is surfacing. Politicians pushing for Chat Control are allegedly interested in protecting children from all sorts of sexual abuse, including grooming. There's a step that precedes wide monitoring of everyone's communication – make children spend less time on the internet. If a child spends a majority of their time on the internet, connecting with shady people, there's a statistically higher chance they will encounter someone weird, or with malintent. The real conflict isn't between the privacy defenders and the child-protecting services; it's between the money-hungry platforms, designed to indiscriminately bring and keep visitors, and the parents, who wish to protect their children.

While all of the stated is a fact, demanding an action addressing it sounds like a fantasy. It might seem insurmountable to fight the entire attention economy, but there are real, immediate changes that can be demanded from these platforms. For example, the MEP for EGP, Markéta Gregorová, suggests better guardrails around who can and cannot contact a minor on certain platforms. This is a structural, legislatively demandable change with impact.

A social media ban for children is just reinventing the wheel of mass surveillance ⁵; the goal should, therefore, be to put the means of control into the hands of the people who know the child best and are closest to them – the parents. This doesn't just entail arming them with tools, because tools do nothing if we don't know how to use them. The majority of people don't know what grooming is and how to spot it. Why is our first instinct to fight an issue from the most remote place, with the largest blast radius, instead of starting where it's most impactful – the community? Investing in education, instead of finding yet another way to transfer taxpayer money to large technological companies, should be the priority.

Except for parents, other people close to the children, like doctors or teachers, can act. An educated network of trusted flaggers comprising of people working closely with children, well-positioned to pick up on red flags and report suspicion that something's going on, would also go a long way.

Conclusion

There is no panacea in the form of omnipotent technology for such a structural issue reaching into many facets of society. There's an undeniable problem with CSAM and justified worry for children's safety online that should rather be addressed through investment in existing infrastructure and education. Instead of fatalistically accepting technology as a burden or reflection, we should start understanding it in a McLuhanian way:

We become what we behold. We shape our tools, and thereafter our tools shape us.

Marshall McLuhan, Canadian media theorist

And the tools don't emerge in a vacuum either; they're dictated by the set of incentives we, as a society, decide to embrace.

This set of legislation is sadly a shallow facade, pretending to do something noble. It does, however, shed light on some of the right issues we should be discussing; the conclusions are just wrong. To prevent this bull-in-a-china-shop of a law from passing in a form that's even remotely close to the one currently in the works, we need to educate ourselves and the MEPs. This is why I'm writing this article! Let's push the EU to care about the protection of children, but let's also push it to be more effective, transparent, and realistic.

If you want more information about Chat Control, the positions of MEPs in your country, and a tutorial on how to contact your representatives, visit this awesome citizen initiative fightchatcontrol.eu.

Special thanks to Rosa for feedback and edits.