A European Union proposal that would require the automated scanning of private digital communications belonging to 450 million citizens remains unresolved after years of negotiation. Known informally as "Chat Control 2.0," the measure has been debated since 2022 and is framed as a tool to detect child sexual abuse material. Its latest round of trilogue talks between the European Parliament, the Council of the EU and the European Commission ended without agreement, and discussions are due to resume in November.
What the proposal would actually do
The current legal framework, in place since 2021 and set to run until 2028, allows platforms to voluntarily scan messages for illegal content. Chat Control 2.0 would replace this with something far broader: mandatory, automated scanning of private messages, photos and files using artificial intelligence, applied regardless of whether a user is under suspicion of any wrongdoing. Crucially, the proposal would also reach into end-to-end encrypted services, the communication standard relied upon by billions of people to keep messages unreadable to anyone but the sender and recipient.
Encryption works by converting data into a code that only the intended recipient's device can unlock. Any mechanism that scans content before it is encrypted, often called "client-side scanning," necessarily creates a point of access that did not previously exist. Security researchers have long warned that such access points, once built, become targets. A scanning system designed to catch criminals could just as easily be exploited by hostile states or cybercriminals, or repurposed by future governments for other forms of monitoring.
The false-positive problem
A 2023 European Parliament study examining this specific proposal concluded that AI-based detection of this kind would produce high error rates and a significant volume of false positives. In practice, this means large numbers of innocent people could have private, lawful messages flagged, reviewed and potentially reported to authorities. The core disagreement among EU institutions reflects this concern: Parliament's position favors limiting scanning to individuals already suspected of involvement in abuse material, while other parties continue to push for indiscriminate, blanket scanning of all users.
This is not a narrow technical dispute. It is a question of whether the presumption of innocence survives in digital communications at all.
Part of a wider regulatory pattern
Chat Control 2.0 does not exist in isolation. It follows the Digital Services Act of 2022, which can fine major platforms up to six percent of global revenue for failing to remove content the EU designates as hate speech or disinformation, enforced partly through officially recognized "trusted flaggers." Critics argue that the DSA's broad, loosely defined categories already pressure platforms toward over-removal of legitimate speech. Layering mass message-scanning on top of existing content controls would extend regulatory reach from what people are permitted to publish to what they are permitted to say privately.
Supporters of the bill describe it as a child-protection measure, and the underlying goal is not in dispute. But the method matters. Systems built to monitor everyone in order to find a few wrongdoers tend to normalize surveillance as a default condition of digital life rather than an exceptional response to specific threats. For a continent that has historically positioned itself as a global standard-setter on data protection, through frameworks like the GDPR, Chat Control 2.0 would mark a notable reversal. The outcome of November's talks will determine whether that reversal becomes law.