EU chat control law proposes scanning your messages — even encrypted ones

The European Union is getting closer to passing new rules that would mandate the bulk scanning of digital messages — including encrypted ones. On Thursday, EU governments will adopt a position on the proposed legislation, which is aimed at detecting child sexual abuse material (CSAM). The vote will determine whether the proposal has enough support to move forward in the EU’s law-making process.

The law, first introduced in 2022, would implement an “upload moderation” system that scans all your digital messages, including shared images, videos, and links. Each service required to install this “vetted” monitoring technology must also ask permission to scan your messages. If you don’t agree, you won’t be able to share images or URLs.

As if this doesn’t seem wild enough, the proposed legislation appears to endorse and reject end-to-end encryption at the same time. At first, it highlights how end-to-end encryption “is a necessary means of protecting fundamental rights” but then goes on to say that encrypted messaging services could “inadvertently become secure zones where child sexual abuse material can be shared or disseminated.”

The proposed solution is to leave messages wide open for scanning — but somehow without compromising the layer of privacy offered by end-to-end encryption. It suggests that the new moderation system could accomplish this by scanning the contents of your messages before apps like Signal, WhatsApp, and Messenger encrypt them.

In response, Signal president Meredith Whittaker says the app will stop functioning in the EU if the rules become law, as the proposal “fundamentally undermines encryption,” regardless of whether it’s scanned before encryption or not. “We can call it a backdoor, a front door, or ‘upload moderation,’” Whittaker writes. “But whatever we call it, each one of these approaches creates a vulnerability that can be exploited by hackers and hostile nation states, removing the protection of unbreakable math and putting in its place a high-value vulnerability.”

Several organizations, including the Electronic Frontier Foundation, the Center for Democracy & Technology, and Mozilla, have also signed a joint statement urging the EU to reject proposals that scan user content.

Privacy advocates aren’t the only ones raising alarm bells about the proposal. This week, dozens of Parliament members wrote to the EU Council to express their opposition to the proposal. Patrick Breyer, a German member of the European Parliament, has also spoken out about the bill, saying that “indiscriminate searches and error-prone leaks of private chats and intimate photos destroy our fundamental right to private correspondence.”

According to Breyer, renewed discussions surrounding the chat control law didn’t appear out of nowhere. He says that chat control supporters are pushing ahead now to take advantage of the period after the European Elections “during which there is less public attention and the new European Parliament is not yet constituted.”

In a statement to The Verge, Breyer also points out that the Belgian Presidency ends later this month, and the country’s current Minister of the Interior has been at the forefront of the chat control bill. “Proponents failed last year to secure a majority,” Breyer says. “This may be their last opportunity.”

If the legislation gains support, negotiations will begin between the EU’s Parliament, Council, and the Commission to form the final text of the law. But even with an endorsement from EU governments, chat control supporters may still have trouble pushing it forward. Last year, a poll conducted by the European Digital Rights (EDRi) group suggested that 66 percent of young people in the EU disagree with policies allowing internet providers to scan their messages.

“Many lawmakers understand that fundamental rights prohibit mass surveillance, but they don’t want to be seen opposing a scheme that’s framed as combatting CSAM,” Breyer says. “My message is that children and abuse victims deserve measures that are truly effective and will hold up in court, not just empty promises, tech solutionism and hidden agendas.”