Law enforcement experts and policymakers are set to convene on September 12th to discuss proposals that would require technology companies to scan encrypted messages before transmission, ahead of a planned vote on the proposals by October 14th.
The “Chat Control” proposals, spearheaded by the Danish presidency of the EU Council, advocate for the mass scanning of mobile phones and computers to identify potential child abuse material within encrypted communications services. However, this initiative has sparked significant opposition from security experts and privacy advocates, with over 500 cryptographers and security researchers issuing an open letter on September 9th cautioning that the proposals are technically unfeasible and would “completely undermine” the security and privacy of European citizens.
The researchers argue that such measures would create vulnerabilities that could be exploited by hackers and hostile nation-states. WhatsApp, a widely used encrypted messaging service, has also voiced concerns regarding the EU’s draft proposals, with a spokesperson stating that the proposals would compromise end-to-end encryption, thereby endangering the privacy, freedom, and digital security of users.
The European Commission initially proposed mandating tech companies to scan emails and messages for potential child abuse content in 2022, but these plans were stalled due to opposition from a minority of member states who feared the proposals would compromise the security and privacy of EU citizens. In July 2025, the Danish presidency introduced a compromise aimed at balancing the security of encrypted communications with the need to identify potentially illegal content.
The compromise asserts that the proposed regulation should not be interpreted as prohibiting, weakening, or circumventing encryption and permits technology companies to continue offering end-to-end encrypted services. However, it requires technology companies to implement “vetted technologies” on devices to scan messages for images, videos, or URLs potentially associated with known child abuse content before encryption and transmission.
As of September 10th, 15 member states supported the Danish proposals, while six remained undecided and six opposed them. Opposing states, including Belgium, Poland, Finland, and the Czech Republic, have raised concerns about the mass surveillance of citizens’ communications. The Danish compromise agreement outlines specific requirements regarding encryption, including the requirement for publicly available messaging services using end-to-end encryption to detect abuse material before transmission.
Providers should remain free to offer services using end-to-end encryption and should not be obliged to decrypt data or create access to end-to-end encrypted data. Users of encrypted services would be asked to consent to having images, videos, and URLs they send monitored, and those who do not consent may be able to send messages without images, videos, or URLs.
Opponents of the proposals argue that “Chat Control” effectively introduces “suspicionless” mass surveillance for hundreds of millions of Europeans. The open letter from cryptographers and security researchers warns that on-device detection inherently undermines the protections of end-to-end encryption without guaranteeing improved protection for children.
German encrypted email provider Tuta Mail has stated that it would take legal action against the EU rather than compromise its users’ privacy by introducing backdoors into its encrypted messaging service. CEO Matthias Pfau believes the proposals would undermine trust in European technology, driving users to foreign tech giants. Alexander Linton, president of the Session Technology Foundation, argues that it is impossible to introduce scanning without creating new security risks.
Matthew Hodgson, CEO of Element, a secure communications platform used by European governments, believes the proposed “Chat Control” regulation is fundamentally flawed and would put the privacy and data of 450 million citizens at risk. He argues that undermining encryption by introducing a backdoor for lawful intercept is deliberately introducing a vulnerability that will be exploited.
Signal warned last year that it would pull its messaging service out of the European Union rather than undermine its privacy guarantees. Callum Voge, director for government affairs and advocacy at the Internet Society, said client-side scanning creates opportunities for bad actors to reverse engineer and corrupt scanning databases on devices.
The scientists argue that, rather than relying on a “technical fix,” governments should invest in education, reporting hotlines, and other proven techniques for tackling abuse. Voge suggests that policymakers should prioritize approaches that protect children while fostering an open and trusted internet, including increased resources for targeted approaches such as court-authorized investigations and metadata analysis.
