Chat control 2.0

Introduction

The Chat control in the EU is not a new topic, but has been intensively discussed and pushed forward at the EU level for several years – specifically since around 2021/2022, when the first legislative initiatives regarding the monitoring of encrypted communication were published.¹² Since then, I have repeatedly tried to raise awareness about this far-reaching threat to our digital fundamental rights, as the effects affect all users of digital communication.

In recent months, it has become increasingly clear that more and more Digital Creators, Influencers and Multipliers on platforms such as TikTok, YouTube and Instagram are addressing the topic of Chat control and privacy. They manage to draw attention in the broader public and highlight the dangers of this surveillance policy. The growing media presence of this topic is an important step towards further strengthening the necessary political and societal resistance.

The 12.09.2025 is only the “preliminary round” for the actual vote on 14.10.2025. Because on Friday, it is once again about giving the matter its final touch, so that everyone is “satisfied.” Whether and if it actually comes to pass, will be decided in October.

What is Chat control? - Definition and Goals

Chat control refers to the planned EU-wide obligation for service providers to automatically scan private communication for illegal content – particularly child pornography and grooming.¹² All communication services that transmit messages, files or audio data are affected, especially messengers (WhatsApp, Signal, Telegram), email providers, cloud storage and other internet services.³¹

The goal is to more effectively combat child abuse online. Critics, however, see this as a massive infringement on the right to privacy, data protection and freedom of the press.³⁴ Chat control effectively marks the end of end-to-end encrypted private communication, which was previously considered secure.

How does Client Side Scanning (CSS) work?

Client Side Scanning is the technical basis of Chat control and refers to scanning messages directly on the user’s end device before encryption.⁵²⁶ Unlike traditional surveillance, which only dampens unencrypted data traffic, CSS allows the searching of actually private, encrypted messages.

During this process, messages or media files are compared with a database of known illegal content. If the software finds a match, a message is sent to security authorities or service providers.⁷⁸

The problem: Users have no control and often no indication of which content is being scanned. The end device becomes a surveillance platform, which poses significant risks for security vulnerabilities and abuse.

Which services are affected by Chat control?

The EU regulation targets a wide range of services of all sizes:

• Large messengers such as WhatsApp, Signal, Telegram, Threema and Facebook Messenger are primary targets. These services are monitored, even if they use end-to-end encryption.¹⁹³
• Email providers and cloud services must also implement scanning technologies.¹⁰²
• Smaller messengers and self-hosted services are also affected, especially if they are used by users in the EU or are distributed through EU app stores.³²
• Companies, hosting providers and app stores can also be subject to regulatory requirements for implementing these scans.²

The size of the provider can influence the scope and priority of the control measures, but there is no general exemption for smaller or decentralized services.

Legal Limits and Obligations of Providers

An important point is: Providers whose services or apps are used or distributed in Europe are obliged to comply with Chat control – regardless of their location or headquarters.¹¹¹ This means:

• Foreign providers must equip their apps for the European market with CSS if they are available in European app stores.¹²¹¹
• A complete bypass through foreign services or servers is therefore legally almost impossible.
• Violations of the guidelines can lead to fines, market bans or other sanctions.

This regulation ensures that there are practically no “loopholes” for Chat control as long as users or services are active in the EU.

What risks and consequences does Chat control bring?

The planned Chat control brings the following risks along with the loss of privacy:

• Undermining encryption security: Client Side Scanning weakens the principle of end-to-end encryption and opens up attack surfaces for security vulnerabilities.⁵⁸
• Massive legal uncertainty: Users, providers and developers often do not know exactly which data is being scanned or whether false alarms could lead to unjustified investigations.³⁴
• Restriction of freedom of speech and freedom of the press: Journalists, activists and whistleblowers could also be affected by the surveillance.³
• Data protection violations: There is a risk of data loss, misuse of personal information and surveillance beyond the originally defined purpose.³

How can one protect oneself? Open Source and Self-hosting as an Opportunity

For technically skilled users and organizations, self-hosted communication servers such as Matrix or XMPP offer significantly better control over privacy and security.^13141516

Advantages of own Matrix or XMPP servers:

• Full control over infrastructure, data flow and source code.
• Use of real end-to-end encryption (OMEMO, Megolm) to prevent surveillance.
• Hard-to-overcome surveillance through Client Side Scanning, as users control their own clients.
• Federated structure allows communication even outside of large providers.

Limitations and legal aspects:

• Even self-hosted servers operated in the EU or used by EU users can theoretically be affected by legislation.¹²
• Operators could be required to implement cooperative scanning mechanisms once certain user numbers or public accessibility are reached.
• Absolute security against chat control is therefore not possible, political and legal resistance remains central.

Conclusion

The EU’s chat control is a serious threat to digital privacy and the right to confidential communication. The planned mandatory Client Side Scanning mechanisms undermine security through encryption and endanger fundamental rights.

Technically savvy users and organizations can gain more protection by using Open Source, self-hosted Matrix or XMPP servers – nevertheless, a complete bypass of legal obligations and controls is hardly possible once services are offered on the EU market.

Ultimately, it remains a societal task to shape digitalization in a way that ensures security and fundamental rights remain intact.

Maybe something else as a final note

or better said: The famous „I have nothing to hide“

There you are, in the cozy living room corner, confidently claiming you have nothing to hide. Interesting how at the same time the curtains are drawn, you carefully filter your data online, and you want to make sure no single message gets into the wrong hands. But of course, if the state wants to listen in, that’s no longer a problem. Whoever has nothing to hide would surely enjoy the state’s 24/7 remote control over private life. The protection of children as a free pass

„It’s only about protecting the children“ – an argument that immediately opens hearts and makes further discussion difficult. Because who could possibly be against wanting to protect children? Only that the means many parents and privacy advocates find suspicious: instead of effective prevention, widespread surveillance is preferred without clear limits or controls. Democracy and freedom are sacrificed for the „child protection“, because that sounds so beautifully simple. Those against chat control have something to hide

Of course, the world is divided into two camps: good citizens who are willing to be monitored without hesitation, and the bad suspects with dirty secrets. That privacy is a fundamental right and not a privilege is often overlooked. Even people who live completely legally and openly should have the right to not be scanned around the clock. Authorities need tools – and do we trust them?

Of course, investigators need possibilities to fight crime. But is an all-encompassing backdoor into all chats and emails the solution? If not even the own IT infrastructure is secure and up-to-date, how can the state then protect sensitive data? A digital universal tool that monitors citizens around the clock is more of a security risk with „easy“ access than an effective means against crime.

How do our parties stand on this issue

Of course, our parties also have an influence on whether chat control comes into being or not. During the last vote, there was fortunately massive protest from the people, and through the influence Germany has, chat control was prevented there.

Here is an overview of which party thinks about the introduction of such mass surveillance:

Positions of German parties on chat control (2025)

SPD

• Oppose bypassing or breaking encryption.
• Strongly oppose untargeted data storage and control of digital communication.
• Emphasize the protection of encryption and privacy as a fundamental right.

Greens

• Oppose untargeted mass surveillance, including data retention, chat control, and biometric data collection.
• Advocate for the protection of privacy and against surveillance measures.

Die Linke

• Call for a ban on biometric video surveillance and chat control.
• Strongly advocate for privacy and citizens’ rights.

FDP

• Oppose internet blocking, chat control, upload filters, and data retention.
• Support privacy and oppose untargeted data collection.

Bündnis Sahra Wagenknecht (BSW)

• Critical of surveillance measures like chat control.
• Call for a stop to comprehensive surveillance and a ban on the collection of individual behavior data.

CDU/CSU

• No clear, published statements on chat control in current programs or statements (as of early 2025).
• Positions and demands remain unclear, which is criticized by civil society and media.

AfD

• Critical of chat control and mass surveillance.
• See the measures as an disproportionate infringement on fundamental rights.
• Call for opposing the regulation on chat control in the EU Council.

Federal Government (Ampel coalition until early 2025)

• Previously opposed stance on chat control.
• Advocate for the preservation of end-to-end encryption.
• Prevented so far a qualified majority in the EU Council for the introduction of chat control.

Sources:

• Bundestagswahl: Wie die Parteien zur Chatkontrolle stehen. Netzpolitik.org, 19.02.2025 [web:21]
• CCC fordert von Dobrindt klare Kante gegen Chatkontrolle. CCC.de, 15.06.2025 [web:22]
• Offener Brief - Chatkontrolle STOPPEN! chat-kontrolle.eu, 16.06.2025 [web:23]
• Digitalminister Wildberger muss sich gegen EU-Vorschlag zur Chatkontrolle stellen. afdbundestag.de, 07.08.2025 [web:24]

Sources