Chat Control: what is already law, and what is still being discussed
An existing regulation, a permanent proposal and negotiating documents have different legal meanings. Here is how to tell them apart.
Updated on 22 October 2026
When Chat Control comes up, one question quickly follows: will someone be able to read our private conversations?
The answer depends on which text is being discussed. Chat Control is an informal name used in the debate about European measures against online child sexual abuse. It covers both temporary legislation already in force and a proposal for a permanent regulation, following a separate legislative process.
As of 22 October 2026, the official sources we consulted do not establish that the permanent regulation has been definitively adopted. There are negotiating documents and meetings, but presenting them as the adoption of a law would be inaccurate. The European Parliament's file for procedure 2022/0155(COD) still lists the procedure as awaiting Parliament's position at first reading.
The temporary regulation is already in force
Regulation (EU) 2026/1881, dated 24 July 2026, was published on 28 July and entered into force on 31 July. It applies until 3 April 2028.
It allows providers of certain messaging and communications services to carry out voluntary activities to detect and report online child sexual abuse and remove the associated material. It introduces a limited derogation from some rules on the confidentiality of electronic communications, subject to conditions. The GDPR continues to apply. Here, “voluntary” describes the provider's choice to carry out those activities.
End-to-end encrypted communications are excluded from this regulation. Article 1(3) refers to communications to which encryption is, has been or will be applied. Article 3 reiterates that limit. The text also excludes the scanning of audio communications. Regulation (EU) 2026/1881, Articles 1, 3 and 11.
These provisions do not introduce a general obligation to monitor every chat. However, the exclusion concerns this specific regulation: it is not an exemption from every other law and does not determine the content of future permanent rules.
Where the permanent regulation stands
The permanent proposal is identified by procedure number 2022/0155(COD). The versions developed throughout that process are not interchangeable.
In Council document ST 15318/25, dated 13 November 2025, the text prepared for the negotiating mandate removed provisions on detection obligations and included voluntary activities among possible risk mitigation measures. It was a text prepared for negotiation. Council document, Section II, points b and c.
The subsequent discussion is also documented in a Presidency note dated 24 July 2026, WK 10939/26. It distinguishes public and non-public content and discusses possible detection orders and searches carried out on providers' own initiative. Among the points raised by Parliament, it reports protection for end-to-end encryption, rejection of generalised scanning of non-public content, and a demand for targeted measures subject to judicial authorisation. These are positions and options described in a working paper, not definitively adopted provisions. Presidency note, pages 1–3 of the annex.
Understanding what might change therefore requires the date, version and status of the document. The initial 2022 proposal, a 2025 position and a 2026 working paper describe different stages of the same procedure.
What we know after 20 October
Two meetings on the permanent regulation had been scheduled in Brussels for 20 October.
Notice CM 4513/26 scheduled a technical discussion at 10:00 on a possible detection package, referring to document WK 15701/26. Notice CM 4514/26 scheduled a meeting at 14:30 on the state of interinstitutional negotiations and the next steps, referring to WK 15702/26. Notice of the technical meeting, notice of the negotiating meeting.
In the Council register consulted on 22 October, WK 15701/26 and WK 15702/26 are listed, but their contents are not accessible. In the public sources we checked, we did not find an account that would allow us to verify the outcomes of those meetings. Council register, file 2022/0155(COD).
The notices establish what was planned. On their own, they do not prove that the meetings took place, what decisions were made, or that a final text was approved. The title of an inaccessible document does not allow us to reconstruct its contents.
Why on-device scanning is part of the debate
The term client-side scanning appears in the technical debate: analysing content on a device, where it may be readable before encryption or after decryption.
Imagine a message checked on a phone before it is encrypted and sent. The subsequent transfer may be protected by cryptography, while that check has already analysed the content. To assess confidentiality across the entire process, we also need to understand what information the check can communicate outside the device.
The study Bugs in our Pockets, by Hal Abelson and other researchers, examines security risks, potential abuse and ways to evade on-device scanning systems. It is an analysis of technologies and their risks; it does not demonstrate that a specific solution is required by the European legislation currently in force. Study on client-side scanning.
Faced with a concrete proposal, the questions become specific: what content is analysed? Does the check cover everyone or identified users? What leaves the device? Who can change the detection criteria? How are errors corrected, and how can a report be challenged?
What to look for in the next update
Protecting children requires effective measures. Assessing those measures means understanding both the intended results and how the proposed checks work.
When a news story announces a new development on Chat Control, three pieces of information help explain its significance:
- The text being cited. Is it the temporary regulation or the permanent proposal? Are a number and a version provided?
- The decision made. Is it a meeting notice, a negotiating position, a provisional agreement or a definitively adopted act?
- The effects on communications. Which services and content are covered? What exclusions, authorisations and avenues for redress are provided?
That information clarifies what a service may or must do with our conversations. The word “approved” alone, without identifying the document and the stage it refers to, leaves the most important question unanswered.
For more on the technology, read what end-to-end encryption protects and what limits remain.