The fightchatcontrol.eu campaign argues that CSAR's detection orders would force a trusted scanning component onto user devices before encryption, fundamentally breaking the threat model E2EE exists to defend against. The site frames Chat Control 2.0 as a permanent surveillance infrastructure that would apply to Signal, WhatsApp, iMessage, Matrix, and Threema alike.
Signal's president has publicly committed to withdrawing from the EU market rather than ship a client-side scanner, and Threema has taken the same position. Their argument is that compromising the cryptographic guarantees of the product for one jurisdiction destroys the guarantee everywhere, so exit is the only coherent response.
Open letters signed by hundreds of cryptographers, along with Proton, Tutanota, and the Signal Foundation, argue there is no known way to implement content detection on encrypted channels without creating a backdoor that will be abused or fail on its own terms. Their position is that the regulation demands a technical capability that does not exist and cannot be built safely.
The editorial argues that Chat Control 1.0 (voluntary scanning of already-unencrypted services like Gmail and Messenger) is being confused with Chat Control 2.0 (mandatory detection orders that reach into E2EE apps via client-side scanning). Treating them as one debate lets proponents point to years of uncontroversial voluntary use to justify a categorically different mandatory regime.
A campaign site — fightchatcontrol.eu — is currently the top-voted story on Hacker News with 634 points, and it exists because the EU's Child Sexual Abuse Regulation (CSAR), better known as Chat Control 2.0, is grinding back through the Council of the EU after being repeatedly stalled since 2022. The Danish presidency has floated a revised text this summer; a qualified-majority vote could land before the current term wraps up.
There are two proposals in play, and practitioners keep confusing them. Chat Control 1.0 is the temporary derogation adopted in 2021 that permits providers to *voluntarily* scan unencrypted communications on services like Gmail and Facebook Messenger for CSAM and grooming. It has been extended twice and is set to lapse again in 2027. Chat Control 2.0 is the proposed permanent regulation that would go much further: it introduces detection orders that national authorities could impose on any "number-independent interpersonal communications service" — Signal, WhatsApp, iMessage, Matrix, Threema, your indie chat app — requiring them to scan message content, including in end-to-end encrypted conversations, before it leaves the device.
The mechanism is client-side scanning: a classifier runs on the user's phone, hashes or evaluates every image, video, and (in earlier drafts) text message, and reports matches to a new EU Centre in The Hague. Signal's president Meredith Whittaker has said publicly the app will leave the EU market before complying. Threema has said the same. The Signal Foundation, Tutanota, Proton, and 500+ cryptographers including Bruce Schneier and Matthew Green have signed open letters calling the scheme technically incoherent.
The engineering objection is not ideological. Client-side scanning breaks the threat model that end-to-end encryption exists to defend against. If the classifier runs before encryption, then by definition there is a trusted component on the endpoint that sees plaintext and reports to a third party. That component is now the highest-value target on the device — a single, government-blessed backdoor with a legally guaranteed install base of ~450 million EU users. Every offensive-security team on Earth will be looking at it. Apple learned this lesson in 2021 when it proposed on-device CSAM hashing for iCloud Photos and shelved the plan within months after researchers demonstrated hash collisions and adversarial preimage attacks on NeuralHash within days of the code being reverse-engineered.
The false-positive math is what most policymakers keep getting wrong. Even a classifier with 99.9% accuracy applied to the ~100 billion messages the average EU day generates would produce roughly 100 million false flags. The proposal routes these to an EU Centre that then forwards "reasonable suspicions" to Europol and national police. There is no serious plan for staffing this pipeline, and no serious plan for the harm inflicted on the flagged. Every previous rollout of image-hash scanning at scale — Microsoft PhotoDNA, Google's classifier, Meta's — has produced a well-documented tail of medical photos of one's own children, teenage sexting between consenting minors, and art history assignments getting parents interrogated and cloud accounts nuked.
There is also the question of scope creep, and here the regulation's own text is the strongest argument against it. Article 10 defines the detection categories broadly enough that once the infrastructure exists, extending it to "terrorist content," then "foreign influence operations," then "copyright violations" is a matter of amending one annex. The German BSI, the Dutch intelligence oversight body, and the European Data Protection Supervisor have all filed formal opinions saying the proposal is incompatible with the Charter of Fundamental Rights. The European Parliament's own legal service reached the same conclusion in a leaked 2023 opinion.
And yet the regulation keeps coming back. Every six months a rotating Council presidency floats a slightly reworded version — sometimes carving out audio, sometimes carving out text, sometimes making detection orders "targeted" rather than blanket — and each time civil society has to mobilize again. The pattern is worth naming: this is regulatory attrition, and the attackers only need to win once.
If you ship a messenger, or any product with a DM feature, or a federated protocol implementation, or an SDK that vendors chat to other apps, you have concrete work to do now — not after the regulation passes.
Audit your legal exposure. The regulation applies to any service "offered in the Union," which under the Digital Services Act precedent means IP-based, not incorporation-based. A US or UK startup with EU users is in scope. Read Article 2's definition of "interpersonal communications service" carefully; it is deliberately broad and covers games with chat, dating apps, forum DMs, and anything with private text between two identified users.
Plan for the compliance branch. If Chat Control 2.0 passes in anything like its current form, you will need either (a) a client-side classifier component you can plug in, (b) a documented decision to withdraw from the EU market, or (c) a legal challenge strategy. Signal and Threema have chosen (b) publicly. Meta, Google, and Apple will almost certainly build (a) — they already have the classifier infrastructure from voluntary scanning. Small and mid-sized providers face the hardest choice, because building a compliant on-device classifier that satisfies a regulator you have no relationship with is not a weekend project.
Reconsider what "E2EE" means in your marketing. If your app's security page says "we can't read your messages," and CSAR passes, that claim becomes false in the EU the moment the detection order lands, regardless of whether your server ever sees plaintext. Users deserve to know the distinction between server-side E2EE (which CSAR breaks by mandate) and true device-local processing (which the regulation targets specifically because it's the last remaining private channel).
The near-term calendar matters. The Council needs a qualified majority — 55% of member states representing 65% of the population. Germany, currently a swing vote, has flipped positions three times in two years; the new coalition's stance is not yet public. If the Council reaches agreement, trilogues with the Parliament follow, and the Parliament's LIBE committee has been consistently more skeptical than the Council. The realistic 2026 outcomes span from "regulation dies quietly for the fourth time" to "passes with a client-side scanning mandate and a two-year implementation window." Either way, the engineering community's job is the same: keep publishing the technical critique, keep the false-positive math in front of policymakers, and — if you build private communications infrastructure — decide now whether you'd rather architect for compliance or for exit. The regulation itself will not decide that for you.
> Is scanning mandatory? - No — voluntary.Voluntary for whom? The service provider? Can I opt out of getting scanned?> Does it touch encrypted messages? - No. End-to-end encrypted communications were never scanned but providers could deploy client-side scanning under this law.So it circumvents
I don't understand. How does it affect encrypted messages? It seems like either you need:1. allow MITM decryption by a privileged authority2. require all devices doing E2EE have a non-user-modifiable piece of functionality to scan on-deviceThe second is the Apple style on-device CSAM scanner? I
If so-called "tech" companies are allowed to have control over internet users' communications ("chat control"), where control over communications lies _exclusively with the company, not the user_,^1 then it stands to reason that governments, among others, may influence how t
https://en.wikipedia.org/wiki/Think_of_the_children
Top 10 dev stories every morning at 8am UTC. AI-curated. Retro terminal HTML email.
Most everyone would love to see more work on stopping child sexual abuse.But this is the ultimate "grant me dictatorial powers so I can do good" play.Rather than narrow and specific - it's a broad based law that suddenly touches everyone even though offenders are a small percentage an