Chat Control: Thought Police at your fingertips
The European Commission is about to impose on 450 million citizens generalised surveillance of their private conversations. WhatsApp, Signal, Telegram, SMS... all your messaging services, without exception, could be forced to scan your messages before you even send them. Yet Ursula von der Leyen, who presides over the Commission, is “unable” to provide her messages concerning a €35 billion public contract[1]. Three rulings against it by the Court of Justice of the EU for lack of transparency[2]... but no sanctions and no text messages.
A Trojan horse
The text’s official name is the CSAR regulation (Child Sexual Abuse Regulation), more commonly known as “Chat Control 2.0”. After the resounding failure of the 2022 version, deemed too intrusive, a reworked draft was relaunched at the end of 2024. A political agreement was sealed on 28 November 2025 in a trilogue between the Commission, the Council and the European Parliament. The final vote in Parliament, reduced to a mere rubber-stamping of the text negotiated behind closed doors, is expected in mid‑December 2025 or early January 2026. The last step before entry into force: a formal vote in the Council of the EU.
The principle is technically trivial but unacceptable: national authorities will be able to issue binding “detection orders”, forcing messaging services such as WhatsApp, Signal, Telegram or iMessage to analyse content before it is encrypted – what is known as “client-side scanning”. In practice, your phone or computer will scan your messages before you even send them, comparing their digital fingerprint against databases of “illegal” content. The secrecy of private correspondence, guaranteed by the Charter of Fundamental Rights, thus becomes an exception that can be switched on by decision of the Member States’ executives.
As we already mentioned in a previous article[3], this kind of regulation is akin to a Trojan horse: sold as a bulwark against child pornography and online harassment, it in fact conceals a freedom-killing objective. The CSAR is part of a well-honed strategy: brandishing child protection as a moral shield while laying the infrastructure for generalised control of communications, in which any dissenting voice could tomorrow be reclassified as a “threat to social cohesion”.
A major institutional drift
First warning: the power to lift the secrecy of correspondence, traditionally reserved for an independent judge, is largely transferred to the executive. Under the current text, it is national authorities – often administrative ones or attached to interior ministries, and therefore directly under political control – that will be able to issue “detection orders”.
Private platforms thus become compulsory police auxiliaries, under threat of fines of up to 6% of their worldwide turnover, without the initial decision systematically going through a sitting judge.
Recent history speaks for itself: states of emergency extended indefinitely, anti-terrorism laws broadened far beyond their original purpose, political espionage scandals uncovered in Greece (Predator Gate), Spain (Catalangate) and Poland (Pegasus). As soon as the executive obtains surveillance tools, it has an unfortunate tendency to abuse them.
You will no longer communicate in the same way
Awareness of potential surveillance profoundly changes behaviour. Academic research shows that the mere possibility of being monitored leads between 20 and 45% of users to change their online behaviour[4]: self-censorship of opinions, avoidance of certain topics, restriction of sensitive exchanges. Investigative journalists, lawyers, human rights activists or ordinary citizens critical of those in power will hesitate to express themselves freely. The chilling effect is proven, and self-censorship becomes the norm.
Signal and Threema, two of the most secure messaging services, have already reaffirmed that they will leave the European market rather than compromise their encryption. Beyond the loss of digital sovereignty this represents, it is a clear signal: the most serious players in privacy would rather give up 450 million potential users than put a surveillance system in place.
The false-positive trap
National experience under the interim “Chat Control 1.0” regime is telling. In Germany, the federal police acknowledge that nearly 50% of automated reports have no criminal relevance. In Ireland, only 20% of reports actually correspond to exploitation material[5]. Family holiday photos, medical images, works of art, even simple memes shared between friends.
With client-side scanning rolled out across Europe, the volume of intimate photos and messages mistakenly passed on to police forces will explode, turning tens of millions of ordinary citizens into suspects. Every parent who has photographed their child in the bath, every couple who has exchanged intimate photos, becomes a potential case to be checked “manually” by police officers.
The inevitable function creep
The history of emergency laws always follows the same pattern. An infrastructure created for a specific purpose – however noble – invariably ends up serving other ends. There is no shortage of pretexts: hate speech, terrorism, foreign interference, disinformation, threats to national security (a definition that can be stretched at will).
The American Patriot Act, passed in a hurry after 9/11 to fight terrorism, was quickly used to monitor activists and journalists. The 2015 French intelligence law now allows spying far beyond terrorist suspects. Once the technical system is in place, its extension depends only on political will… which very often is not long in coming.
A problem of proportionality
No one disputes the need to protect children. But the Court of Justice of the EU, like the European Court of Human Rights, imposes a simple rule: a measure as serious as the systematic lifting of the secrecy of private correspondence must be strictly proportionate and may only be adopted if there is no other, less intrusive solution capable of achieving the same objective.
And such solutions very much exist:
- Targeted judicial investigations based on concrete suspicion, authorised by an independent judge – which requires giving the justice system the human and financial resources it has been denied for years
- Massive strengthening of specialised units within national police forces: recruitment, ongoing training, modern investigative tools, stronger international cooperation
- Stronger cooperation with platforms on public content (forums, open groups, comments)
- Improved voluntary reporting, with moderator training and detection tools on servers (not client-side)
- Large-scale education and prevention: school programmes, awareness campaigns, support for victims
These methods are already being applied successfully in several Member States. The Netherlands, for example, dismantled several major child-abuse networks in 2023‑2024 thanks to targeted investigations and cooperation with platforms, without generalised scanning. They are recommended by UNICEF, ECPAT and virtually all independent cybersecurity experts. They make it possible to dismantle networks without turning 450 million Europeans into permanent suspects.
Added to this is a paradox that undermines the very effectiveness of the system: real child-abuse networks will migrate to communication channels beyond reach as soon as the system is operational. Mass scanning will therefore monitor only ordinary users, while losing track of the organisations or individuals the system claims to target.
The CSAR therefore openly violates the principle of proportionality enshrined in Article 52 of the Charter of Fundamental Rights: it imposes an extreme measure when effective alternatives exist that are more targeted and less damaging to freedoms. They just seem to have one small flaw: they do not make it possible to monitor you on a mass scale and entirely legally.
The noose tightens
Germany remains the linchpin. The Interior Ministry (SPD) is pushing for adoption, while the Justice Ministry (FDP) and the Greens are resisting. A theoretical blocking minority still exists in the Council (Germany, the Netherlands, Austria, Poland and Slovenia account for around 35% of the EU population, above the required 35% threshold), but the pressure from the Commission and the Danish Presidency is considerable.
On the European Parliament side, several MEPs – notably Patrick Breyer (Pirate, Germany), Sophie in ’t Veld (Renew, Netherlands) and the Greens/EFA groups – have announced that they will try to amend or reject the text in the final vote. But the room for manoeuvre is narrow: since the text was negotiated behind closed doors between the Commission, the Council and Parliament, Parliament can no longer substantially amend it, only accept or reject it as a whole. And who will dare oppose a text that claims to protect children? Probably not a majority…
While you are reading this
The European Union is about to cross a historic red line: making the secrecy of private correspondence an exception rather than the rule. On the pretext of protecting children – an objective no one disputes –, the entire European ecosystem of digital trust is at risk of collapsing.
The real issue is not technical, it is political: who is watching whom? A healthy democracy rests on citizens’ ability to hold their leaders to account, not the other way round. The CSAR reverses this fundamental logic. Curiously, the bodies that claim to defend “democratic values” do not seem very keen on institutional transparency and respect for privacy.
The timetable is tightening dangerously. The political agreement of 28 November 2025 must still be approved by a formal vote in the Council of the EU, then by the European Parliament (scheduled for mid‑December 2025 or early January 2026). Between these two votes, there remains a window of a few weeks for a blocking minority to re-form in the Council or for a coalition of MEPs to reject the text. We can still act:
- Contact your national MEPs before the final vote (mid‑December or early January)
- Support the organisations that are fighting: EDRi (European Digital Rights)[6], La Quadrature du Net[7], Chaos Computer Club[8], noyb[9]
- Spread the word: most people are unaware of the real dangers
After that, everything will be read. Your messages to your spouse. Your exchanges with your lawyer. Your intimate photos. Your conversations. Your criticisms. Your doubts, your fears, your secrets.
Your privacy will be gone. Thinking and communicating without feeling watched will be nothing but a memory.
Marcan for BAM!
[1] BAM! News - Ursula, gravedigger of Europe?
[2] 17 July 2024: Judgment T‑44/21 - Refusal of access to the COVID‑19 vaccine contracts concluded with pharmaceutical companies
17 July 2024: Judgment T‑158/21 - Refusal of access to documents relating to potential conflicts of interest in the management of the pandemic
14 May 2025: Refusal to disclose the exchanges between Ursula von der Leyen and the CEO of Pfizer concerning the €35 billion contract
[3] Censorship: France on the podium
[4] The Chilling Effects of Digital Dataveillance: A Theoretical Model and an Empirical Research Agenda - Moritz Büchi, Noemi Festic, Michael Latzer, 2022
[5] Chat Control : l’Allemagne fait basculer l’opposition européenne - Frédéric Boisdron - Conseil en robotique
