Live

Between protection and privacy

At the forefront of Europe, there is a polarized legislative process for the future of the digital age, with the draft bill under consideration being “Chat Control.” Essentially, this is the EU Regulation on Combating Child Sexual Abuse (CSA Regulation), the rationale being based on the ambition to enable authorities to detect and prevent the distribution of child abuse material by scanning private messages. Despite the undoubtedly good core of the purpose—as stated—the legislation has become a battleground between the protection of children and the protection of privacy. Discussions in the EU Council have repeatedly broken down, while Denmark, which currently holds the Council presidency, recently reintroduced the proposal for “mandatory scanning” even in end-to-end encrypted applications such as Signal, WhatsApp, Telegram, and other apps where only the sender and recipient can read the content of messages; not even the company providing the service has the technical ability to access it. On the other hand, Germany, Poland, and Austria are reacting strongly, comparing the measure to “opening all letters to see if they contain anything illegal.”

The stance of smaller and larger companies is in line with that of data protection organizations, warning that removing encryption will make everyone vulnerable to attacks and eavesdropping. On the other hand, law enforcement agencies and child protection organizations are pushing for strict measures, insisting that without access to messages, “the police are fighting blindfolded.” The pressure on European governments has been systematic, culminating in the fall of 2025, when thousands of citizens sent emails to MEPs with messages of protest, The European Digital Rights (EDRi) “Stop Scanning Me” campaign claimed that Chat Control would turn the EU into a field of “mass surveillance without suspicion of crime.” while noting that the law would allow the installation of software that “scans the personal messages, photos, and files of all citizens,” undermining the fundamental principle of the presumption of innocence and the right to anonymity.

 

Member states appeared divided, with nine governments—including Germany, the Netherlands, Luxembourg, and Slovenia—opposing the proposal and twelve supporting it, including Denmark, France, and Spain, while six remain undecided, including Greece, which is “technically evaluating the proposal.”

As of 7th of October 2025, eventually,  the EU Council has postponed the vote on the proposed Child Sexual Abuse Regulation (Chat Control), following strong opposition from several member states, publicly rejected the idea of mandatory chat scanning, calling it incompatible with encryption and the right to private communication. The delay came after the Danish presidency’s push for client-side scanning failed to gather a qualified majority. Yet, the proposal remains alive, with EU interior ministers expected to revisit it during their December 6–7 meeting, as negotiations continue behind closed doors. Digital rights advocates and organizations like the Internet Society and Signal Foundation warn that the pause should not be mistaken for a victory, as the legislation could return in modified form under new language claiming to “protect privacy” while effectively undermining it.

The principal of confidentiality 

Digital encryption is the cornerstone of private communication. The new European Chat Control Regulation attempts to close this privacy loophole by allowing authorities to scan messages, photos, and files before they are even sent. The proposed technology, known as client-side scanning, does not read data on the server, but directly on the user’s device. In practice, every phone becomes a potential surveillance tool, as “detection” precedes encryption.

European Digital Rights (EDRi) warns that the proposal constitutes “mass surveillance without suspicion of crime,” while the artificial intelligence systems that will detect suspicious content are based on imperfect algorithmic models, with a high rate of false positives. In the same vein, the European Center for Press and Media Freedom (ECPMF) describes the regulation as “an existential threat to press freedom.” As it points out, mandatory scanning could expose journalistic sources and undermine the fundamental principle of confidential communication between journalists and informants. More than 470 researchers from 34 countries warn that the adoption of the regulation will create “unprecedented possibilities for surveillance, control, and censorship,” emphasizing the possibility that tomorrow’s infrastructure could be used for political repression or espionage.

The proposal is based on Article 114 of the Treaty on the Functioning of the EU, which concerns the internal market and not the restrictive regulation of fundamental rights. This makes the legal basis questionable, as the case law of the Court of Justice of the EU (Digital Rights Ireland, Tele2 Sverige, La Quadrature du Net) has repeatedly ruled that generalized surveillance violates Articles 7, 8, and 11 of the Charter of Fundamental Rights: the right to privacy, the protection of personal data, and freedom of expression. As EDRi notes, even the UN and the European Court of Human Rights have pointed out that weakening encryption is a serious violation of the right to privacy. The difference between protection and surveillance, it seems, lies in a line of code.

Famous last words

In the acceptance of the logic of Chat Control, the democratic contract is dismantled and citizens are placed under preventive surveillance. State control is established within the gaze itself; everyone becomes a potential spectator and suspect. Despite its stated good intentions, Chat Control can easily slip into a digital version of the Panopticon. Europe seems to be building a space where the “right to whisper” is replaced by the obligation to speak under surveillance.

Both Tor and VPNs have become synonymous with free—even overly free—internet browsing, and states, reacting with restrictions and prohibitions, will drive more and more citizens even deeper into the internet at the first visible level of communication. Private space is a prerequisite for freedom; people form their opinions before entering the public sphere. Citizens cannot be treated as data nodes for the sake of a peculiar form of security, reminiscent of other such crusades such as the war on terror. It is ironic that the continent that gave birth to habeas corpus is discussing the surrender of privacy and reversing the rule of innocence until proven guilty. In the end, privacy is nothing more than a side issue; the question is how the view that freedom does not need surveillance to exist is faltering, or, in other words, freedom ceases to be freedom when it needs proof that it is not dangerous.

Do you believe that the EU should allow the scanning of private messages for the purpose of protecting children?

Written by

Shape the conversation

Do you have anything to add to this story? Any ideas for interviews or angles we should explore? Let us know if you’d like to write a follow-up, a counterpoint, or share a similar story.

Write a counterargument article Write a related article