The European Union has removed the mandatory requirement for chat scanning in its new draft.
European Union efforts to mandate scanning of private messages have again been blocked, marking a significant setback for the bloc’s proposed Chat Control legislation and a victory for digital rights advocates. German digital rights activist and Pirate Party Germany politician Patrick Breyer announced on November 15th via X (formerly Twitter) that a client-side scanning backdoor – requiring scanning of messages on user devices – had been removed from the latest draft of the “Regulation to Prevent and Combat Child Sexual Abuse,” more commonly known as Chat Control. The removal was achieved through a line added during Denmark’s presidency of the Council of the European Union, which initially introduced the backdoor clause: “Nothing in this Regulation should be understood as imposing any detection obligations on providers.”
Previously, the draft utilized vague language referring to “all possible risk mitigation measures,” which critics argued would enable authorities to force service providers to implement chat scanning systems. This concern was amplified by the existing infrastructure for voluntary chat scanning, already in place with services like Gmail, Facebook, Instagram, Skype, Snapchat, iCloud email, and Xbox. The European Commission anticipates a threefold increase in reports generated by a mandatory scanning system. However, Breyer characterized the move as “political deception of the highest order,” noting that Chat Control’s re-emergence is “coming back through the back door – disguised, more dangerous, and more comprehensive.”
The legislative process remains active, with the Committee of the Permanent Representatives of the Governments of the Member States to the European Union (COREPER II) expected to endorse the draft on November 19th without debate, listing it as a “non-discussion” item. Following COREPER II’s approval, the text will proceed to the Council of Ministers meeting, potentially for adoption without discussion unless a minister specifically requests to pull it. While the mandate for mandatory chat scanning has been removed from the proposal, the current draft still contains provisions for anonymity-breaking age checks for communication services and voluntary mass scanning. Critics warn that these remaining elements could render anonymous email and messenger accounts “factually impossible and exclude teens under 17 from many apps.”
The ongoing struggle reflects a long-standing battle for privacy and encryption rights. The origins of this fight can be traced back to the cypherpunk movement of the 1980s, a pro-cryptography movement advocating for the widespread use of technology to enhance privacy. This movement, heavily influenced by figures like Adam Back, stemmed from concerns about government surveillance and the export restrictions on cryptographic technologies. Early cypherpunks, including Back, distributed T-shirts warning that cryptography was “classified as a munition and may not be exported from the United States, or shown to a foreign national,” highlighting the perceived absurdity of the laws restricting these technologies. This historical context underscores the deep roots of the current debate and the enduring commitment to safeguarding fundamental rights in the digital age. The movement’s influence is evident in the development of Bitcoin, which draws heavily from cypherpunk principles, alongside developments in privacy-enhancing technologies. The fight continues as the European Union attempts to shape the future of online communication and digital privacy.
