EU Chat Control Explained: What It Scans, Where It Stands, and What You Can Actually Do

"Chat Control" has been declared dead and revived so many times since 2022 that most people stopped following it. The catch: two different laws now share the name, and one of them is already in force.

Here is what is scanned today, what might be scanned later, and which of your tools actually matter. We sell eSIMs, so we will also be clear about what an eSIM does not do. This is an explainer, not legal advice.

Two laws, one nickname

When people say Chat Control, they usually mean one of these:

• Chat Control 1.0, the interim regulation. Regulation (EU) 2021/1232 is a temporary exception to the ePrivacy Directive. It lets messaging and email providers voluntarily scan private communications for child sexual abuse material. Nobody is forced to scan.
• Chat Control 2.0, the CSA Regulation. Proposed by the European Commission on 11 May 2022, it would create a permanent framework: risk assessments, a new EU Centre, and, in the original draft, detection orders forcing providers to search messages for known material, new material and grooming.

The key phrase is client-side scanning. With end-to-end encryption the provider cannot read your messages, so the only place left to look is your device, before encryption. That is why critics, including Signal, argue that mandatory scanning of encrypted chats would break encryption in practice.

The timeline, with dates

• 11 May 2022: the Commission publishes the CSA Regulation proposal, including detection orders.
• November 2023: Parliament's civil liberties committee adopts its position on 14 November (51 to 2), confirmed as Parliament's mandate on 22 November: targeted detection approved by a judge, and no weakening of end-to-end encryption.
• 2024 to 2025: Council presidencies fail to find a qualified majority. Germany, the Netherlands and Austria are among the opponents.
• Autumn 2025: the Danish presidency pushes mandatory detection that would also reach encrypted services. Signal's president Meredith Whittaker says Signal would leave the market rather than build in a surveillance machine. Germany refuses support on 8 October, and on 30 October Denmark drops mandatory detection orders.
• 26 November 2025: the Council agrees its position: no mandatory detection orders, voluntary scanning made permanent, and, according to CDT Europe, new age verification obligations.
• 26 March 2026: with trilogues under way since 9 December, Parliament rejects extending the interim regulation (228 for, 311 against). It lapses after 3 April; Google, Meta, Microsoft and Snap say they will keep scanning anyway.
• July 2026: the interim regime returns. A 9 July attempt in Parliament to reject it falls short of the absolute majority needed, the Council approves it on 23 July, and Regulation (EU) 2026/1881 is published on 28 July. It runs until 3 April 2028 and excludes end-to-end encrypted communications.
• 29 September 2026: the sixth trilogue ends without a deal on private communications.

→ For what your mobile operator already sees without any new law, read What your carrier knows about you

Where it stands in October 2026

According to a 30 September summary by former Pirate Party MEP Patrick Breyer, negotiators provisionally agreed the EU Centre's tasks and the rules for public content: hosting platforms can be ordered to search public uploads for known abuse material.

Private communications are the part that is still open. Breyer reports that the Council side wants permanent voluntary scanning of private chats and orders that can reach non-public content, while Parliament wants scanning limited to people linked to abuse, with court approval. Technical talks continue through October; Breyer expects the next trilogue in November. We found no official date.

Breyer opposes the proposal and many Council documents are not public, so read any single account with care. A law firm analysis from 20 October 2026 gives the same picture: movement towards protecting encryption and scaling back age verification, with mandatory versus voluntary, targeted versus general detection still unresolved. Any deal still needs formal votes in Parliament and Council.

What is actually being scanned, and what might be

• Today, under the interim law: providers may voluntarily scan messages and email that are not end-to-end encrypted, typically by matching images against known material.
• Likely in the final law: detection on public content, such as uploads to hosting platforms, plus risk assessments and removal and blocking orders.
• Still undecided: whether voluntary scanning of private chats becomes permanent, whether orders can reach private messages, who can issue them, and whether encrypted services stay fully out of scope.
• Age verification: the Council's position includes age checks for communication services and app stores, while Parliament's mandate rejects mandatory age verification for messaging. This matters as much as scanning: an ID check to open a messenger account ties your identity to it permanently.

Whether end-to-end encrypted services stay fully outside any mandatory scanning is exactly what the November round has to settle.

What each layer of your setup actually does

Scanning, if it happens, happens inside the messaging service or on your device. Most privacy tools work on other layers.

• Phone number and identity. A no-KYC eSIM gives you a number and data that are not tied to your passport. Your messenger account is not linked to your name through the carrier. It does not touch message content at all.
• Network. Your carrier sees metadata such as which servers you connect to and when. A VPN hides that traffic from the carrier and the local network. It does not change what your messaging app does on your phone or what the provider does on its servers.
• Messenger. This is the layer Chat Control is about. Signal and WhatsApp encrypt chats end to end by default. Telegram's regular cloud chats are not end-to-end encrypted, only its secret chats are, so they sit on the scannable side of the interim law.
• Device. Client-side scanning would run on the phone itself, inside the app. Open-source apps and an open-source OS do not make you immune, but they make such a change visible to anyone reading the code.

→ For using a number that is not tied to you on messengers, read Anonymous numbers for Telegram and Signal

Practical steps that do not depend on Brussels

• Default to end-to-end encryption. Use messengers that encrypt every chat by default. Treat unencrypted cloud chats as readable by the provider.
• Check your backups. An encrypted chat backed up unencrypted to the cloud is no longer private. Enable encrypted backups or switch them off.
• Separate the number from your identity. Register with a number not linked to your passport, set a registration PIN, and hide your number where the app allows, such as Signal usernames.
• Keep metadata thin. Disappearing messages, fewer large groups and no contact syncing reduce what exists to be scanned, leaked or requested.
• Follow primary sources. Parliament's Legislative Observatory tracks procedure 2022/0155(COD); the Council press room, EDRi and messenger developers' blogs beat social media.

For the full toolkit beyond messaging, see the digital nomad privacy stack, and for what an eSIM itself can and cannot reveal, our eSIM privacy concerns guide.

• Chat Control is a fight about what happens inside your messenger and on your phone. A private number keeps your name off the account. It does not keep anyone out of the conversation. Know which tool is doing which job.

Where Cypher eSIM stands

We sell eSIMs without KYC, paid in crypto, with optional real phone numbers. That solves one problem well: your identity is not attached to the line or the accounts you register with it. It does not encrypt messages or stop an app from scanning, and no eSIM can. For message content, your messenger and device matter far more than your SIM.

Use a private number for identity, an end-to-end encrypted messenger for content, and Cypher VPN or any VPN you trust for the network.

FAQ

Is Chat Control law now?

Partly. The temporary voluntary scanning rules are back in force as Regulation (EU) 2026/1881 until 3 April 2028, excluding end-to-end encrypted communications. The permanent CSA Regulation is still in negotiation as of 22 October 2026.

Will my Signal or WhatsApp messages be scanned?

Not under the interim law, which excludes end-to-end encrypted communications. Whether the final regulation allows orders that reach encrypted chats is one of the open questions. Signal said in October 2025 it would leave the EU market rather than build scanning in.

Does a VPN or a non-EU eSIM get me out of Chat Control?

No. The rules target services offered in the EU, and scanning happens in the app or on the provider's side, not on the network. A VPN and a no-KYC eSIM protect your traffic and your identity.

Chat Control is neither dead nor law in its feared form. Pick tools for the layer they actually protect, and check back after the November round.