What Is EU Chat Control?
Chat Control is the nickname for two different EU laws about scanning private messages for child sexual abuse material: a temporary regulation already in force that allows voluntary scanning (Chat Control 1.0), and a larger proposed regulation that could make scanning mandatory and is still being negotiated (Chat Control 2.0).
Current status
Last verified: 2026-09-30- Chat Control 1.0 (Regulation (EU) 2026/1881): in force since 31 July 2026 — voluntary scanning, expires 3 April 2028.
- Chat Control 2.0 (CSAR): not adopted — sixth trilogue held 29 September 2026; Coreper, LIBE and a full Parliament vote still to come.
The two laws, side by side
Chat Control 1.0 — Regulation (EU) 2026/1881
Published 28 July 2026 and in force since 31 July 2026, this regulation permits providers of messaging and mail services to scan for known child sexual abuse material on a voluntary basis. It expires on 3 April 2028. It replaced the 2021 interim derogation, whose extension the European Parliament rejected on 26 March 2026 and which lapsed on 3 April 2026.
Chat Control 2.0 — the Child Sexual Abuse Regulation (CSAR)
The CSAR is the proposed permanent framework. It is not adopted. The sixth trilogue was held on 29 September 2026 under the Irish presidency; the presidency pushed a 'search plans' approach and the Council's own lawyers warned it could be struck down in court. Age verification was agreed out of the detection debate. After a provisional deal it would still need Coreper, the LIBE committee and a full Parliament vote.
Who does it apply to?
Both laws target providers of interpersonal communications services — messaging apps, email services and similar platforms operating in the EU — not individual citizens directly. In practice, whatever providers are required or allowed to do shapes what happens to your messages.
What it means for encrypted apps
Chat Control 1.0 does not require breaking end-to-end encryption: scanning under it is voluntary. Whether Chat Control 2.0 would compel detection inside encrypted services is, as of 30 September 2026, not decided — it is the central unresolved point of the trilogues.