What is in force, what is being negotiated, and what it means for the apps you use. We check it every day and update it within 24 hours of every development.
Voluntary scanning of private messages is legal in the EU today. Chat Control 1.0 allows it until 3 April 2028. The permanent law is still being negotiated; the next political trilogue is planned for 29 September 2026.
Last checkedWhat changed since the last check: a date, not an event. Council minutes published by netzpolitik.org on 2 July put the next political trilogue on 29 September 2026; we had missed that report. The most recent event on this page is still 24 July 2026, and Chat Control 1.0 has been in force the whole time.
Chat Control 1.0
Providers of mail and messaging services may scan private communications for child sexual abuse material without individual suspicion. May, not must. End-to-end encryption is outside its scope.
Chat Control 2.0
The permanent law is stuck on one question: may detection target everyone, or only people named by a judge? Five negotiating rounds have not settled it. The next political trilogue is planned for 29 September 2026 under the Irish presidency, according to Council minutes published by netzpolitik.org.
Get an email when the status changes. One message per development, unsubscribe anytime.
Timeline
Newest first. Every date checked against the source linked under it.
- 2026
- 24 Jul 2026Regulation
Regulation (EU) 2026/1881 is signed; in force from 31 July. Voluntary scanning is legal again, until 3 April 2028.Source: Official Journal, EUR-Lex - 9 Jul 2026Parliament
Second reading. The motion to reject gathers 314 votes, 276 against, 17 abstentions, short of the absolute majority of all MEPs that a second reading requires. Parliament adopts amendments excluding end-to-end encrypted communications from the law; the Council accepts them on 23 July.Sources: European Parliament, Council - 30 Jun 2026Council
Council counsellors are told the next political trilogue is “scheduled for 29 September”. The internal minutes, published by netzpolitik.org on 2 July, also show the presidency floating a mix of voluntary and mandatory detection, split by public and non-public content.Source: netzpolitik.org, 2 July 2026 - 29 Jun 2026Trilogue
The negotiating round on the permanent regulation ends without agreement on detection. Parliament’s team reports compromises “on almost the entire Regulation”.Source: European Parliament - 3 Apr 2026Regulation
The old derogation (Regulation 2021/1232) expires. For almost four months, suspicionless scanning has no legal basis in the EU.Source: Regulation 2021/1232, EUR-Lex - 26 Mar 2026
- 2021 to 2025
- 26 Nov 2025Council
The Council adopts its negotiating mandate. Detection orders are out; providers “may voluntarily check content shared on their platforms”.Source: Council press release - 6 Nov 2025Council presidency
The Danish presidency’s compromise text (14092/25) removes the detection obligations, Articles 7 to 11, from the draft.Source: document 14092/25, published by netzpolitik.org (PDF) - 22 Nov 2023Parliament
Parliament adopts its negotiating mandate: detection only as a last resort, aimed at specific suspects, with end-to-end encryption protected.Source: European Parliament, Legislative Train - 26 Apr 2023Council Legal Service
Opinion 8787/23: ordering a service to scan all its users’ communications is “general and indiscriminate” screening and risks compromising the essence of Articles 7 and 8 of the Charter.Source: Council register (PDF) - 11 May 2022Commission
The European Commission proposes the permanent CSA Regulation (2022/0155(COD)).Source: COM(2022) 209, EUR-Lex - 14 Jul 2021Regulation
Regulation (EU) 2021/1232, the first temporary derogation, makes voluntary scanning lawful. “Chat Control 1.0” is born.Source: EUR-Lex
Are my messages scanned?
“Voluntary” means each provider decides. We track public statements.
| Service | Type | Under the current law | Note |
|---|---|---|---|
| Gmail | May be scanned | Voluntary scanning has historically run here. | |
| iCloud Mail | May be scanned | Voluntary scanning has historically run here. | |
| Instagram messages | Messaging | May be scanned | Encryption is optional, not the default. Voluntary scanning has historically run here. |
| Facebook Messenger | Messaging | Partly covered | Personal chats have been end-to-end encrypted by default since December 2023, which puts those chats outside the derogation. |
| Snapchat | Messaging | May be scanned | Voluntary scanning has historically run here. |
| Xbox | Gaming chat | May be scanned | Voluntary scanning has historically run here. |
| Telegram | Messaging | Unclear | Regular chats are not end-to-end encrypted, so the law does not exclude them. No public statement on scanning. |
| Messaging | Not covered | End-to-end encrypted by default. Outside the scope of Regulation 2026/1881. | |
| Signal | Messaging | Not covered | End-to-end encrypted by default. Outside the scope of Regulation 2026/1881. |
| iMessage | Messaging | Not covered | End-to-end encrypted. Outside the scope of Regulation 2026/1881. |
| Skype | Messaging | Discontinued | Retired by Microsoft on 5 May 2025. Listed because it ran voluntary scanning for years. |
Whether encryption stays protected is the central fight of Chat Control 2.0. An app missing here? Tell us.
Who decides next
Where the permanent law stands in the procedure.
- ProposalCommission11 May 2022
- Parliament positionPlenary mandate22 Nov 2023
- Council positionMinisters’ mandate26 Nov 2025
- TrilogueFive rounds, no deal on detectionnext: 29 Sep 2026 (planned)
- AdoptionParliament plenary and Councildate unknown
- Official JournalPublicationdate unknown
- In forceThen national implementationdate unknown
Council of the EU
Mandate of 26 November 2025: no detection orders, voluntary scanning only. In June the presidency floated a compromise: a mix of voluntary and mandatory detection, split by public and non-public content. Germany’s position in the Council is widely seen as the swing vote.
European Parliament
Detection only as a last resort, aimed at specific suspects, with end-to-end encryption protected. Its second-reading amendments on encryption are already in the temporary law.
European Commission
Proposed the regulation on 11 May 2022 with mandatory detection orders at its heart, and sits in the trilogue as the third party.
What the Council’s own lawyers said
The Council’s Legal Service has said since April 2023 (opinion 8787/23) that ordering a service to scan all its users’ communications is general and indiscriminate screening, with a serious risk of compromising the essence of Articles 7 and 8 of the Charter, and that any such regime must be targeted at persons against whom there are reasonable grounds for suspicion. In Council minutes of May and June 2026, published by netzpolitik.org, it kept that objection against Parliament’s “last resort” detection orders and called voluntary detection in public areas of a service unproblematic. On the Council’s voluntary model it has said only that the exemption may be applied where a legal basis exists, and that nothing in the text stops providers scanning inside end-to-end encrypted services. That is why the single word voluntary carries so much weight. Full account: The Council’s lawyers said no. Chat Control went voluntary. How the negotiating room works: Five trilogues, no deal.
Chat Control FAQ
Short answers, in force today.
Is Chat Control in force right now?
Partly. Chat Control 1.0, Regulation (EU) 2026/1881, has been in force since 31 July 2026. It allows, but does not require, providers of unencrypted mail and chat services to scan private messages for child sexual abuse material. It expires on 3 April 2028. The permanent Chat Control 2.0 is still being negotiated.
Does Chat Control affect WhatsApp or Signal?
Not under the current rules. End-to-end encrypted apps such as WhatsApp and Signal are outside the scope of the 2026 derogation. Scanning can lawfully run on unencrypted services such as Gmail, iCloud Mail, Instagram messages, Snapchat and Xbox.
When is the next decision on Chat Control?
The next political trilogue is planned for 29 September 2026 under the Irish presidency, according to Council minutes published by netzpolitik.org; the institutions have not announced a date. Germany’s position in the Council is widely seen as the swing vote. This tracker is updated within 24 hours of every development.
What is the difference between Chat Control 1.0 and Chat Control 2.0?
Chat Control 1.0 is a temporary permission: providers may scan unencrypted messages, but do not have to. Chat Control 2.0, formally the CSA Regulation, would replace permission with obligation through detection orders and risk mitigation duties. We explain both in Two laws, one nickname.
Did the European Parliament approve Chat Control?
Not exactly. In July 2026 Parliament failed to reject the Council position: the rejection gathered 314 votes and an absolute majority of all MEPs was required. Parliament did adopt amendments excluding end-to-end encrypted communications, which the Council accepted on 23 July. On the core question, the Council text prevailed.
Will Chat Control make me prove my age?
Not under the rules in force today. The 2026 derogation says nothing about age checks. Age verification sits in the permanent Chat Control 2.0 proposal: the Council text would require communication services to verify how old their users are, and the Parliament text rejects that. It is one of three questions still open in the negotiation, alongside mandatory detection and encryption.
Changelog
Every update to this page, including corrections. Nothing is changed quietly.
- 5 Sep 2026Update and correctionNext political trilogue: 29 September 2026, from Council minutes published by netzpolitik.org on 2 July. Added to the status card, the timeline, the procedure steps and the FAQ. Earlier versions of this page said no date had been published; the date had been reported since 2 July.
- 4 Sep 2026New layoutStatus cards, timeline with filters, table of services, procedure steps, FAQ accordion and this changelog. Corrections made at the same time: Skype removed from the list of scannable services (retired 5 May 2025); Facebook Messenger marked partly covered (default end-to-end encryption since December 2023); next negotiating round now given as autumn 2026 with no date published.
- 4 Sep 2026CorrectionThe summary of the Council Legal Service’s position, the 29 June entry (the round ended without agreement on detection; it did not collapse) and the 9 July entry (absolute majority of all MEPs; amendments adopted) were rewritten against primary sources. Link to part four of Who Decides? added.
- 27 Aug 2026PublishedTracker launched with the status of both laws, the timeline, the list of services and the FAQ.
Sources
Primary documents first. We read them, not summaries of them.
- Regulation (EU) 2026/1881Official Journal, 24 July 2026
- Regulation (EU) 2021/1232Official Journal, 14 July 2021
- Commission proposal COM(2022) 209EUR-Lex, 11 May 2022
- Council Legal Service, opinion 8787/23Council register, 26 April 2023
- Council reaches positionCouncil press release, 26 November 2025
- Statement by the EP negotiating teamEuropean Parliament, 29 June 2026
- Support for a more limited ePrivacy derogationEuropean Parliament, 9 July 2026
- Interim measure now reinstatedCouncil press release, 23 July 2026
- Council minutes of May and June 2026published by netzpolitik.org, 12 June 2026
- Council minutes of June 2026: next trilogue 29 Septemberpublished by netzpolitik.org, 2 July 2026
- CDT Europe on the 26 March 2026 voteCDT Europe
- Legislative Train: combating child sexual abuse onlineEuropean Parliament
- Chat Control overviewfightchatcontrol.eu
WithoutCensorship, EU Chat Control Tracker, checked 5 September 2026, withoutcensorship.com/chat-control-tracker/Maintained by WithoutCensorship as part of the Who Decides? series. Background reading: Two laws, one nickname · The Chat Control 1.0 saga · Prove your age · Five trilogues, no deal · The Council’s lawyers said no.
Spotted an error or a development we missed? Use the contact form; corrections make this page better and appear in the changelog. Seen these systems from the inside? If you work at a platform, a hotline or a regulator, talk to us. We take confidentiality seriously.
