Five rounds of closed-door negotiation have failed to settle whether Europe may scan everyone’s private messages. A sixth is coming this autumn. Almost nobody can tell you who is in the room, what they are allowed to agree, or how you would find out if they did.
This is the fifth piece in our Who Decides? series, and it is about the least visible stage of European lawmaking. Chat Control 2.0 will not be settled by a dramatic vote you can watch. It will be settled in a trilogue.
What is a trilogue?
A trilogue is an informal negotiation between the three institutions that have to agree before an EU law can pass: the European Parliament, the Council of the EU, and the European Commission. It has no basis in the founding treaties. It grew up because the formal procedure, where each institution amends a text in turn, is slow, and because a deal reached in private is easier than a deal reached in public.
Roughly four out of five EU laws are now agreed this way, at first reading, before most members of the Parliament have voted on anything. There is no public gallery, no live stream and no transcript. What comes out is a single compromise text that both sides then rubber-stamp.
Who is actually in the room?
Three delegations, and they are not the same kind of body at all.
The Parliament sends a negotiating team: the rapporteur who wrote its report, shadow rapporteurs from the other political groups, and the chair of the responsible committee. They are bound by the mandate the Parliament voted, and they cannot lawfully agree to something outside it.
The Council is represented by whichever member state holds the rotating presidency. Since July 2026 that is Ireland. The presidency speaks for a mandate agreed by all twenty-seven governments, which means it arrives with the least ambitious version of the text that nobody has vetoed yet.
The Commission sits between them as broker and as author of the original proposal. It has no vote, but it drafts the compromise language, and whoever drafts the language shapes what is thinkable.
So the honest answer to “who decides” is: a rapporteur, a rotating presidency and a Commission official, working from mandates that were themselves agreed at different times by different majorities.
What are they fighting about?
Three questions, and every one of them has been open since 2022.
May detection target everyone, or only named suspects? The Parliament’s position, adopted in committee in November 2023, allows surveillance only with a judicial warrant and only against people or groups reasonably suspected of involvement in child sexual abuse material. The Council’s mandate of 13 November 2025 instead allows providers to scan at their own discretion, without suspicion and without a court order, and calls this voluntary.
Does encryption survive? The Parliament excludes end-to-end encrypted services from the scope entirely. The Council follows the Commission and keeps them in. In February 2024 the European Court of Human Rights ruled that requiring providers to weaken end-to-end encryption cannot be regarded as necessary in a democratic society. That judgment did not end the argument.
Will everyone have to prove their age? The Commission and Council texts require communication services to verify how old their users are. The Parliament rejects mandatory age verification for communication services. This is the quietest of the three questions and the one most likely to survive into the final text, which is why we treat it as its own subject in Papers, Please.
Why five rounds have failed
Because the disagreement is not about wording. It is about whether a democracy may search the correspondence of people it does not suspect of anything.
The Council’s answer has been to relabel the search. If scanning is described as voluntary, chosen by the provider rather than ordered by the state, it looks less like surveillance. The Council’s own legal service took that argument apart: scanning framed as voluntary is still generalised scanning of communications, and generalised scanning is incompatible with Article 7 of the EU Charter of Fundamental Rights without reasonable suspicion and prior judicial authorisation.
When your own lawyers write that down, the negotiation stops being about finding better words. The fifth round, billed as the final one, ended on 29 June 2026 without agreement on exactly this question, even as Parliament’s team reported compromises on almost the entire Regulation.
Who can break the deadlock?
Not the Parliament as a whole, and this is the part people get wrong. On 9 July 2026, at the second reading of the temporary law, a motion to reject gathered 314 votes, with 276 against and 17 abstentions. It needed an absolute majority of all MEPs, and 314 was not enough. Parliament did adopt amendments that exclude end-to-end encrypted communications, and the Council accepted them on 23 July. But on the core question the Council text prevailed, because at second reading the Parliament must muster an absolute majority of all its members to stop something, not merely more votes than the other side.
That arithmetic is the whole story of this file. A Parliament that is against something is not the same as a Parliament that can block it. We took that apart in When a No is not enough.
The realistic ways this ends: the Council presidency finds a form of words that a qualified majority of governments and a majority of MEPs can both live with; or one large member state moves and takes the blocking minority with it; or the file runs out of political time and dies quietly, as EU files sometimes do.
What to watch next
The negotiations resume this autumn under the Irish presidency, with an adoption push expected in October 2026. Three signals are worth more than any headline.
Whether a sixth trilogue is scheduled at all. A presidency that believes it can win books the meeting. A presidency that does not, lets the file drift.
Whether the word voluntary survives in the Council text. If it does, the legal service’s objection has been overruled rather than answered, and the law will be litigated rather than settled.
Whether Germany moves. Its position in the Council is widely treated as the swing vote, and a change there changes the arithmetic for everyone else.
What is in force while they argue
Chat Control 1.0 is law. Regulation (EU) 2026/1881 was adopted on 24 July 2026, entered into force on 31 July 2026, and expires on 3 April 2028. It permits, but does not require, providers of unencrypted mail and messaging services to scan private communications without individual suspicion. End-to-end encrypted services are outside its scope.
In other words, the thing the trilogue cannot agree to make permanent is already happening on a temporary basis. We keep the current status on the EU Chat Control Tracker, updated within 24 hours of every development.
Correction, 4 September 2026: an earlier version of this article gave the absolute majority as 361 votes, described the 29 June round as having collapsed, and said the Council text became law by default. The Parliament’s press office put the bar at 360 that day, its negotiating team reported compromises on almost the entire Regulation with detection left open, and Parliament adopted amendments on encryption that the Council accepted on 23 July. The full account is in The Council’s lawyers said no. Chat Control went voluntary.
