EU CSA Regulation (Chat Control 2.0)
European Union- Proposed
- Parliament position
- Trilogue
- Adopted
The permanent plan to mandate scanning of private messages in Europe. Five trilogue rounds have failed on the same question: suspicionless scanning of encrypted communications.
Latest update
Fifth trilogue round failed over permanent suspicionless scanning
This bill is still moving
This bill is still moving, so there's still time to push back.
Contact LawmakersWhat it does
The proposed CSA Regulation would let authorities issue detection orders forcing services to scan private communications for abuse material, with the reach into end-to-end encryption as the central fight. Parliament's November 2023 mandate drew the lines: no scanning of encrypted services, judicial warrants, no suspicionless scanning. The Council deadlocked for two years until Germany's 2025 shift against mandatory suspicionless scanning broke the logjam toward a softened position built on voluntary detection, endorsed in November 2025. Five trilogue rounds between December 2025 and June 2026 failed to close the gap, the Council's own Legal Service warned in June that even the voluntary regime violates Article 7 of the Charter, and the fifth round collapsed on June 29 over permanent suspicionless scanning. Negotiations resume under the Irish presidency in September.
Why it matters
This is the West's central fight over whether private communication survives. Whatever text emerges becomes the global template: a mandate here is cited in Washington and London within the year. And the voluntary regime of Chat Control 1.0 runs alongside as the ratchet, keeping scanning normalized while the permanent version is negotiated.
Our take
Four years in, nobody has explained how you scan encrypted messages without breaking encryption for everyone, because there is no answer. The Council's own lawyers now say the voluntary version violates the Charter. The strategy left is attrition: keep the interim regime alive, stall the permanent text, and wait for a presidency willing to force it. September is the next attempt, and the Council's label for the scanning is voluntary, the same label the 1.0 regime has carried for seven years.
Timeline
Fifth trilogue round failed over permanent suspicionless scanning
LatestCouncil Legal Service warned voluntary scanning violates Charter Article 7
Trilogue negotiations began; four rounds through May without agreement
Council general approach adopted without debate at COREPER, built on voluntary scanning
Germany came out against mandatory scanning, forcing Denmark to drop detection orders
Council vote pulled after the blocking minority held
Parliament mandate: no scanning of encrypted services, judicial warrants required
Proposed by the European Commission
Sponsor
European Commission