Voluntary chat control: EU Parliament plans next deadline extension

The suspicion-independent scanning of private online communication was originally intended as a one-time special regulation. Now, the corresponding voluntary chat control is to be extended for the second time – despite strong criticism of the proportionality of the measure. This suggests that the interim solution is likely to become permanent: The EU Commission, the member states, and the Parliament's negotiators are pushing for a renewed extension of the requirement in the fight against the dissemination of child sexual abuse material.

The Commission and the Council of Ministers want to extend the deadline for the authorization across the board by around two years – until April 3, 2028. Leading EU MEPs are now trying, at least, to limit the deadline to one year and to restrict the scans to already known abuse material. In general, digital letter secrecy in Europe is once again at a crossroads, while negotiations on a permanent solution within the framework of the long-contested regulation to restrict child sexual abuse material are stalled.

The confidentiality of digital messages is legally enshrined in the EU. The ePrivacy Directive from 2002 protects citizens' privacy and prohibits content monitoring without the explicit consent of the affected parties. However, since 2021, a "temporary exception" has been undermining this protection. It allows internet service providers such as Meta, Google, Microsoft, or Snapchat to automatically scan their users' private chats, images, and metadata to find abuse material. This transitional provision was originally limited to three years, but was already extended once in April 2024. Now, the second round is imminent.

Political deadlock and lack of factual basis

The responsible rapporteur in the EU Parliament, Birgit Sippel, has attached an unusually critical statement to her draft. The SPD politician clearly criticizes that the actually exceptional measure is becoming routine simply because negotiations on the so-called CSA regulation have not progressed since 2022. Sippel therefore proposes to at least abandon the most error-prone technologies.

In her paper, the Social Democrat calls for refraining from scanning text messages and automated evaluation of previously unknown image material in the future. Instead, providers should only be allowed to search for already known content that can be identified via unique digital fingerprints, so-called hash values.

The EU's data protection supervisor has also been criticizing for years that fundamental rights are being infringed without the necessity being proven. Nevertheless, the vote in Parliament is scheduled for March, as proponents fear a "protection gap" should the current authorization simply expire in April 2026.

Inefficiency and risk of criminalization

In practice, a problematic picture emerges that contradicts the arguments of the proponents. According to figures from the Federal Criminal Police Office (Bundeskriminalamt), almost half of the reported content in 2024 – around 100,000 chats – was completely irrelevant to criminal proceedings. Often, it involved harmless beach photos or typical teenage "sexting" among minors. Instead of dismantling organized criminal rings, the automated procedure is likely to contribute to law enforcement agencies drowning in a flood of data garbage.

About 40 percent of proceedings are now directed against young people, not criminal networks. These resources are missing for investigators elsewhere, for example, in proactive searches on the dark web or in targeted investigations against known suspects.

Civil rights activists like former MEP Patrick Breyer warn of an "end to digital letter secrecy by installments." As long as the voluntary chat control is repeatedly extended, Breyer argues, there is no pressure on EU states to adopt modern security standards like "Security by Design." Apps could be pre-configured to make contact with strangers ("grooming") more difficult without broadly monitoring the private communication of all citizens.

In the EU Parliament, there is still an opportunity to prevent at least the worst excesses of mass surveillance through amendments to the Sippel draft. Alliances like "Stop Chat Control" call to contact their representatives directly before the dice are cast in March.

(nie)