There is a European bill that, if approved in its most aggressive form, would force WhatsApp, Signal and Telegram to scan every private message before it is sent. It is called Chat Control 2.0. For now it has been halted — but the game is far from over.

What Chat Control Is and Why It Exists

The Chat Control regulation was born from a noble intention: fighting the distribution of child sexual abuse material (CSAM) online. The idea is that messaging platforms should automatically analyze the contents of private conversations in order to detect illegal images or videos.

The problem is the method. The original proposal — Chat Control 2.0, presented by the European Commission in 2022 — called for client-side scanning: every message would be analyzed on your own device, before it is even encrypted and sent. In practice, a backdoor into end-to-end encryption.

Cybersecurity experts around the world have denounced the technical impossibility of distinguishing this measure from a mass-surveillance system. If your phone has to read every message to inspect its contents, there is no longer any privacy left in digital communications.

Where Things Stand: A Temporary Victory, an Ongoing War

In March 2026, the European Parliament blocked the most invasive version of the regulation, establishing clear principles: no indiscriminate scanning, measures must be targeted and proportionate, based on judicial authorization, and end-to-end encrypted communications must remain excluded from any scanning.

The transitional rules, which expired on April 3, 2026, were extended until August 2027 — but with far tighter constraints. A breath of fresh air, not a definitive victory.

Why? Because the final regulation — the real Chat Control 2.0 — is still under negotiation between the Parliament, the Commission and the European Council. The institutions are aiming to approve it by the end of 2026. And at that stage, anything can happen.

Italy abstained during the key votes, together with Germany. An ambiguous signal: neither in favor nor against, leaving every negotiating option open.

GDPR Turns 7: Promises Unkept

While Chat Control is being negotiated, it is worth taking stock. The GDPR came into force in May 2018. In seven years, European authorities have imposed over 7 billion euros in fines — more than one fine per day on average.

And yet, as Federprivacy has documented, it has never been as difficult as it is today for an ordinary citizen to protect their own privacy. Advertising trackers everywhere, abusive call centers, invasive AI. Italy’s data protection authority (the Garante) is the second most active in Europe by number of fines: 400 rulings in seven years. But corporate behavior isn’t changing enough.

The law exists. Its enforcement is slow, fragmented, asymmetric. The big platforms pay the fines as a cost of doing business and carry on. Small and medium-sized enterprises, on the other hand, risk being suffocated by compliance. The system punishes those who can’t afford the best lawyers.

What It Means for You, Concretely

Chat Control 2.0, in its most aggressive form, is not dystopian science fiction. It is a formal proposal by the European Commission, backed by governments that consider it acceptable to sacrifice the privacy of 450 million people in order to — theoretically — catch criminals who would probably just migrate to different channels.

The crucial point: a backdoor created for “good” purposes cannot be reserved for the good guys alone. Who guarantees that the very same infrastructure won’t be used tomorrow for political censorship, surveillance of journalists, or the suppression of dissent? No one.

The architecture of surveillance, once built, gets used. It has always gone that way.

What You Can Do Today

Don’t wait for the regulation to be approved before protecting your communications. A few concrete steps:

Use Signal for the conversations that matter. It is open source, end-to-end encrypted, ad-free, and collects no metadata beyond the bare minimum. It is the de facto standard for anyone who wants to communicate privately.

Disable unencrypted backups. Many people use Signal or WhatsApp but back up to Google Drive or iCloud without encryption. That backup is accessible. Disable it, or encrypt it with a strong password.

Follow the legislative debate. Patrick Breyer, the German member of the European Parliament, is the most active voice against Chat Control. His website patrick-breyer.de is constantly updated on the state of the negotiations.

Conclusion

Chat Control 2.0 is halted, not dead. The final negotiation underway in 2026 will determine whether Europe becomes the first democratic bloc to adopt the mass surveillance of private communications as a matter of law. Privacy is not a privilege for those who have something to hide: it is the oxygen of freedom of thought. It is worth defending — before it disappears from the political agenda without anyone noticing.

Sources: