explainer

chat control: two different proposals, one confused headline

The press routinely conflates these. They are not the same fight, they are not at the same stage, and mixing them up is how honest people end up wrong about EU law. Here they are kept separate.

Last verified: 2026-07-28

chat control 1.0

the voluntary scanning derogation

A temporary legal derogation that permits messaging and email providers to voluntarily scan private communications for child sexual abuse material, without it being mandatory. It expired 3–4 April 2026. Parliament then failed to reject the Council's fast-tracked reinstatement text — a rejection needed an absolute majority of 361 MEPs, and only 314 voted to reject it — so the derogation was reinstated on 9 July 2026. Voluntary scanning under it may continue until 2028.

status: in force (reinstated 2026-07-09) — voluntary, not mandatory, permitted until 2028

chat control 2.0 / CSAR

the permanent regulation — still not law

The proposed permanent Child Sexual Abuse Regulation (CSAR): mandatory detection orders, with the possibility of client-side scanning built into messaging apps before encryption applies. This is what most alarm about "chat control" is actually about, and it is still in trilogue negotiation between Parliament, Council, and Commission — it is not law. The fifth and expected-final trilogue was held 29 June 2026 under the Cyprus presidency and did not resolve it. Talks resume in September 2026, with Q4 2026 the likely decision window.

status: in trilogue, unresolved — not enacted, decision expected Q4 2026

The distinction matters because the two proposals carry very different stakes: 1.0 is a permission for providers to scan voluntarily, already in force again; 2.0/CSAR is a mandate that could force scanning into how messaging apps work at all, and it has not been decided. Reporting that says "chat control passed" without specifying which one is, at best, imprecise.

timeline

what happened, in order

  • 2026-04-03/04

    chat control 1.0 expires

    The temporary derogation permitting voluntary scanning lapses.

  • 2026-06-29

    fifth trilogue on CSAR, under the Cyprus presidency

    Expected to be the final round. It was not — the permanent regulation remains unresolved.

  • 2026-07-09

    chat control 1.0 reinstated

    Parliament falls short of the 361-MEP absolute majority needed to reject the Council's fast-tracked text — only 314 vote to reject. The voluntary-scanning derogation is reinstated, permitted until 2028.

  • 2026-09 →

    CSAR trilogue talks resume

    Q4 2026 is the window in which a decision on the permanent regulation is expected.

where veil fits

veil doesn't fix this fight

This is a legislative fight about what providers and apps must do, not a gap in your machine's configuration. veil can't opt you out of a regulation. What it does is make sure your own device isn't handing over more than the law already requires — encrypted DNS, a working VPN tunnel, a firewall that's actually on. Read the threat model for what that does and doesn't cover.