Illustration of a woman with a smartphone at her kitchen table in the evening. A translucent drawn plane marks the edge of her warmly lit private space.

EU chat control 2026: Who decides whether your messages are scanned?

Voluntary message scanning starts with a provider’s decision. Understand EU chat control in 2026, the role of encryption and four questions to ask your messaging provider.

When you tell your lawyer about a dispute at work, you choose your words and the recipients carefully. Whether your messaging provider also inspects the content should be equally clear. That is the question at the heart of EU chat control: who decides who gets access to a confidential conversation?

Confidentiality also protects people seeking help. European lawmakers explicitly recognise conversations between survivors of sexual abuse, trusted adults and lawyers. Protecting those conversations belongs in the discussion about child protection.

EU chat control in 2026: the law and the ongoing negotiations

As of 2 November 2026, there is no general EU obligation to scan all private chats. Regulation (EU) 2026/1881 allows certain messaging and webmail providers to carry out voluntary detection under specified conditions. It creates an exemption from certain rules protecting communications confidentiality. The exemption has applied since 31 July 2026 and expires on 3 April 2028. Communications protected by end to end encryption are excluded. A separate legal basis under data protection law is still required.

Negotiations on a permanent framework are separate. Council report WK 15082/2026, dated 30 September, records unresolved issues concerning private content. Parliament sought tighter limits on voluntary searches and targeted detection orders for specific users as a last resort. The Council Presidency had no mandate for such orders. Provisional agreements concerning public content remained subject to agreement on the overall package. A negotiating position is not law.

Voluntary scanning: whose decision is it?

“Voluntary” sounds like a choice on your own screen. Under the current framework, it refers first to a provider deciding to use detection technology. It does not automatically mean that everyone affected has personally consented.

Providers using the exemption must clearly explain that they are doing so, how their measures work and what they mean for confidentiality. This includes the possibility of sharing personal data with law enforcement or child protection organisations. Previously unidentified abuse material and suspected solicitation require human confirmation before a report is made.

The question to ask a messaging provider is therefore specific: do you inspect private messages on your own initiative, on what legal basis and with what access? “We comply with European law” does not explain which choices a service makes within that framework.

Encryption and client side scanning: where content becomes visible

With correctly implemented end to end encryption, only the intended participants can read the content. The provider carries the encrypted message without receiving its readable text. An encrypted connection to the server provides a different form of protection: the service can, in principle, process the content there.

Client side scanning moves inspection onto the device. A message is readable there before encryption or after decryption. If a scanner reports information from a conversation to another party, the transmission may remain correctly encrypted. Yet someone learns about content that was not meant for them. There is no need to break the encryption algorithm. Matching known abuse material differs from assessing new images or conversational patterns. A single accuracy figure cannot adequately describe these different methods.

Article 1(3) of the current exemption also excludes communications that will be encrypted end to end later. Scanning before encryption therefore receives no permission from this regulation. This is not a blanket judgment on every local filter. Technical risks also depend on the implementation. The study “Bugs in our pockets” describes new attack surfaces created by scanners and their update mechanisms. It does not establish a specific vulnerability in every messenger.

Four questions to check your messaging service

Before a confidential personnel discussion or an exchange with your legal adviser, check the communication channel you actually use. A product name alone cannot answer these four questions:

  1. Is this conversation encrypted end to end? Check the status separately for direct messages and groups. Find out which encryption settings apply by default and where you need to enable encryption yourself.
  2. Who else gets access? Check the participants and ask about the permissions of bots, integrations and administrators. Bringing another recipient into the conversation changes who you trust with its contents.
  3. What copies are created? Backups, exports and notification previews may have different safeguards. An authorised recipient can also share messages. Encryption cannot make that trust decision for you.
  4. Does the provider use voluntary content detection? Ask for a clear answer about the methods, legal basis and possible reports. Resolve this before sending particularly confidential material.

How luckychat protects your conversations

In luckychat, private direct messages and private groups are encrypted end to end by default. This applies across all current luckychat web, desktop and mobile applications. Public groups are not encrypted end to end. A group can only be public when encryption is disabled. Choose a private chat for confidential conversations.

We do not carry out voluntary content scanning or analyse message content. Nor do we use message metadata to produce analyses of your conversations. Confidentiality, freedom of thought and the presumption of innocence belong together for us. This does not give anyone a licence to commit crimes. Additional verification helps you check that the keys in use belong to the intended person. Compare the displayed emojis through a trusted second channel and confirm only if they match. Encryption and verification do not prevent a compromised device from reading messages or a participant from sharing them.

Why public scrutiny still matters

Decisions about such intrusions must be open to public scrutiny. In 2024, the European Ombudsman criticised the Commission for refusing wider access to Thorn policy papers and a meeting record. The Commission cited commercial interests, even though national authorities had already lawfully released the documents. Thorn develops detection technology and contributed to the legislative debate.

In 2025, the Ombudsman also criticised Europol’s handling of one staff member’s move to Thorn. She did not criticise the second move examined. Europol said it had found no evidence of an actual conflict of interest, noted that it had not bought Thorn products and announced improvements. The findings show failures of transparency and oversight. They are not proof of corruption.

The success of these measures also needs a concrete test. A 2024 Stanford study interviewed 66 people about the American CyberTipline system. It describes the system’s value alongside gaps in report quality, prioritisation and resources. What matters is whether reports lead to timely help. Confidential routes to support, prevention and effective investigations belong together.

When choosing your messaging service, the question remains the same: who can read your messages, and who decides? A provider should give an answer specific enough for you to make your own choice.

Sources and practical guides

You might also be interested in