Few European policy debates have generated as much confusion as Chat Control. Part of the problem is semantic: there are actually two separate proposals sharing the same nickname, and conflating them has muddied public understanding of what's actually being voted on in Brussels. Untangling Chat Control 1.0 from Chat Control 2.0 is essential for anyone trying to figure out what's real, what's exaggerated, and what still might happen to their private messages.
Two Different Laws, One Confusing Name
Chat Control 1.0 refers to a temporary derogation from the EU's ePrivacy Directive. It allows online platforms, on a voluntary basis, to scan private communications for child sexual abuse material. This framework isn't new. It has existed in some form since 2021 and has been repeatedly extended by the European Parliament as lawmakers negotiate a permanent replacement. Because it's voluntary, providers choose whether to participate, though critics argue that even optional scanning normalizes broad access to users' private content and sets a precedent that's hard to walk back.
Chat Control 2.0 is a different animal entirely. It refers to the proposed Child Sexual Abuse Regulation, a permanent, mandatory framework that has been debated and revised for years without final adoption. Earlier drafts of this regulation raised alarm because they would have required scanning of encrypted messages, effectively forcing providers to build detection mechanisms into end-to-end encrypted apps. That's the version that sparked warnings about backdoored encryption and mass surveillance of ordinary citizens' private conversations.
The distinction matters because public outrage has sometimes targeted the wrong version, or conflated concerns that apply to one but not the other. Chat Control 1.0's voluntary scanning is a real privacy concern, but it doesn't touch encryption directly. Chat Control 2.0, in its more aggressive drafts, threatened something far more structural: the integrity of encrypted messaging itself.
What Actually Happened in July
Chat Control 1.0 technically expired on April 4, 2026, after its legal basis lapsed. In a move that caught many observers off guard, MEPs voted on July 9 to restore its legal basis, reinstating the voluntary scanning framework that had briefly been in limbo. The vote was notable not just for its timing but for how quickly it moved through the legislative process, leaving little room for public debate before the reinstatement took effect.
Meanwhile, Chat Control 2.0, the permanent regulation, remains under negotiation. Recent reporting suggests that the latest drafts of this proposal will not include scanning of encrypted messages, a significant walk-back from earlier versions. That distinction is particularly important for journalists, activists, lawyers, and anyone else who relies on encrypted communication for professional or personal safety. If encrypted scanning is genuinely off the table in the final text, it would mark a meaningful concession from privacy advocates' perspective, though the regulation's final shape is still being hammered out.
Separating Facts From Fear
A lot of the public reaction to Chat Control has treated both versions as if they were identical, mandatory, encryption-breaking surveillance tools. That's not accurate. Chat Control 1.0 is temporary and voluntary. Chat Control 2.0, at least in its current form, appears to be moving away from encrypted message scanning, though it would still be a mandatory, permanent regulation once finalized.
At the same time, dismissing concerns entirely would be a mistake. Voluntary scanning frameworks have a track record of expanding in scope over time, and mandatory regulations can be amended after adoption in ways that reintroduce provisions civil society groups fought to remove. The fact that lawmakers reinstated Chat Control 1.0 through a fast-moving vote, with the legal basis having lapsed for three months beforehand, shows how quickly the legislative landscape can shift with limited public scrutiny.
What This Means For You
If you use messaging apps in the EU, Chat Control 1.0's reinstatement means providers can, if they choose, scan your communications for CSAM under the voluntary framework. It does not currently mandate breaking encryption. Chat Control 2.0, if finalized without encrypted scanning provisions, would represent a more privacy-respecting outcome than what was originally proposed, but it would still be a binding, EU-wide regulation once passed. Staying informed about which version is being debated at any given time is the best way to separate legitimate concern from misplaced alarm.
Key Takeaways
Understanding the difference between Chat Control 1.0 and 2.0 isn't just a technicality, it shapes how you should think about your own privacy practices going forward. Keep track of which proposal is actually moving through the European Parliament at any given moment, since the two often get discussed interchangeably in headlines. If encrypted messaging matters to you, watch closely for any changes to Chat Control 2.0's final text, since earlier drafts included provisions that could have undermined encryption entirely. And regardless of how the legislation evolves, using services that are transparent about their data practices and encryption standards remains one of the most effective ways to protect your own communications.
