Three Laws, One Target: Your Private Messages
A quiet but consequential shift is underway across three of the world's largest regulatory blocs. The European Union's proposed Chat Control regulation, the United Kingdom's Online Safety Act, and the United States' proposed KIDS Act are each, in their own way, building message surveillance into law. The stated goal in every case is protecting children online. The practical effect, according to privacy advocates and security researchers, is the erosion of end-to-end encryption, the technology that keeps private messages private between sender and recipient, with no one else, not even the platform, able to read them.
These three efforts didn't emerge from a single coordinated plan, but together they represent a pattern: lawmakers in different jurisdictions arriving at similar conclusions about scanning, monitoring, or otherwise gaining visibility into encrypted communications, even when the technical and civil liberties tradeoffs are strikingly similar.
The EU's Chat Control Proposal
Chat Control is the informal name given to the EU's push to require messaging services to scan private communications, including encrypted ones, for illegal content before it's sent. Supporters frame it as a tool to combat the spread of child sexual abuse material online. Critics, including encryption experts and digital rights organizations, argue that any mechanism capable of scanning encrypted messages before they're sent effectively breaks the encryption itself. Once a scanning backdoor exists, the argument goes, it can be exploited by bad actors, expanded to cover other types of content, or misused by governments beyond its original intent.
The debate has repeatedly stalled and resurfaced within EU institutions, reflecting how contentious the underlying tradeoff is: protecting children versus protecting the privacy of everyone who uses encrypted messaging apps, which is to say, hundreds of millions of ordinary people with nothing to do with any crime.
The UK's Online Safety Act and the US KIDS Act
The UK's Online Safety Act, already in force, gives regulators broad powers to compel platforms to detect and remove harmful content, with provisions that have raised similar encryption concerns to those surrounding Chat Control. One flashpoint has been age verification and whether the law would push people toward workarounds like VPNs to access restricted content. Notably, UK officials have already rejected VPN restrictions under the Online Safety Act, choosing not to target VPN use directly even as age verification requirements roll out. That decision matters because it shows regulators drawing at least one line, even as the broader scanning and monitoring provisions of the law remain in place.
Across the Atlantic, the proposed KIDS Act in the United States follows a comparable logic: framing platform monitoring and content moderation obligations as child safety measures. Like its European counterparts, it has drawn scrutiny from privacy advocates who warn that safety mandates can, in practice, require the kind of visibility into private communications that undermines encryption for every user, not just those the law is meant to protect.
What This Means For You
If you use encrypted messaging apps, whether for personal privacy, professional confidentiality, or simply because you value not having your conversations read by third parties, these laws matter regardless of where you live. Regulations passed in one country often influence policy elsewhere, and platforms that operate globally may adjust their encryption practices everywhere to comply with the strictest jurisdiction.
The core tension in all three laws is the same: can a system scan or monitor communications for harmful content without breaking the privacy guarantees that make encryption meaningful in the first place? Security researchers have consistently argued the answer is no. A scanning mechanism built into an encrypted system is a vulnerability, whether it's used by a government agency, a hacker, or an authoritarian regime that later gains access to the same tool.
Actionable Takeaways
Stay informed about how these laws evolve, since none of Chat Control, the Online Safety Act's implementation, or the KIDS Act are static. Provisions get amended, delayed, or reinterpreted as public and industry pressure mounts. Pay attention to which messaging apps commit publicly to maintaining true end-to-end encryption and which signal they may comply with scanning mandates. If you're concerned about message privacy, consider using tools with a strong track record of resisting government pressure on encryption, and keep software updated so you benefit from security improvements as they roll out. Finally, engage with the policy process where you can. Public comment periods, parliamentary consultations, and advocacy campaigns have already shaped outcomes like the UK's decision not to restrict VPNs, and they can shape what comes next for Chat Control and the KIDS Act too. The fight over encrypted messaging isn't settled, and how it resolves will affect anyone who values a private conversation.
