EU Extends Voluntary Chat Scanning Rules Through 2028

EU lawmakers have voted to keep voluntary message-scanning rules in place until 2028, extending a legal framework that lets messaging providers scan private chats for illegal content even as the broader, more contentious Chat Control proposal continues to work its way through Brussels. The extension doesn't force anyone to scan messages, but it keeps the door open, and it means the fight over encryption in Europe's messaging apps is far from over.

For everyday users of Signal, WhatsApp, and Telegram, the news might sound like inside baseball. It isn't. The EU Chat Control encryption rules debate touches every app that promises private, end-to-end encrypted communication, and the extension to 2028 signals that lawmakers see message scanning as a long-term policy tool rather than a temporary emergency measure.

What the Extended Voluntary Scanning Rules Actually Authorize

The rules renewed by EU lawmakers are described as voluntary, meaning messaging platforms and email providers can choose to scan user content for illegal material without running afoul of EU privacy law. This interim arrangement has existed for several years as a stopgap while the European Commission and Parliament negotiate a permanent, mandatory version of the policy known as Chat Control.

By pushing the voluntary framework's expiration date out to 2028, lawmakers have effectively bought themselves years of breathing room. Companies that already scan messages can keep doing so legally, and the political pressure to finalize a mandatory regime eases, at least temporarily. But "voluntary" is doing a lot of work in that sentence. Once scanning infrastructure exists inside an app, whether a company uses it aggressively, sparingly, or expands it later is largely up to that company and future regulation, not the user.

Why Encrypted Apps Like Signal, WhatsApp, and Telegram Are Still in Scope

The reason this keeps coming up for end-to-end encrypted apps specifically is that scanning encrypted content requires a different approach than scanning a plain-text email. Providers can't read the contents of a truly end-to-end encrypted message on their servers, so any scanning has to happen on the device itself, before encryption is applied or after decryption. This is often called client-side scanning, and it's the technical mechanism that critics say undermines the core promise of end-to-end encryption.

Signal has long said it would rather leave the EU market than build scanning tools into its app. WhatsApp and Telegram, both widely used across the bloc, face the same underlying tension: any mechanism built to flag illegal content before encryption is applied is also, technically, a mechanism that could be expanded, misused, or targeted by bad actors. The voluntary extension doesn't mandate this kind of scanning for encrypted apps, but it keeps the legal and political groundwork in place for a future rule that could.

How This Fits Into the Broader Chat Control Fight in Brussels

This voluntary extension is a subplot in a much larger, ongoing story. The permanent Chat Control regulation has been debated in the European Parliament for years, with privacy advocates, technologists, and a large bloc of lawmakers warning that mandatory scanning would break encryption for everyone, not just suspected bad actors. Despite that opposition, the measure has continued to advance through EU institutions. As we covered in our report on how Chat Control passed an EU vote despite 314 MEPs opposing it, a majority of members voting against a proposal doesn't automatically stop it under the EU's legislative rules, a procedural quirk that has kept the mandatory version alive even when opposition looked overwhelming on paper.

The voluntary rules extension announced now doesn't resolve that fight. If anything, it demonstrates how EU policymakers are managing the issue in stages: keep the interim scanning framework running, avoid a legal cliff edge, and continue negotiating the permanent regulation in parallel. Users shouldn't read the 2028 extension as a sign that Chat Control has been shelved. It hasn't.

What This Means For You

If you use Signal, WhatsApp, Telegram, or any other messaging app in the EU, nothing about your day-to-day encryption changes immediately because of this extension. Voluntary scanning rules don't force any specific app to start scanning your messages tomorrow. What has changed is the timeline: EU lawmakers now have until 2028 to hash out a permanent framework, and the underlying legal architecture for scanning stays available to providers who opt in.

The practical risk isn't a sudden loss of privacy this week. It's the slow normalization of scanning infrastructure as a standard feature of messaging apps, which makes it easier to mandate later. Staying informed about which apps commit to true end-to-end encryption without scanning backdoors, and which ones participate in voluntary scanning programs, is the most useful thing a privacy-conscious user can do right now.

Actionable Takeaways

Follow the messaging apps you rely on for public statements about their stance on scanning and encryption, since providers who oppose client-side scanning tend to say so publicly. Keep an eye on Chat Control's legislative progress rather than assuming the debate is settled, since the mandatory version remains active in Brussels. Consider using apps that have made clear, public commitments against building scanning backdoors into their encryption. And recognize that EU Chat Control encryption rules are a moving target, not a one-time decision, so what applies today may look different well before that 2028 deadline arrives.