- Data Journalists Investigation: How the EU will scan our WhatsApp and how chat control will work on major platforms. The “key,” encryption, and the dark web.
- Giorgos Pleios to Data Journalists: “The major platforms trade in personal data. These measures are part of a global trend toward the suppression of freedoms.”
- The role of Artificial Intelligence: When it detects a file it judges to be suspicious, it will report it to the Data and Incident Assessment Centre, which will decide whether to refer the case to the authorities of the EU member states.
- The content of communications will be scanned on users’ devices (client-side scanning) before it is encrypted and sent, and this will apply even to end-to-end encrypted conversations. So there will be no such thing as encryption…
- How we got here: The votes and stages in the long-running effort to impose the measure.
- Kostis Pieridis to Data Journalists: “There are grey areas and questions of legality. After September 11th, Security prevailed over Freedom.”
- Enforcement handed to private parties – Cryptography experts sound the alarm.
By Vasilis Galoupis
The European Union is regarded internationally as the model for fundamental human freedoms and digital privacy. It has enshrined this core principle in its legal order through the Charter of Fundamental Rights of the European Union, which governs all of its laws and actions. Article 7 is unambiguous: “Everyone has the right to respect for his or her private and family life, home and communications.” The Article is considered a cornerstone of European democratic values.
This is why a regulation that the European Commission pushed through as an emergency measure, the scanning of all communications of its 450 million citizens, without exception, is already stirring up more debate and backlash than any other piece of legislation the European Union has ever passed.
In essence, the European Council is asking all messaging services, that is, providers of online services or interpersonal communications operating in Europe, to scan the communications of all their users, as well as the files they exchange with one another, with the aim of detecting material related to the sexual abuse or grooming of children.
This is the so-called “Chat Control,” which legalises the scanning of all private digital communications, including encrypted messages and photos. This threatens the fundamental rights to privacy and digital security for all EU citizens.
How chat control would work on the major platforms
In practical terms, this means that major platforms and technology companies (Meta, WhatsApp, Viber, etc.) would check all our emails and every photo and video we send in our private communications. Software would be installed on every mobile phone that would scan users’ communications in real time.
When it detects a file it judges to be suspicious, it will report it to the Data and Incident Assessment Centre. The data centre, using Artificial Intelligence software, will decide whether to refer the case to the law enforcement authorities of the EU member states.
Even the EU’s supervisory Data Protection Authorities warn that this particular regulation runs counter to the privacy guarantees of the Charter of Fundamental Rights, since it could permit broad, indiscriminately applied scanning and monitoring of ordinary communications.
Every file would be scanned automatically
What does this mean in practice for every EU citizen? Every photo, every message, every file they send could be scanned automatically without their consent and without their being suspected of anything.
The purpose behind scanning all the communications of European citizens is the protection of children, specifically, the detection of material related to child grooming or sexual abuse.
In practice, however, this is seen as the starting point for the dismantling of communications privacy, with even encryption itself being abolished in the process.
The content of communications would be scanned on users’ devices (client-side scanning) before it is encrypted and sent, and this would apply even to end-to-end encrypted conversations. So encryption would effectively cease to exist, since the monitoring, the scanning of the communication, would take place before it even has the chance to be encrypted.
G. Pleios: They trade in personal data
Giorgos Pleios, Professor and Director of the Laboratory for Social Research in the Media at the Department of Communication and Media Studies of the National and Kapodistrian University of Athens, spoke to Data Journalists, adopting a critical stance toward the surveillance of citizens by companies and states.
He stresses that major platforms trade in personal data and that measures such as the fake news law overstep constitutional provisions and the confidentiality of communications. He views these measures as part of a global trend toward the suppression of freedoms, turning citizens into objects of surveillance in the name of supposed risks.
“I disagree on principle,” he tells us: “And all the more so when it’s the companies themselves doing this, companies which, as we know very well, trade in personal data. This clearly oversteps the provisions of the Constitution and the confidentiality of private communications. That’s my view.”
Privacy and the dark web
Objections have been raised across the entire political spectrum in the European Parliament (left, right, and liberals alike), as well as by security experts and cryptographers. Most of them believe that the measure may stem from good intentions, but that in practice it normalises the erosion of privacy.
Paedophiles would simply “move” their communications to other networks, such as the dark web, meaning the fight against the sexual abuse of children would not actually be achieved this way. Consequently, as experts in security and encryption argue, rather than a targeted crackdown on child sexual abuse, the measure paves the way for the mass surveillance of every private communication of European citizens.
K. Pieridis: Grey areas and questions of legality
Data Journalists also spoke with Kostis Pieridis, a PhD candidate in the Department of Political Science and History at Panteion University. He points out that the EU is pushing to extend measures allowing the monitoring of conversations on apps like WhatsApp and Viber, justified on the grounds of combating sexual abuse.
He raises questions of legality and “grey” areas, highlighting the risk of mass surveillance of private communications. “The framework is being presented as a shift toward greater state power at the expense of privacy,” he stresses.
How we got here: The votes and stages in the long-running effort to impose the measure
The “key” and encryption
The critical point is that the 2021 regulation was not extended to encrypted messaging services such as WhatsApp or Signal, thereby preserving a basic level of privacy for users. The abolition of encryption, however, is set to arrive in September with the introduction, for consultation, of “Chat Control 2.0”, the reinforced version of the bill.
So, on 9 July 2026, the “Chat Control 1.0” bill passed through the European Parliament, extending the validity of the controversial legislation until April 2028. Although most MEPs voted against the proposal rather than in favour of it (314 votes against, 276 in favour, and 17 abstentions), the absolute majority required to reject it (361 votes) was not reached, and as a result it was approved.
The fact that, even though most MEPs actually voted against the legislation, the European Parliament nevertheless passed the law caused strong dissatisfaction and was seen as setting a particularly dangerous precedent in the European Parliament.
How the member states voted
On 23 July 2026, the governments of the EU member states confirmed the temporary extension of Chat Control 1.0 through a written procedure in the Council of the EU,with the result that 25 countries voted in favour, 1 against, and 1 abstained, extending the law on scanning citizens’ communications until 3 April 2028.
No official data on how each individual country voted was made public. In the Council of the EU’s written procedure of 23 July 2026, the Council did not publish a detailed public list setting out each country’s vote in detail, and the written procedures were handled internally by EU ambassadors.
That said, judging by their previous stance in November 2025, the bloc of countries supporting the Chat Control legislation was made up of:
Pieridis: The ranking of “security” over “freedom” since 2001
After September 11th, Security prevailed over Freedom in Western democracies, Mr. Pieridis concludes, speaking to Data Journalists. He identifies a turning point after the attacks on the US and the “war on terror,” where the presumption of innocence and civil liberties gave ground to security.
He cites the widespread use of CCTV in the United Kingdom as an example, where visual evidence is now used systematically in courts. He concludes that freedoms are being “sacrificed” at the altar of security as the supreme good.
He points out that younger generations give consent to data sharing more readily: “A culture of one-click consent, given without a second thought, has become entrenched,” he states, adding the crucial AI dimension: “In the future, Artificial Intelligence won’t just ‘read’, it will actively shape needs and desires, based on long-term analysis of behavioural, biometric, and environmental data.”
AI, moreover, appears to solve the scale problem of analysing enormous volumes of data. Artificial Intelligence has the capacity to process an inconceivable volume of data in minimal time, drawing timely and precise conclusions from the data collected on citizens. This technical capability is accelerating the shift to the next phase of surveillance, one involving automated decision-making.
The arguments on both sides: Security or Privacy?
Supporters of Chat Control and of the measure to scan all communications of EU citizens believe that privacy, one of the fundamental rights the EU has hitherto fully protected, must now be weighed against a potential public “harm” it could otherwise cause.
They judge that “Chat Control” combats online child sexual abuse and exploitation. They consider that protecting children must take priority over citizens’ right to privacy.
And they argue that protecting minors from online sexual grooming and abuse is an overriding moral duty that justifies enhanced detection measures, even if this means the end of privacy protection for communications.
By contrast, the arguments of critics, who include many internationally recognisedexperts in encryption and surveillance, stress that the legislation is, at best, practically unenforceable and will prove ineffective, while at worst it will prove dangerous.
The main objections that have been raised are:
– the indiscriminate application of scanning to citizens’ ordinary communications amounts, in practice, to mass surveillance that treats all citizens as suspects rather than targeting specific criminals.
– it runs counter to the fundamental privacy guarantees set out in the Charter of Fundamental Rights.
– breaking encryption, that is, forcing systems to scan messages before they are encrypted, weakens the digital security not only of citizens but also of each country’s sensitive state services, opening backdoors for hackers and various malicious groups.
The most recognised experts in cryptography conclude that this amounts to mass surveillance. There is also the risk of “false positives,” since automated AI scanners (detection algorithms), even at the highest achievable levels of accuracy, tend to misidentify innocent content, putting ordinary citizens at risk of false accusations and damaging investigations.
The scans carried out by this technological software cannot accurately determine what is lawful and what is unlawful, Patrick Breyer stated: “This week (30.7.26) we received data from Germany showing that more than 50% of these reports, generated through mass scanning as suspected findings of child sexual abuse, are not, in fact, criminally actionable.”
Pleios: The citizen as the object of surveillance
“If we look at the bigger picture, there are now many interventions, particularly within the European Union, restricting freedom of speech and privacy. This isn’t the only instance, there are quite a few,” Giorgos Pleios tells us:
“I believe that with every new step, the citizen essentially becomes the object of surveillance, an object that goes beyond constitutional provisions and which is clearly bound up with preventing any mobilisation of citizens, all in the name of some supposed risk. I’d remind you too of the Fake News law, which also sparked backlash.”
Enforcement handed to private parties – Cryptography experts sound the alarm
Through Chat Control, the EU is effectively outsourcing the work of law enforcement to private parties. According to the Economist, the European Union has proposed, through Chat Control 2.0, requiring messaging and email platforms to scan content and use artificial intelligence to flag any potentially illegal material, which would then be sent off for assessment.
In 2021, a group of 14 of the world’s leading cryptography experts, including Whitfield Diffie and Ronald Rivest, the two legendary cryptographers who, in the 1970s, laid the foundations for the encryption methods still widely used today, put forward a detailed case against mass scanning:
“The first issue is how the algorithm being used would distinguish a harmless family photo at the beach, or of a toddler being bathed, from an illegal photo documenting child abuse. If the result were a flood of false positives, then moderators would end up having to view enormous quantities of private data.”
The second objection is that such monitoring could set a dangerously slippery precedent: a government that starts out by scanning for child sexual abuse images could later repurpose the same software for a much broader range of content.
Third, if the system relies on a central database of illegal content, hackers or spies could secretly expand that list in order to search for other secrets.
Paedophiles and criminal networks involved in the sexual exploitation of minors and child pornography would “migrate” en masse to other communication channels where they would be less likely to be detected (Tor, the Dark Web, etc.). The legislation would fail to “catch the bad guys,” and law enforcement authorities would instead find themselves searching for criminal material amid a flood of false positives (innocent photos or conversations), far more than they could realistically ever verify.
Legal experts, MEPs, and specialists voice concern that the issue exploits a socially “sensitive” topic – paedophilia – as moral justification for bending and effectively nullifying the fundamental rights of 450 million citizens. As evidence, they point to precedents involving other sensitive issues, for instance, derogation measures aimed at combating illicit finance or terrorism, which began with good intentions for the common good but ended up being turned against all citizens without exception,curtailing their basic rights.
There is also the risk that various hackers or malicious actors could exploit the scanning software as a platform for unlawful facial recognition and for fishing out sensitive information.
Messenger apps with third-party participation
In 2022, Ian Levy and Crispin Robinson, both senior members of GCHQ, the British government’s intelligence, cybersecurity, and communications security agency,argued that weakening encryption also carries the risk of a malicious “Ghost Protocol.” That is, the risk that messenger apps could quietly insert government monitors as covert eavesdroppers into specific conversations or calls, while simultaneously suppressing the notification that would normally alert the user that a third party had joined the call.
In the end, it is one thing to carry out targeted surveillance of a suspect, following judicial approval, when there are reasonable grounds implicating them or when an independent court confirms that intercepting their communications is justified. But it is something else entirely, and unlawful, to preemptively monitor everyone, without exception.
