Understanding Chat Control 1.0 and 2.0

Confusion often surrounds the "Chat Control" debate because there isn't just one piece of legislation—there are two distinct legal tracks moving through European Union institutions simultaneously.

This dual-track approach explains why headlines seem contradictory: one version was stopped in March 2026, yet another remains under negotiation, and the first is currently being resurrected.

---

📊 Comparison: 1.0 vs. 2.0

---

🛡️ Chat Control 1.0: The "Temporary" Measure

What is it?

This was a short-term exception to the ePrivacy Directive. It provided a legal loophole allowing service providers to scan the private messages of users—even those not under suspicion—to find Child Sexual Abuse Material (CSAM).

Key Detail: In practice, this was utilized primarily by non-encrypted US-based platforms, including Gmail, Facebook/Instagram Messenger, Skype, Snapchat, iCloud Mail, and Xbox.

While end-to-end encrypted (E2EE) chats were not scanned, the law technically permitted the deployment of client-side scanning.

Current Status

• Legal State: Expired on 4 April 2026.
• The Conflict: The European Parliament refused to extend the law.
• The Twist: The Council is now attempting a "fast-track" revival. Since they cannot extend an expired law, they are proposing a formally new law that contains the exact same content.

---

⚖️ Chat Control 2.0: The Permanent Proposal

What is it?

The CSA Regulation (CSAR) is intended to be a permanent legal framework requiring digital platforms to detect and report CSAM.

• The Council's Stance (2025): Shifted toward "voluntary suspicionless detection" combined with broad risk-mitigation duties that effectively pressure companies to scan anyway.
• The Parliament's Stance: Scanning must be targeted. It should only apply to specific individuals or groups suspected of crimes, and must be backed by a court order.

The E2EE Battle

Whether end-to-end encrypted messengers should be included remains the primary point of contention between the Parliament and the Council.

Current Status

Negotiations are stalled. After five rounds of "trilogues," no agreement was reached. The final session on June 29, 2026, collapsed specifically over the issue of suspicionless scanning. Talks continue under the Irish presidency.

---

🗺️ Visualizing the Process

---

📅 Timeline: Chat Control 1.0

The saga of the voluntary scanning regime.

• Jul 14, 2021: Regulation (EU) 2021/1232 is adopted, creating the temporary ePrivacy exception.
• Apr 29, 2024: First extension granted because 2.0 was not yet finished.
• Dec 18, 2025: The Commission suggests extending the law until April 2028.
• Mar 2, 2026: The LIBE committee rejects the extension with a vote of $38$ to $28$.
• Mar 11, 2026: Parliament proposes a compromise:
  • Extend to 2027.
  • Targeted detection only.
  • No E2EE scanning.
  • Judicial authority required.
• Mid-Mar 2026: Trilogue collapses; the Council refuses to budge.
• Mar 26, 2026: Parliament rejects the extension entirely.
  • Vote: $311$ against / $228$ in favor / $92$ abstentions.
  • Critical Moment: Amendment 34 (rejecting automated assessment of unknown media) passed by a single vote: $307$ to $306$.
• Apr 4, 2026: Law expires. Major tech firms (Google, Meta, Microsoft, Snap) claim they will continue scanning regardless of the legal status.
• Jun 26, 2026: EU ambassadors agree to resurrect the law via a "new" expedited regulation.
• Jul 2, 2026: Council adopts its position via written procedure.
• Jul 7, 2026: Parliament approves an "urgency procedure" ($331$ to $303$) to fast-track the law.

Upcoming Milestone:

• July 9: Binding vote. An absolute majority of $361$ MEPs is required to block the revival.

---

📅 Timeline: Chat Control 2.0

The struggle for a permanent mandate.

• May 11, 2022: Commissioner Ylva Johansson proposes the CSAR, including requirements to bypass E2EE.
• Nov 2023: Parliament adopts a protective mandate:
  • No E2EE scanning.
  • Detection limited to visual media.
  • Judicial warrants required.
  • No mandatory age verification.
• Oct 2025: Germany breaks the Council's deadlock by opposing mandatory suspicionless scanning.
• Danish Presidency Shift: The focus moves from "detection orders" to "risk assessment and mitigation," while attempting to make the 1.0 voluntary scanning permanent.
• Nov 26, 2025: Council endorses the Danish compromise. Critics argue this still incentivizes suspicionless detection through broad risk-mitigation duties.

---

🖼️ Conceptual Overview

💻 Logic Summary

If we were to represent the current legal tension in pseudo-code:

if law_version == "1.0":
    status = "Expired"
    if council_action == "Revive":
        status = "Urgency Procedure"
        required_votes_to_stop = 361
elif law_version == "2.0":
    status = "Trilogue"
    if parliament_position != council_position:
        status = "Deadlocked"
        issue = "E2EE_Scanning"