Chat Control Explained: The EU's Chat Monitoring Legislation vs. Encryption Privacy

What is Chat Control?

"Chat Control" is the colloquial name for a series of EU legislative proposals aimed at combating online child sexual abuse material (CSAM). The policy's goal appears legitimate—protecting minors from online sexual exploitation—but its implementation methods have sparked widespread controversy among the tech community, privacy advocates, and legal experts.

The online distribution of CSAM is a massive and worsening global problem. According to data from the U.S. National Center for Missing & Exploited Children (NCMEC), in 2022 alone, platforms worldwide submitted over 32 million related reports—a figure that has grown roughly 50-fold over the past decade. Interpol's "Project Childhood" and joint investigations by Europol reveal that the distribution networks for such content rely heavily on end-to-end encrypted platforms and the dark web. This is precisely the direct backdrop against which EU law enforcement agencies have continuously pressured encryption technology and pushed for Chat Control legislation.

At the heart of the controversy: in order to detect illegal content, the relevant regulations may require communication service providers to conduct large-scale scanning of users' private messages, potentially even bypassing the protection of end-to-end encryption (E2EE). End-to-end encryption is a communications security mechanism in which messages are encrypted on the sender's device and can only be decrypted on the recipient's device—the service provider's servers merely relay the encrypted "ciphertext" and cannot read the content themselves. Mainstream messaging apps such as Signal, WhatsApp, and iMessage all use this technology. Its mathematical foundation is typically an asymmetric key system, exemplified by the Elliptic Curve Diffie-Hellman (ECDH) key exchange—a protocol that allows two communicating parties to negotiate a shared key known only to themselves over an insecure channel, without exchanging any secret information beforehand.

The Signal protocol goes further by introducing the "Double Ratchet" algorithm to achieve Forward Secrecy. Designed by Moxie Marlinspike and Trevor Perrin in 2013, this algorithm combines two independent key "ratchet" mechanisms: an asynchronous ratchet based on Diffie-Hellman key exchange, responsible for updating the root key between conversation rounds; and a symmetric key ratchet that generates a unique key for each message within the same round. This design ensures that even if an attacker intercepts a session key at a given moment, they cannot decrypt previously sent messages (forward secrecy), nor can they derive the keys for future messages (post-compromise security / Break-in Recovery). It is precisely this mathematical "one-time key" characteristic that makes server-side scanning fundamentally infeasible—even if a server is compromised, attackers cannot reconstruct historical communications. Its security has been rigorously validated by decades of cryptographic research. This means that private communications originally readable only by the sender and recipient could be examined one by one by automated systems before or after transmission.

To make sense of this debate, we need to distinguish between two distinct phases of Chat Control: the temporary version 1.0, and the more controversial version 2.0 proposal.

Chat Control 1.0: Temporary Authorization for Voluntary Scanning

Chat Control 1.0 refers to a temporary regulation (Temporary Derogation) passed by the EU in 2021. At the time, once the relevant rules of the EU's ePrivacy Directive took effect, they theoretically restricted service providers' authority to proactively scan users' communications content.

The Core Mechanism of 1.0

The keyword for version 1.0 is "voluntary." It provided a legal exemption for platforms such as Meta (Facebook Messenger, Instagram) and Google, allowing them to voluntarily scan users' messages, images, and videos to detect known CSAM content and potential "grooming" behavior.

The mainstream technology for detecting known CSAM is perceptual hashing—generating a unique digital "fingerprint" for known illegal images. A representative tool is PhotoDNA, jointly developed by Microsoft and Dartmouth College. Perceptual hashing differs fundamentally from traditional cryptographic hashing (such as SHA-256): the latter requires that any tiny change in input produces a completely different output (the avalanche effect), whereas perceptual hashing is designed to produce similar hash values for visually similar images. PhotoDNA was jointly developed by Microsoft Research and Dartmouth College in 2009, originally created to help NCMEC combat CSAM. Its core principle is to convert an image to grayscale, resize it to a fixed resolution, and extract a "visual fingerprint"—a design that allows it to still recognize matches even for images that have been slightly cropped, compressed, or color-adjusted. However, the "similar content produces similar hashes" characteristic of perceptual hashing also introduces security risks: researchers have demonstrated that adversarial examples techniques can be used to generate images visually nearly indistinguishable from the original illegal content but with completely different hash values to evade detection ("evasion" attacks); conversely, one can also construct images visually indistinguishable from legitimate content but whose hash values collide with the database ("poisoning" attacks). NCMEC (the U.S. National Center for Missing & Exploited Children) maintains a database of hashes of known CSAM, and platforms perform detection by comparing against this database—a technology that has been in operation in the industry for years.

The original intent of this temporary measure was to fill a legal gap, allowing tech companies to continue the content detection work they had already been performing. In other words, 1.0 did not compel all platforms to participate but rather gave a "green light" to those willing to scan.

However, the inherent limitations of perceptual hashing technology also planted a hidden risk here: it can only identify "known" illegal content and is powerless against newly generated material—which is precisely the direct reason Chat Control 2.0 sought to introduce AI classifiers.

The Origin of the Privacy Controversy

Even the "voluntary" version, Chat Control 1.0, raised privacy concerns. Critics pointed out that automated scanning systems have a non-negligible false-positive rate, potentially mislabeling innocent family photos or private conversations as illegal content and forwarding them to law enforcement for review. This logic of "scanning everyone in advance" fundamentally conflicts with the traditional legal principle of "investigating only upon reasonable suspicion."

Chat Control 2.0: The Controversial Escalation from Voluntary to Mandatory

If 1.0 was a temporary, limited authorization, then Chat Control 2.0 (officially named the "CSA Regulation," i.e., the proposed Regulation on Combating Child Sexual Abuse) represents a fundamental escalation—attempting to shift scanning from "voluntary" to "mandatory" enforcement under certain circumstances.

Mandatory Detection Orders

The most controversial part of the 2.0 proposal is the "detection order" mechanism. According to the proposal, competent authorities can issue orders to communication service providers requiring them to scan user communications to detect both known and unknown CSAM, as well as grooming behavior.

This means scanning would no longer be a platform's own choice but could be legally mandated. Particularly thorny is the requirement to detect "unknown" content and grooming behavior—the former relies on AI classifiers, the latter requires AI to analyze the semantics of conversation text. Both are far more complex than comparing hash values of known content, and the risk of false positives is far higher. Compared to the deterministic matching of perceptual hashing, machine learning classifiers are difficult to subject to independent auditing in real-world scenarios; their decision-making processes lack transparency, and once a false positive occurs, it may cause irreparable harm to wrongly flagged innocent users.

Client-Side Scanning: The Greatest Threat to Encryption Protection

The fiercest debate sparked by 2.0 centers on its potential threat to end-to-end encryption. Since E2EE communications (such as Signal and WhatsApp) cannot be read on the server side, mandatory scanning has, technically, only one viable path: Client-Side Scanning (CSS)—that is, checking content directly on the user's device before the message is encrypted and sent.

In 2021, Apple introduced a CSAM detection mechanism called NeuralHash, which was a real-world experiment in client-side scanning. Its design was that before a user uploaded a photo to iCloud Photos, the device would locally compare the photo's perceptual hash against the NCMEC database; if matches exceeded a certain threshold, an encrypted "voucher" would be generated and uploaded to Apple's servers, and human reviewers would decide whether to report. However, security researchers demonstrated hash collision attacks against NeuralHash within just days of its release, pointing out that the entire architecture essentially built infrastructure on user devices capable of remotely updating a "surveillance target library"—the target database that scanning relies on could be silently expanded at any time via server-side updates, and users and third-party auditors had virtually no reliable means to monitor whether its content had changed. Apple announced in December of that year that it was indefinitely shelving the plan, and this incident has become the most persuasive real-world case in the debate over the feasibility and security of client-side scanning technology.

CSS typically has two implementation paths: one is embedding a scanning module at the operating system level (like the Apple scheme mentioned above), and the other is requiring app developers to embed detection logic within the app. Both approaches face the same core problem: the "illegal content database" that scanning relies on must be stored on the device or be accessible at detection time. Once this database is obtained or tampered with by malicious actors, the entire system can be weaponized—it could be used to fabricate false positives to frame the innocent, or to track specific legitimate content. The cryptography community summarizes this problem as the "trusted third party paradox": any security mechanism that requires a third party to function has an upper security limit equal to the trustworthiness of that third party.

It is worth noting that the cryptography community once devoted exploratory attention to an alternative technical path called Zero-Knowledge Proof (ZKP). ZKP allows a user's device, after completing hash comparison locally, to generate a cryptographic proof to the server demonstrating that "this message does not contain known CSAM content" without transmitting the message content or any identifiable information off the device. Stanford cryptographers such as Dan Boneh conducted preliminary theoretical exploration of this. However, the computational latency and processing power required to generate complex ZKPs on mobile devices mean it remains far from practical deployment. The very existence of this technical path reveals a structural flaw in the current policy debate: legislators often rush to lock in regulatory frameworks before technical solutions have matured, and prematurely rigid legal texts may exclude future technical solutions that better balance privacy and security.

Cryptography experts are almost unanimously opposed. In 2021, 14 cryptography and security experts from top institutions such as MIT and Stanford jointly published the paper Bugs in our Pockets, with an author lineup that included Ron Rivest, one of the inventors of the RSA algorithm, whose academic endorsement carries considerable weight in the cryptography community. The paper systematically argued the four core risks of CSS: the scanning database itself becomes a high-value attack target, the system can be hijacked by state actors for political censorship, covert scope-expansion is virtually impossible for outsiders to detect, and false positives cause irreversible harm to innocent users. The paper's core conclusion: there is no backdoor that only "good guys" can access; any technical entry point left for law enforcement will equally be exploited by malicious attackers. In the experts' view, client-side scanning essentially plants a "backdoor" or surveillance component in everyone's device. The encrypted messaging app Signal even publicly stated that if forced to implement client-side scanning, it would rather withdraw from the relevant market.

Why This Debate Matters So Much

The Fundamental Tension Between Privacy and Security

The essence of the Chat Control controversy is an unavoidable contradiction of the digital age: how to balance the legitimate goal of protecting vulnerable groups such as children against the imperative of preserving the communications privacy and encryption security of all citizens.

Supporters argue that in the face of rampant online child sexual exploitation, platforms cannot "stand idly by" using privacy as an excuse. Opponents emphasize that the cost of breaking encryption is making everyone's communications less secure, and this cost is often borne by ordinary users, while the real criminals may simply move to more covert channels.

Furthermore, in discussions of Chat Control, content scanning attracts the vast majority of attention, while the surveillance potential of communications metadata is often underestimated. Metadata refers to data describing the communication behavior itself—including the identity markers of both parties, message timestamps, communication frequency, recipient geographic location, device identifiers, and so on, but not the actual content of the messages. Former U.S. National Security Agency Director Michael Hayden once candidly stated: "We kill people based on metadata." This statement bluntly reveals the practical value of metadata in intelligence analysis. In 2013, Stanford University's research project "MetaPhone" analyzed cell phone metadata from recruited volunteers and, based on call records alone, was able to infer volunteers' medical conditions, financial distress, and religious beliefs with high accuracy. Chat Control-related regulations similarly contain provisions requiring platforms to retain and submit communications metadata. Even if content scanning is ultimately scaled back due to opposition from various parties, the metadata retention mechanism could still constitute a separate surveillance infrastructure, and its impact on ordinary users is often more lasting and far-reaching.

It is worth noting that the European Data Protection Board (EDPB) has repeatedly expressed opinions on this, arguing that mandatory scanning schemes would struggle to pass the proportionality principle review under the GDPR. This principle has deep constitutional roots in the EU legal system, running throughout the EU treaties and Article 52 of the Charter of Fundamental Rights of the European Union. The Court of Justice of the European Union (CJEU) typically applies a three-step test when assessing measures that restrict fundamental rights: whether the measure is suitable for achieving its claimed legitimate objective (suitability); whether it is the least rights-restrictive of the many means capable of achieving the same objective (necessity); and whether, even if necessary, the harm to rights is manifestly disproportionate to the public interest pursued (proportionality in the narrow sense). The EDPB, in its opinions, specifically pointed out that indiscriminate preventive scanning of all users is difficult to pass at the "necessity" hurdle: because it does not target specific subjects for whom reasonable suspicion exists, but rather presumes every user to be a potential suspect, in clear conflict with the surveillance legality precedents established by the European Court of Human Rights in cases such as "Szabo and Vissy v. Hungary." The European Court of Human Rights also confirmed in the 2021 "Big Brother Watch v. UK" case that mass communications surveillance programs lacking adequate judicial oversight mechanisms may violate Article 8 (right to privacy) of the European Convention on Human Rights—that is, the means must not restrict fundamental rights beyond what is necessary to achieve the objective.

The Twists and Divisions of the Legislative Process

The legislative process for Chat Control 2.0 has been fraught with setbacks. Due to significant divisions among member states, votes have been repeatedly postponed or failed to reach consensus. Countries such as Germany hold reservations about mandatory scanning—this has a constitutional basis: the German Federal Constitutional Court established the "IT fundamental right" (IT-Grundrecht) in 2008, explicitly listing the integrity of data on personal devices as a fundamental right, and this precedent provides domestic legal support for Germany's conservative stance in the negotiations. Other countries advocating stronger regulation continue to push for acceleration. This back-and-forth precisely illustrates that even within the EU, there is far from a consensus on how to strike the balance between surveillance power and privacy boundaries.

Takeaways for Ordinary Users

Ordinary users concerned about digital privacy can distill several important takeaways from this debate.

End-to-end encryption is not an absolute defense. Once the law mandates client-side scanning, even encrypted apps may be forced to check content on the device, greatly diminishing the sense of security that "encryption" provides.

Beware the risk of "function creep." Function creep describes the phenomenon whereby a technical infrastructure is gradually expanded in use beyond its original design purpose, and it is particularly typical in the field of surveillance technology. History offers many precedents: the U.S. "PRISM program," established under the Patriot Act in the name of counterterrorism, was later revealed by Snowden to operate far beyond its authorized scope, including routine eavesdropping on the communications of allied leaders; the UK's Investigatory Powers Act 2016, colloquially known as the "Snooper's Charter," granted over 48 government agencies the power to access communications metadata without a warrant, with users even including the Food Standards Agency; facial recognition systems in multiple countries have expanded from airport security checks to routine surveillance on city streets. From a technical architecture perspective, the function-creep risk of client-side scanning systems is especially pronounced: once the technical infrastructure to "scan every message" is in place, expanding the scope of surveillance becomes merely a policy decision rather than a technical obstacle—updating scanning targets (expanding from a CSAM hash database to political dissent content or copyrighted material) requires only modifying the server-side database configuration, without any change to the scanning module on end devices. Once the code logic of the scanning module itself is deployed to user devices, the "target database" it compares against can be expanded at any time via silent server-side updates, and end users and third-party auditors have virtually no reliable means to monitor whether the database content has changed. A detection system targeting CSAM today may be used for other purposes tomorrow.

EU legislation has a global demonstration effect, but the other edge of this "double-edged sword" is equally not to be ignored. The GDPR, which took effect in 2018, forced companies worldwide to redesign their data processing workflows and directly gave rise to numerous similar pieces of legislation such as Brazil's LGPD and California's CCPA, profoundly reshaping the global data protection landscape. The ultimate direction of Chat Control could likewise become a reference for other regions to emulate or to guard against. On this geopolitical dimension, mass communications scanning infrastructure established by democratic regimes carries a hidden risk known as the "paradox of democratizing authoritarian technology": China's Cybersecurity Law and Data Security Law have long required communications platforms to deploy content scanning, and Russia's SORM system requires telecom operators to mandatorily install Federal Security Service equipment. When the EU pushes mandatory message scanning in the name of child protection, authoritarian systems can invoke the EU precedent as an international reference for their own surveillance laws and pressure multinational tech companies: if you have already deployed scanning modules for EU compliance, there is no reason to refuse to provide equivalent technical interfaces to our authorities. This inherent contradiction becomes even more pronounced against the backdrop that the core philosophies of Chat Control and the GDPR already stand in tension: the former seeks to grant competent authorities the power to proactively access private communications, while the latter's core logic is to restrict institutions' access to personal data. This inherent contradiction itself constitutes an important prism for understanding the legislative dilemma of Chat Control.

Conclusion

Chat Control's evolution from 1.0's voluntary scanning to 2.0's mandatory detection proposal reflects a significant expansion of surveillance power. This debate has no easy answers: the goal of protecting children is beyond dispute, but the means adopted may endanger the privacy and security of every ordinary user. For technology practitioners, policymakers, and ordinary citizens alike, understanding the technical details and trade-offs involved is a prerequisite for participating in this discussion about our digital future.