Weakened EU ‘Chat Control’ moves forward with voluntary scanning

EU member states have expressed broad support for a new compromise on the controversial “Chat Control” law, moving away from mandatory content scanning in favor of a voluntary framework.

The latest draft, tabled by the Danish EU Council Presidency, was discussed on November 5, 2025, in a closed-door session of the Committee of Permanent Representatives (Coreper).

According to a classified meeting protocol obtained by Netzpolitik, representatives from across the bloc broadly endorsed the Danish proposal, which now centers on permanently allowing voluntary scanning by service providers. No member state opposed the compromise, though many expressed regret over the abandonment of compulsory detection provisions.

The original ‘Chat Control’ regulation, proposed by the European Commission in May 2022, sought to obligate online platforms, such as hosting services and messaging apps, to detect and report child sexual abuse material (CSAM), as well as online grooming attempts. It also proposed the creation of an EU Centre to support investigations and coordinate with national authorities. While intended to strengthen child safety online, the regulation sparked a fierce backlash due to its potential to undermine end-to-end encryption and enable mass surveillance.

Efforts to mandate scanning faced repeated opposition from member states, including Germany, the Netherlands, and Austria, particularly over legal concerns and encryption risks. A decisive vote scheduled for October 14, 2025, failed to pass, effectively stalling the legislative process. In response, Denmark proposed stripping the detection obligation entirely while preserving other structural elements, such as the EU Centre and risk-based provider categorization.

The current temporary framework permits voluntary scanning, and under the new proposal, this would be made permanent. The document also clarifies that providers offering high-risk services may still be expected to develop and apply mitigation measures in cooperation with the EU Centre, but without a legal obligation to scan content.

Germany, which had previously opposed mandatory scanning, has now recommended supporting the Danish proposal, with officials advising that no further changes be made to the compromise text. The Dutch position remains unchanged, rejecting scanning mandates, but the broader consensus now appears to favor codifying the current voluntary status quo to avoid a legal vacuum when the interim rules expire in April 2026.

Civil society organizations and privacy advocates continue to warn that even voluntary measures can lead to de facto mandates, especially if paired with risk categorization and reporting requirements. Concerns persist that service providers might feel coerced into scanning content to avoid regulatory scrutiny or reputational harm.

The upcoming meeting of the Council’s law enforcement working group will explore the new ‘Chat Control’ draft in further detail, potentially setting the stage for a partial negotiation mandate with the European Parliament. A formal trilogue process may begin thereafter, though detection obligations, now sidelined, could re-enter the legislative debate under a future review clause.