The official name
"Regulation laying down rules to prevent and combat child sexual abuse" — that's the official title. Abbreviated: CSAR. Everyone calls it Chat Control.
What the law demands
Mandatory scanning
All messengers, email providers, and cloud storage must scan for "known and new" abuse content. WhatsApp, Signal, Telegram, Gmail, ProtonMail, iCloud — all of them.
Client-side scanning
The AI runs on your device. Before your message is encrypted, the software analyzes the content. End-to-end encryption is bypassed because the surveillance happens before encryption.
Everything gets scanned
Not just text. Images, videos, voice messages, files — everything. The AI searches for known abuse images (hash matching), new abuse images (AI detection), and "grooming" conversations (text analysis).
Anonymous reporting
If the AI finds a "hit," a report goes to an EU center. You are not notified.
Who supports it?
- EU Commission (Ylva Johansson)
- Spain, Ireland, Hungary
- Child protection organizations (NCMEC, ICMEC)
Who's against it?
- 700+ IT scientists (open letter)
- Edward Snowden
- Signal (would leave the EU rather than comply)
- WhatsApp (also against scanning)
- Germany, Austria (EU Council)
Current status
First draft
EU Commission introduces CSAR. Massive backlash.
EU Council blocks
Germany, Austria vote against.
New attempt
Revised draft. "Only" known material.
Negotiations
Details being negotiated. Messengers preparing.
Even if the law is "only" for known content: the technology built for it can be used for everything else. Terrorism. "Hate speech." "Disinformation." The infrastructure stays — the reasons change. That's called function creep.