Chat Control: could the State read your private messages?

Imagine that, before a letter reached its recipient, someone opened it to check whether its contents were illegal. A similar dilemma lies at the heart of the controversy surrounding the so-called Chat Control, a European Union initiative aimed at strengthening the fight against child sexual abuse online, but which raises questions about the future of the confidentiality of digital communications.

At first glance, the objective seems difficult to dispute. Protecting children from sexual abuse and exploitation is an unequivocal priority, and digitalisation has facilitated the circulation of this type of content, making its detection and prosecution more complex.

However, to understand the debate, it is important to consider the legal framework.

What does the ePrivacy Directive say?

The general rule stems from the 2002 ePrivacy Directive, which protects the confidentiality of electronic communications.

In simple terms, the directive establishes that the content of private communications — such as instant messages, emails or calls — cannot be monitored or processed by service providers, except in circumstances provided for by law.

The principle is clear: citizens' communications are private.

In 2021, however, the European Union adopted Regulation (EU) 2021/1232, creating a temporary derogation from some of these rules.

This regulation did not remove the protection afforded by the ePrivacy Directive, but it allowed certain providers of electronic communications services, such as messaging or email platforms, to voluntarily use technologies designed to detect content related to child sexual abuse and report suspected cases to the competent authorities.

This transitional regime was recently extended while negotiations continue on a proposal for a permanent regulation, commonly referred to as Chat Control 2.0. Its content continues to generate intense debate among European institutions, Member States, experts and civil society organisations.

Could my messages be read?

In light of this situation, many citizens are asking an inevitable question: could my messages be read?

The answer is not entirely straightforward.

Under the current regime, detection is generally carried out using automated technologies, many of them based on artificial intelligence, which seek to identify images, videos or patterns associated with child sexual abuse.

The aim is not to allow people to indiscriminately read private messages, but rather to enable the use of automated systems capable of flagging potentially illegal content.

Only when something is flagged may a subsequent analysis take place to determine whether the content is in fact illegal.

Nevertheless, for many experts, even automated analysis constitutes a form of interference with private communications.

The concern is that, once a technological infrastructure capable of analysing messages has been created, there may be a temptation in the future to expand its use to other types of content or offences.

What happens to encrypted messages?

The debate becomes particularly sensitive when it concerns applications that use end-to-end encryption, such as WhatsApp or Signal.

This system ensures that only the sender and recipient can access the content of messages, making it one of the main safeguards for privacy and digital security today.

It is precisely at this point that a significant part of the discussion surrounding the future regulation is focused.

Some argue that more effective detection will require technical solutions that could affect the way end-to-end encryption works.

Others maintain that any measure that reduces this protection could compromise not only users' privacy, but also the security of digital communications in general.

What will happen to Chat Control?

Negotiations on the so-called Chat Control 2.0 are continuing in Brussels, and there is still no consensus on a definitive solution.

Until then, the transitional regime remains in force, allowing platforms to voluntarily adopt detection mechanisms under the derogation created from the ePrivacy Directive framework.

Protecting children is an absolutely unquestionable objective. The real challenge is to find a balance between the need to effectively combat one of the most serious crimes of our time and the preservation of another principle that is equally essential in a democratic society: the right to the confidentiality of private communications.