Chat Control 1.0 returns, encryption stands, builders must act

The EU reinstated Chat Control 1.0 until April 2028, allowing Big Tech to scan private messages, but end-to-end encryption is protected, Nordic builders must decide tonight how to harden their stacks.

NEW DEVELOPMENT The EU’s temporary ePrivacy derogation expired on 4 April 2026. On 3 August 2026, it was reinstated until 3 April 2028. The derogation allows companies like Meta and Google to voluntarily scan users’ private messages for child sexual abuse material. The method and scope are left to the companies. This is Chat Control 1.0 returning. ENCRYPTION PROTECTED The Parliament’s amendments AM30 and PC3 survived. They protect end-to-end encrypted interpersonal communications, including against client-side scanning. Services like Signal, Threema, and WhatsApp with E2EE are explicitly excluded. The derogation does not order scanning; it only permits it. WHAT CHANGES The derogation is temporary, but the infrastructure for scanning is now legal again. Companies can build it, and future legislation may make it mandatory. The EU Centre on Child Sexual Abuse will coordinate detection technology, and confirmed cases will be forwarded to Europol and national police. WHAT BUILDERS MUST DO Nordic builders must decide how to respond to the return of Chat Control 1.0. The network must choose between: 1. Accepting the derogation as is, building on foreign platforms, and accepting the risk of future mandatory scanning. 2. Hardening Nordic stacks to ensure encryption remains unbreakable, even if the derogation expands. 3. Building local alternatives to foreign platforms, ensuring Nordic data stays in Nordic hands. 4. Waiting for the next legislative fight, accepting the status quo until April 2028. The derogation is temporary, but the precedent is set. The next fight is over Chat Control 2.0, which may make scanning mandatory. The network must act tonight to decide how to prepare.

researched · 2 sources

4 Augreaches everyone