If a company can read it, Chat Control 1.0 lets them scan it — legally, in the EU, until 2028.
On 9 July 2026 the European Parliament voted 314 against and 276 in favour of extending Chat Control 1.0 — and it passed anyway, because rejecting it at second reading required an absolute majority the opposition never reached. Voluntary scanning of private content is therefore legal in the EU until 2028, on services such as Gmail, Facebook Messenger, Snapchat and Skype.
The rule, in one sentence
Chat Control 1.0 does not target "messengers". It permits the scanning of content a provider is able to read. The question is not which app you use — it is whether anyone other than you can read what is inside it.
Where you are in scope
Anywhere your content sits on a server in a form the provider can open. That includes, by design:
- Your mail — Gmail, Outlook and the like hold your messages in a form they can read.
- Your chats on non-encrypted services — Facebook Messenger, Snapchat, Skype were named in the extension.
- Your files and photos — cloud drives and photo libraries that are not end-to-end encrypted.
- Your documents and calendar — anything stored in plaintext on someone else's machine.
Where you are not
Anywhere the provider holds only ciphertext. If the service genuinely cannot read your content, there is nothing on its servers to scan — not as a policy, as a fact. That covers end-to-end encrypted messaging (Signal, and WhatsApp for message bodies), end-to-end encrypted mail and storage (Proton, Tuta, uOS), and any service built the same way.
The blind spot most people have
Almost everyone who reacted to Chat Control did the same thing: they changed messenger. It is a good instinct, and it protects the smallest surface they own. Their mail, their files, their photos and their calendar — the large majority of their digital life, and the part that actually documents it — usually stay exactly where they were: readable, and now legally scannable until 2028.
Switching messenger protects your messages. It does not move your mail, your files or your photos out of scope. Most people are protected on the small surface and exposed on the big one.
What Chat Control 2.0 would change
The permanent regulation (CSAR, "Chat Control 2.0") is still being negotiated. In its most contested form it would require even end-to-end encrypted services to detect known material — which, for an encrypted service, can only mean scanning on your own device, before encryption. That is client-side scanning, and it is a backdoor by construction. It is not law: the fifth trilogue collapsed on 29 June 2026 over exactly this, and a sixth round is expected under the Irish Presidency around September 2026.