Chat Control 1.0 permits scanning. Chat Control 2.0 would require it. That is the whole difference — and it is a large one.
“Chat Control 2.0” is the informal name for the permanent EU Chat Control regulation, CSAR (the EU proposal to prevent and combat child sexual abuse). Where 1.0 makes voluntary scanning legal until 2028, 2.0 would put a lasting framework in its place — and in its most contested form, make detection mandatory.
1.0 versus 2.0, in plain terms
- Chat Control 1.0 — temporary; permits providers to voluntarily scan content they can read; in force until 2028.
- Chat Control 2.0 (CSAR) — permanent; in its contested form would mandate detection orders, potentially requiring client-side scanning that inspects content on your device before it is encrypted.
- The sticking point — mandatory detection orders and client-side scanning are exactly what repeated negotiations have failed to agree on.
Where it stands
The permanent regulation is still being negotiated between the Parliament, the Council and the Commission. The fifth trilogue collapsed on 29 June 2026 without agreement, and negotiations are expected to continue under the Irish Presidency from around September 2026. The mandatory-scanning provisions remain the main obstacle. The timeline and final text are genuinely unsettled — anyone who tells you the outcome is decided is guessing.
Client-side scanning is the part to watch. It does not break end-to-end encryption — it bypasses it, by reading your content on your own device before encryption happens.
Why 2.0 does not reach uOS
A detection order can only compel what a provider is able to read. uOS holds no plaintext: content is encrypted end-to-end on your device, the server stores only ciphertext, and there is no server-side key and no password database. There is nothing on our side for a detection order to be served against.
Client-side scanning is the harder question, because it targets the device rather than the server. Our answer is architectural honesty: uOS does not run scanning code against your content, and a web operating system whose whole design is that it cannot read your data would have to abandon that design to comply. We are built the other way.