On October 14, 2025, the EU Council will decide on client-side scanning of private chats – criticism regarding data protection and fundamental rights is growing
EU member states are once again negotiating the “Regulation to Prevent and Combat Child Sexual Abuse” (CSAR). The next round of discussions is scheduled for September 12, 2025, followed by the final vote in the EU Council on October 14. The goal is to require messaging and hosting services such as WhatsApp, Signal, or Telegram to scan private communications for abusive content even before encryption.
Client-Side Scanning – Checking Before Encryption
The plan is to implement so-called client-side scanning: content would be scanned directly on the device before being encrypted end-to-end. This could require providers to scan even private messages or photos and, if suspicious, forward reports to the authorities.
Criticism from privacy advocates and experts
Critics such as the Federal Commissioner for Data Protection and Freedom of Information (BfDI), Prof. Dr. Louisa Specht-Riemenschneider, view the regulation as a massive encroachment on fundamental rights. While child protection is an important goal, they argue that the proposal represents “a step toward unwarranted mass surveillance.” The European Data Protection Board (EDPB) and the European Data Protection Supervisor (EDPS) also warn that the risks to citizens are greater than those to criminals.
Companies such as the German email provider Tuta have also expressed concerns: They argue that unreliable AI models could expose private conversations, thereby jeopardizing both users’ privacy and the security of encrypted communications.
The political sensitivity of the decision
Whether the regulation is adopted depends heavily on Germany and France, which have not yet taken a clear stance. Austria, on the other hand, has spoken out clearly against chat monitoring. For the proposal to be adopted, at least 15 of the 27 EU member states must approve it, representing 65 percent of the EU population. A so-called blocking minority of four countries, representing more than 35 percent of the population, could prevent the regulation from passing.
Conclusion: The tension between child protection and digital freedom
The debate over chat monitoring exemplifies the conflict between security interests and data protection. On the one hand, there is a push to better protect children from online abuse; on the other, the privacy of digital communications is at stake. Whether the EU can strike a balance between protection and surveillance will be decided on October 14, 2025.