Ministers around the table of the Justice and Home Affairs Council, Luxembourg, 5 June 2026. Photo: Council of the EU, © European Union, 2026 (cropped).
Since 2023 the Council’s own Legal Service has told ministers the same thing: ordering the scanning of everyone’s private messages will not survive the EU Charter. The answer was not to drop scanning. It was to rename it.
This is the sixth piece in our Who Decides? series, and it is about a group of lawyers nobody elected and few readers have heard of.
Every EU institution keeps lawyers in the house. The Council’s are called the Legal Service. They do not vote and they do not negotiate. Their job is to tell the 27 governments whether a text will hold up in court. Their opinions are normally stamped LIMITE, which keeps them away from the public, and ministers are free to ignore them.
On Chat Control they have not been ignored so much as worked around. Three times in three years the Legal Service has looked at the plan to scan private messages for child sexual abuse material. Three times it has said the same thing. The response has been to change the wording, not the substance.
April 2023: “general and indiscriminate”
The first opinion is dated 26 April 2023 and numbered 8787/23. It carries the LIMITE stamp and a footnote warning against unauthorised publication. It became public within weeks anyway, through digital rights groups and netzpolitik.org, and today the Council’s own register serves it with a PUBLIC stamp on top. It is 27 pages long and it is worth reading.
The Commission’s proposal would have let courts order a messaging service to scan all its users’ communications. The Legal Service said that such a detection order “would require the general and indiscriminate screening of the data processed by a specific service provider, and apply without distinction to all the persons using that specific service, without those persons being, even indirectly, in a situation liable to give rise to criminal prosecution” (paragraph 78).
It went further than proportionality. The regime, it wrote, “entails a serious risk that it would be found to compromise the essence of the rights to privacy and data protection enshrined in Article 7 and 8 of the Charter” (paragraph 58). In Charter language, “the essence” is the line no law may cross, whatever the aim.
Three more findings matter for what came next.
On encryption: scanning content in an encrypted service would mean “(i) abandoning effective end-to-end encryption or (ii) introducing some form of ‘back-door’ to access encrypted content or (iii) accessing the content on the device of the user before it is encrypted (so-called ‘client-side scanning’)” (paragraph 50). Any of these would “create a stronger interference with the fundamental rights concerned” (paragraph 51).
On age checks: detecting grooming would “necessarily require age assessment/verification generalised to all users of the service concerned”, by mass profiling, biometric analysis or digital identification, adding “another layer of interference” (paragraph 52). That is the same question we followed in Prove your age: who decides what you must show to get in?
On the technology: the proposal never defined what “sufficiently reliable detection technologies” meant or what error rate would be acceptable, and left compliance with fundamental rights “to a very large extent to the service provider” (paragraph 22).
The advice at the end was plain. If the Council wanted to keep private communications in the law at all, the regime “should be targeted in such a way that it applies to persons in respect of whom there are reasonable grounds to believe that they are in some way involved in, committing or have committed a child sexual abuse offence” (paragraph 79). Suspects, not everyone.
November 2025: the word that changed the law
For two and a half years the Council could not agree on how to answer that. Then the Danish presidency found a way out. In a compromise text dated 6 November 2025 (document 14092/25) it proposed removing the detection obligations, Articles 7 to 11, from the draft altogether, and keeping instead the “voluntary activities” that providers already carry out under the temporary exemption from the ePrivacy rules. On 26 November 2025 the Council adopted that as its negotiating mandate: “providers of messaging services, for instance, may voluntarily check content shared on their platforms for online child sexual abuse material.” The temporary exemption, due to expire on 3 April 2026, was to be made permanent.
No order, no court, no state. Just permission. The Legal Service’s objection had been built around what public authorities may impose. Take the authority out of the sentence and the objection loses its target.
What did the lawyers say about that? Internal minutes of the working party of 12 November 2025, published by netzpolitik.org, record three answers. The exemptions may be applied where a legal basis exists. Nothing obliges a provider to take any particular measure, but the wording can be read both ways. And nothing in the text prohibits providers from taking measures inside end-to-end encrypted communications, which the lawyers described as no change to current law.
Read that last point twice. The presidency text says nothing in it “should be interpreted as prohibiting, weakening or circumventing end-to-end encryption”. The lawyers’ reading is that nothing in it stops a provider from scanning inside an encrypted service either. The “voluntary” model does not settle the encryption question. It hands it to the provider.
2026: the objection that will not go away
The trilogues with Parliament began in December 2025 and ran through the spring. Parliament’s line was the one the Legal Service had sketched in 2023: mandatory detection only as a last resort, against people a judge has named, with reasoned suspicion. The Council’s line was purely voluntary detection.
The lawyers were asked again. Council minutes of 21 May and 10 June 2026, published by netzpolitik.org on 12 June, record that their concerns about detection orders were not resolved, because the text still meant general searching in interpersonal communication. An objective, sufficient link to abuse material was required, and that judgement could not be delegated to service providers. Voluntary searching in public areas of a service, they added, was unproblematic.
So the Legal Service now rejects Parliament’s targeted orders as still too broad in the way they are drafted, and has no objection to voluntary scanning of public content. On voluntary scanning of private messages it has said only that a legal basis makes it possible. That is the whole legal landscape the negotiators are standing on.
On 29 June the negotiating round ended. Parliament’s team announced “compromises on almost the entire Regulation” and named the open question: detection. We covered that room in Five trilogues, no deal: who decides Chat Control 2.0?
Ten days later the voluntary model won the first real vote. On 9 July Parliament, at second reading, could reject or amend the Council’s temporary law only by an absolute majority of all MEPs. The motion to reject got 314 votes, 276 against, 17 abstentions. Short. Parliament amended instead, excluding “communications to which end-to-end encryption is, has been or will be applied”. The Council accepted the amendments on 23 July and added, in its own press release, that the encryption exclusions in the interim law “do not imply” acceptance of the same limit in the permanent one. Regulation (EU) 2026/1881 has been in force since 31 July. It runs until 3 April 2028.
So who decides?
Follow the chain. The lawyers say the state may not order the scanning of everyone. Parliament wants orders against suspects, and the lawyers say even that is drafted too broadly. The Council says: let the companies volunteer.
Which means the decision about whether your private messages are scanned is no longer made by a minister or a judge. It is made by a provider’s trust-and-safety team, under its terms of service, on a legal basis that says it may. Nobody has to authorise it. Nobody has to justify it to you. The Legal Service was asked whether the state can do this. It was not asked whether a company should, because that is not a question the Charter puts to companies.
The sixth negotiating round is planned for 29 September under the Irish presidency, according to Council minutes published by netzpolitik.org; the institutions have not announced it. Three things will tell you what was decided. Whether “voluntary” comes with the encryption exclusion Parliament won in July, or without it, as the Council’s mandate has it. Whether Parliament’s suspect-based orders survive in any form. And whether anyone puts the Legal Service’s view on the record, in public, before the vote.
We keep the status on the EU Chat Control Tracker, updated within 24 hours of every development. Part four of this series: When a No is not enough: who decides Chat Control this autumn?
Sources
- Council Legal Service, opinion 8787/23 of 26 April 2023, Council register (PDF)
- Council presidency compromise text 14092/25 of 6 November 2025, published by netzpolitik.org (PDF)
- netzpolitik.org, 18 November 2025: Interne Dokumente: EU-Staaten einigen sich auf freiwillige Chatkontrolle
- Council of the EU, 26 November 2025: Council reaches position on law protecting children from online abuse
- netzpolitik.org, 12 June 2026: Interne Dokumente: Trilog zur Chatkontrolle geht in entscheidende Phase
- European Parliament, 29 June 2026: Statement by the EP negotiating team
- European Parliament, 9 July 2026: Support for a more limited ePrivacy derogation
- Council of the EU, 23 July 2026: Interim measure protecting children now reinstated
- Regulation (EU) 2026/1881, EUR-Lex
Update, 5 September 2026: an earlier version of this article said no date had been published for the sixth round. Council minutes published by netzpolitik.org on 2 July put the political trilogue on 29 September 2026.
