Javier Zarzalejos, the Parliament’s rapporteur, greets Beate Gminder, the Commission’s Director-General for Migration and Home Affairs, at the trilogue on the Child Sexual Abuse Regulation in Brussels, 29 June 2026. Photo: European Parliament, © European Union 2026, Source: EP, Laurie Dieffembacq.
The sixth political trilogue on the regulation against child sexual abuse online, the permanent law known as Chat Control 2.0, took place on 29 September 2026 at the Council, under the Irish presidency. The presidency’s overview for this week’s Justice and Home Affairs Council, Council document 13051/26, records that it was “dedicated to reaching general political agreement on detection obligations and own-initiative searches”.
The only official account so far comes from the Parliament. On 30 September it published a statement by its rapporteur, Javier Zarzalejos (EPP, Spain), welcoming an agreement on the tasks of the future EU Centre. The Council has published no outcome: the main results of the home affairs ministers’ meeting on 1 October and of the justice ministers’ meeting on 2 October do not mention the regulation.
What the Parliament confirms
According to the rapporteur, the Centre will receive reports of abuse material from providers, check that they are not unfounded and send them to the relevant authorities. It will keep a database of indicators of known material and search publicly accessible online content for known and new material itself. Its searches will be governed by safeguards, including guidelines set out with the Commission and the European Data Protection Supervisor; a fundamental rights officer will monitor its compliance, and a Victims Consultative Forum will give victims a voice. With the tasks agreed, the Commission can soon launch the selection of the Centre’s seat.
The statement does not mention detection orders. Work on the rest of the regulation, it says, continues “in a constructive spirit” with the Irish presidency.
What the press reports
Agence Europe reports that the Council presidency and the Parliament also reached an agreement in principle on detection orders for large platforms covering public content. MLex reports that the deal on public content is provisional and depends on a deal on the whole law.
Former MEP Patrick Breyer, who campaigns against the regulation and has published several of the Council’s negotiating documents, gives a fuller account. He writes that courts or administrative authorities will be able to order hosting services to scan public uploads for known material, and that such orders could reach any hosting service regardless of its size, which differs from Agence Europe’s report of large platforms. He also reports a clarification on risk mitigation, the measures providers must take to reduce the risk that their services are misused: authorities could not use those measures to force providers into voluntary scanning of private communications.
netzpolitik.org is more cautious. It reports agreement only on the EU Centre, with some points on publicly accessible content, such as images in public cloud storage or on social media, already settled. Who would issue detection orders, independent courts or administrative authorities, and which services they would cover were also negotiated, it writes.
What was not agreed
Detection in private messages and files remains open, by every account. Breyer writes that the Parliament’s negotiators refused the search plans the presidency proposed for the Council, and insisted that any scanning of private communications stay limited to people linked to child sexual abuse. Agence Europe describes private content as one of the most sensitive parts of the text, with the Parliament holding a firm position on the protection of personal data. netzpolitik.org describes the Council as wanting detection orders taken out of the law in favour of voluntary scanning, and the Parliament as wanting to keep mandatory orders as targeted as possible, without agreement yet on whether they would cover individual users, groups of users or parts of a service.
How that compares with what the Council asked
Before the round, the presidency put three questions to the ambassadors in document 13158/26 of 18 September. The first was whether to establish detection orders on publicly accessible content for known material, alongside own-initiative searches by providers in non-public content for known and new material and for the solicitation of children. The second was whether those searches would require a search plan reviewed by a national judicial or independent administrative authority, with providers obliged to use a database of indicators from the EU Centre. The third was whether, if no compromise proved as effective as today’s voluntary practice, non-public content should be left out of the regulation altogether.
If the press accounts are right, the round settled the public half of the first question and none of the private half. The third question remains open: according to Breyer, the Council still wants to keep the voluntary regime of Chat Control 1.0 in place.
The Parliament’s line has been on record since July. According to the presidency’s note 11501/26 of 7 July, its negotiators were ready to discuss detection on condition that end-to-end encrypted communication stays protected and that no general monitoring obligation is imposed, and could accept detection orders and own-initiative searches side by side if both were targeted and came with safeguards.
What does not change
Voluntary scanning of private messages remains legal. Regulation (EU) 2026/1881, Chat Control 1.0, allows providers to scan messages that are not end-to-end encrypted until 3 April 2028.
Nor do the numbers in the Council change. Nine governments are on record against mandatory scanning of private messages, 32.9 % of the EU population, 2.1 points short of the 35 % a blocking minority needs. Germany’s position is conditional, and Belgium, Portugal and Slovenia have not declared a decisive line. Where the 27 governments stand lists every government with its document.
What comes next
- 1 and 2 October 2026: home affairs and justice ministers met in Luxembourg. The Council’s main results of both days, 1 October and 2 October, do not mention the regulation.
- October 2026: technical work on detection continues, according to MLex, Breyer and netzpolitik.org.
- Seat of the EU Centre: the Commission can soon launch the selection, the Parliament’s rapporteur says.
- Next trilogue: no date has been set, Agence Europe and netzpolitik.org report. Breyer expects it in November.
- 3 April 2028: Regulation (EU) 2026/1881 expires, unless the permanent law replaces it first.
This piece will be updated when the Council publishes its account of the round. The Chat Control Tracker carries every step with its source.
Sources
- European Parliament, “Combating child sexual abuse: rapporteur hails deal on new EU agency’s tasks”, press release, 30 September 2026.
- Agence Europe, “‘CSAM’ regulation: co-legislators agree on detection of public content and tasks of EU Centre for Child Protection”, Europe Daily Bulletin 13949, 1 October 2026.
- MLex, “EU can soon seek host city for agency to protect children online, lawmaker says”, 30 September 2026, and “EU child abuse talks advance on public content searches; nonpublic detection unresolved”, 29 September 2026.
- Patrick Breyer, “Chat Control 2.0 Trilogue Update: No mass scanning deal for now”, 30 September 2026.
- netzpolitik.org, Tomas Rudl, “Chatkontrolle-Verhandlungen: EU-Staaten und Parlament weiter uneins”, 1 October 2026.
- Council of the EU, document 13051/26, overview of the current legislative proposals under the Irish presidency, 29 September 2026.
- Council of the EU, “Preparation for the trilogue”, document 13158/26 of 18 September 2026, LIMITE, as published by Patrick Breyer.
- Council of the EU, presidency note to delegations, document 11501/26 of 7 July 2026.
- Council of the EU, Justice and Home Affairs Council, main results, 1 October 2026 (home affairs) and 2 October 2026 (justice).
- Regulation (EU) 2026/1881, EUR-Lex.
- Brussels Record, Where the 27 governments stand and data.json, 2 October 2026.
