Chat Control: who decides, by name

Who Decides? series · reference page

The permanent Chat Control law is being settled in a room with three chairs, on mandates written elsewhere by people whose names rarely appear in the coverage. This page names them: the negotiators, the ministers on record, the lawyers, the companies that scan today and the courts that set the limits. Every entry links to the document it comes from, and the page is updated together with the Chat Control Tracker and Where the 27 governments stand.

Last checked 11 October 2026. The sixth political trilogue on Chat Control 2.0, held on 29 September 2026 under the Irish presidency (Council document 13051/26), agreed on the tasks of the EU Centre, which the Parliament’s rapporteur, Javier Zarzalejos, welcomed in a statement on 30 September, and, according to press reports, in principle on detection orders for public content; scanning of private messages remains unresolved, and no date has been confirmed for the next round. Justice and home affairs counsellors met on 5 October on the outcome and the next steps (Council, CM 4365/26); no outcome has been published. They meet again on 20 October (Council, CM 4514/26). Chat Control 1.0, Regulation (EU) 2026/1881, is in force until 3 April 2028.
Javier Zarzalejos and Thomas Byrne seated at the committee podium behind their nameplates
Javier Zarzalejos, chair of the Civil Liberties committee and rapporteur on Chat Control, with Thomas Byrne, Ireland’s Minister of State for European Affairs, as the Irish presidency presented its priorities to the committee, Brussels, 13 July 2026. Photo: European Parliament, © European Union 2026, Source: EP (cropped).
Council of the EU
Ireland, presidency July to December 2026

Speaks for the mandate of 26 November 2025: voluntary scanning only, no detection orders. Justice Minister Jim O’Callaghan is on record for the mandatory text.

Behind it: 27 governments. 9 of them, with 32.9 % of the population, are against mandatory scanning, and Germany is conditional.

European Parliament
Javier Zarzalejos (EPP, Spain), LIBE chair and rapporteur

Chairs the Civil Liberties committee (LIBE) and leads its negotiating team with the shadow rapporteurs. Mandate of 22 November 2023: detection only on a judicial order, against named suspects, encryption protected.

Behind it: the plenary. In July 2026 the motion to reject the temporary law drew 314 votes, short of the absolute majority of all members, 360 that day.

European Commission
Magnus Brunner, Commissioner for Internal Affairs and Migration

The Commission proposed the law on 11 May 2022, presented by Ylva Johansson, with mandatory detection orders at its heart. It has no vote; it drafts the compromise language.

Behind it: DG Migration and Home Affairs, and the deadlines of the temporary law.

The room: three chairs, three mandates

A trilogue is an informal negotiation between the three institutions that must agree before an EU law can pass. Nobody votes in the room. Each chair arrives with a mandate agreed elsewhere, at a different time, by a different majority, and cannot lawfully agree to something outside it. Five rounds have not settled the one question that matters: may detection target everyone, or only people a judge has named?

Council of the EU: the rotating presidency

Who speaks: the member state holding the six-month presidency. Ireland holds it from July to December 2026. Its justice minister, Jim O’Callaghan, is on record in support of the mandatory text (Council press release, 2 July 2026). Before Ireland, Cyprus (January to June 2026) drafted the compromise texts, and Denmark (July to December 2025) produced the mandate that the presidency now defends.

The mandate: agreed by member states’ representatives in the Permanent Representatives Committee on 26 November 2025. Detection orders are out; providers “may voluntarily check content shared on their platforms” for child sexual abuse material. The Danish compromise text of 6 November 2025 (document 14092/25) had removed the detection obligations, Articles 7 to 11, from the draft. In June 2026 the presidency floated a mix of voluntary and mandatory detection, split by public and non-public content.

Who stands behind it: 27 governments, weighted by population. Nine of them, with 32.9 percent of the EU population, are on record against mandatory scanning of private messages. Four states with 35 percent of the population are enough to block a Council vote, and those nine do not reach it. The vote that counts is the Council’s next one on this file, the endorsement of whatever the trilogues produce, on a date not yet set; the Council does not vote in the trilogues, and the sum assumes governments vote as they have spoken. Germany, at 18.47 percent, would take them well past it: its public line rejects suspicionless scanning, but the instruction its negotiators have carried since June 2026 does not oppose mandatory detection where it supplements voluntary scanning. Belgium at 2.63 percent and Portugal at 2.38 percent have declared nothing decisive, and either one alone would also close the 2.1 point gap. Slovenia, reclassified as unclear on 9 September 2026 after its change of government, holds 0.47 percent and could not close it alone. Italy, Poland and the Netherlands carry 25.5 percent between them. The full list, with the document behind every entry, is in Where the 27 governments stand.

European Parliament: the rapporteur and his team

Who speaks: Javier Zarzalejos (EPP, Spain), who chairs the Civil Liberties committee (LIBE) and is also the rapporteur on this file, leads a team of shadow rapporteurs from the other political groups. They are bound by the mandate the Parliament voted and cannot agree to something outside it.

The mandate: adopted in LIBE on 14 November 2023 and confirmed by the plenary on 22 November 2023. Detection only as a last resort, aimed at specific suspects, on a judicial order, with end-to-end encryption protected and no mandatory age verification for communication services.

The votes so far: on 26 March 2026 the Parliament refused to extend the temporary law, and the old rules lapsed on 3 April. On 9 July 2026, at second reading, a motion to reject the Council’s temporary law gathered 314 votes, with 276 against and 17 abstentions. It needed an absolute majority of all members, 360 that day, so the Council text prevailed. The Parliament did adopt amendments excluding end-to-end encrypted communications, and the Council accepted them on 23 July 2026, with Hungary the only government voting against. How each MEP voted is public: HowTheyVote, vote of 9 July 2026.

European Commission: the author

Who speaks: the Commission proposed the permanent regulation on 11 May 2022, presented by Ylva Johansson, then the Commissioner responsible for home affairs, with mandatory detection orders at its heart. Since the Commission that took office in December 2024, the file sits with Magnus Brunner, Commissioner for Internal Affairs and Migration, and his department, DG Migration and Home Affairs.

The role: the Commission has no vote in the trilogue. It sits between the other two as broker and drafts the compromise language, and whoever drafts the language shapes what is thinkable. Under the temporary law it also has deadlines of its own: by 1 October 2026 it must publish the list of organisations that receive Europeans’ reports.

Ministers on record, by name

Most governments state their position through Council working documents rather than in public. These are the people who have put their name to it, with the source in the governments table.

  • Against mandatory scanning: Czechia, Interior Minister Lubomír Metnar (25 July 2026) and the Chamber’s European Affairs Committee (17 September 2026); Estonia, ministers Kristina Kallas and Igor Taro (19 February 2026); Luxembourg, Justice Minister Elisabeth Margue (11 September 2025); the Netherlands, where the Tweede Kamer ordered the no vote by motion on 25 November 2025 and Justice Minister David van Weel restated the line on 18 September 2026; Poland, the Ministry of Digital Affairs (16 September 2025); Austria, a government decision reported by NEOS (9 October 2025); Italy, the only abstention on the mandate (26 November 2025); Slovakia and Finland, on record in Council votes and minutes.
  • Conditional: Germany, where the federal government and the Justice Ministry rejected suspicionless scanning on 8 October 2025, a refusal that sank the mandatory text; the Interior Ministry’s instruction that its negotiators have carried since June 2026 does not oppose mandatory detection where it supplements voluntary scanning.
  • For mandatory scanning, or the widest scope: Ireland, Justice Minister Jim O’Callaghan (2 July 2026); Croatia, Interior Minister Davor Božinović (14 October 2025); Sweden, Justice Minister Gunnar Strömmer (5 February 2025); Latvia, Kaspars Āboliņš of the Interior Ministry (11 September 2025); France, by formal statement in the Council voting result of 23 July 2026; Denmark, Spain, Hungary, Greece, Romania, Bulgaria, Lithuania, Malta and Cyprus, through Council minutes.
  • No settled position: Belgium, where Interior Minister Bernard Quintin told a Chamber committee on 8 October 2025 that the government’s position was not yet decided; Portugal, where parliament demands a judicial warrant for any detection and the government’s line in Council is not settled; and Slovenia, whose Interior Ministry spoke against the Commission text on 2 October 2025 under the previous government, while the government confirmed on 4 June 2026 has not stated a line.

The lawyers nobody elected

The Council’s Legal Service does not vote and does not negotiate; its job is to tell the 27 governments whether a text will survive in court. On 26 April 2023 (opinion 8787/23) it wrote that ordering a service to scan all its users’ communications is general and indiscriminate screening, with a serious risk of compromising the essence of Articles 7 and 8 of the Charter, and that any such regime must be targeted at persons against whom there are reasonable grounds for suspicion. In Council minutes of May and June 2026, published by netzpolitik.org, it kept that objection against the Parliament’s “last resort” orders and called voluntary detection in public areas of a service unproblematic. Its opinions are normally stamped LIMITE and ministers are free to ignore them. Full account: The Council’s lawyers said no. Chat Control went voluntary.

The courts that set the limits

In February 2024 the European Court of Human Rights ruled that requiring providers to weaken end-to-end encryption cannot be regarded as necessary in a democratic society. That judgment is the reason encryption is the hardest of the three open questions. At the other end of the chain, the Commission’s own report on the temporary law found that in two years “no instance of complaints to a judicial authority have been reported” against a scanning decision anywhere in the Union. The courts set the limits; so far nobody has asked them to apply them to a single case.

The companies that decide today

Under Chat Control 1.0 nobody is ordered to scan. A company decides whether to search, with which tools and at which threshold. Google, Meta, Microsoft and Snap announced that they would carry on scanning after the temporary law lapsed in April 2026, citing other legal bases. Five providers reported to the Commission on their scanning in 2023 and 2024: Google, LinkedIn, Meta, Microsoft and Yubo. All of them send their reports to NCMEC, the National Center for Missing and Exploited Children, a private organisation in the United States that received 21.3 million reports in 2025, 77 percent of them about uploads from outside the US, and forwarded them to police in 170 countries. Germany’s Federal Criminal Police Office received between 14,351 and 21,472 such reports a month from January to May 2026; about 60 percent were criminally relevant. Who inside the company decides, and what they owe you, is the subject of The law expired. The scanning did not.

The dates that decide next

  • 1 October 2026: the Commission must publish the list of organisations that receive reports about Europeans under Chat Control 1.0.
  • 1 and 2 October 2026: Justice and Home Affairs Council in Luxembourg, two days after the trilogue. The regulation is not a separate item on the programme published on 30 September; under any other business, in public sessions, the presidency updates ministers on current legislative proposals, and its written overview, document 13051/26, records the 29 September trilogue. The formal endorsement of any provisional agreement belongs to the Permanent Representatives Committee.
  • October 2026: technical meetings on detection in private content continue, according to former MEP Patrick Breyer.
  • November 2026 (expected): the seventh political trilogue, a new attempt at a political deal, according to Patrick Breyer. Agence Europe reported on 1 October that no date has been confirmed.
  • 1 February 2027: first public reports from providers on error rates and false positives are due.
  • 1 April 2027: end of the grace period for providers that were already scanning before 31 July 2026 without a completed data protection consultation.
  • 3 April 2028: Chat Control 1.0 expires unless the permanent law replaces it first.

Where to find them

Every person named here holds a public office and can be written to through it. Members of the European Parliament, with committee membership and contact details: europarl.europa.eu/meps. The Council presidency and its calendar: consilium.europa.eu. The Commissioner responsible: commission.europa.eu. National ministries are linked from each entry in Where the 27 governments stand. We record positions; we do not run campaigns.

Sources

Changelog

2 October 2026: correction: the entry for 30 September below said that the Council and the Parliament had not published an outcome; the Parliament had published its rapporteur’s statement that day. The status line now attributes the agreement in principle on public content to the press reports that carry it; the Parliament’s statement covers only the tasks of the EU Centre.

1 October 2026: the status line now records the rapporteur’s statement of 30 September and Agence Europe’s report of an agreement in principle on public content and on the EU Centre’s tasks; the November date is marked as unconfirmed.

30 September 2026, evening: former MEP Patrick Breyer reported that the trilogue of 29 September ended without agreement on scanning private messages and that the next round is expected in November. The status line and the dates that decide next now say so, with the source; the item for 29 September was removed from the dates. The Council and the Parliament have not published an outcome. Corrected on 2 October: the Parliament had published its rapporteur’s statement that day.

30 September 2026: the sixth trilogue was held on 29 September (Council document 13051/26); its outcome has not been published. The status line and the dates that decide next no longer describe it as upcoming; the technical meeting of 18 September was removed from the dates, and an unsourced line about an adoption push in October was deleted. Later the same day, the item for 1 and 2 October was updated from the Council programme published on 30 September.

28 September 2026: Correction. The list under “Ministers on record, by name” still counted Germany and Slovenia among the governments against mandatory scanning, contrary to the count at the top of this page and to Where the 27 governments stand. Germany now has its own line as conditional, as in the governments table since 7 September, and Slovenia is listed with Belgium and Portugal as having no settled position, as since 9 September. The list now names the nine governments counted above; no figure changes. The error was found in a review of the site on 28 September 2026.

11 September 2026: Clarification after a reader’s objection, no change of position: the blocking-minority sum on this page describes the Council’s future vote on the outcome of the trilogues, on a date not yet set; the Council does not vote in the trilogues. The mandate of 26 November 2025 is now described as agreed by member states’ representatives in the Permanent Representatives Committee, as the Council’s press release puts it, not by ministers.

9 September 2026: Slovenia reclassified from Against to Unclear on Where the 27 governments stand, because its recorded statement predates the government confirmed on 4 June 2026; the count on this page changes from ten governments and 33.3 percent to nine and 32.9 percent, the gap from 1.7 to 2.1 points. Same day: the trilogue date now rests on the Council’s own record, the presidency’s note to delegations of 7 July 2026 (document 11501/26), instead of internal minutes published by netzpolitik.org. Added the technical meetings of 10 and 18 September and the Justice and Home Affairs Council of 1 and 2 October to the dates that decide next.

6 September 2026: page published. Same day: corrected the description of Javier Zarzalejos, who chairs the Civil Liberties committee as well as acting as rapporteur; the first version presented the chair as a separate person. Corrections are recorded here, never made quietly. Cite this page as: Brussels Record, “Chat Control: who decides, by name”, checked 6 September 2026, brusselsrecord.com/chat-control-who-decides/.