How many of the 27 EU governments oppose Chat Control? On the public record of 10 October 2026 the answer is one, four or nine, depending on what is asked. Each number below is right for its own question, and each comes with the document behind it.

Four questions, four answers

• Against mandatory scanning of private messages? Nine governments are on record against it, with 32.9 % of the EU population: Austria, Czechia, Estonia, Finland, Italy, Luxembourg, the Netherlands, Poland and Slovakia. Germany is conditional, Belgium, Portugal and Slovenia are unclear, and fourteen governments support it (governments page).
• Against the Council’s negotiating mandate? On 26 November 2025 four governments voted against it: Czechia, the Netherlands, Poland and Slovakia. Italy abstained and 22 voted for. The Permanent Representatives Committee does not publish its votes; the Czech news agency ČTK reported the split (Deník.cz).
• Against Chat Control 1.0? In the written procedure completed on 23 July 2026, which brought back voluntary scanning until 3 April 2028, one government voted against, Hungary. Belgium abstained and 25 voted for (Council voting result 12382/26).
• For scanning suspects only? One government is on record for limiting scanning to people under suspicion: Poland, with 8.3 %. Thirteen want voluntary scanning of everyone kept broad (our note of 5 October).

Why the numbers differ

The Council’s mandate has no detection orders. In its own words, it would “make permanent a currently temporary measure” that lets companies scan their services (Council, 26 November 2025). A government can therefore oppose mandatory scanning and still vote for the mandate, as Austria, Estonia, Finland and Luxembourg did. In July all nine governments against mandatory scanning voted for Chat Control 1.0. The one that voted against it, Hungary, is recorded as supporting mandatory scanning and published no reason (Hungary’s page).

Another count

Other trackers combine the questions in their own way. On 10 October fightchatcontrol.eu showed one member state opposing, 23 supporting and three split. Most of its 23 carry the line “Approved revised Danish Chat Control on November 26th 2025”, that is, the Council’s mandate. Its one opposing government is Italy. Its three split governments, Czechia, the Netherlands and Poland, are those it lists as opposing the permanent law and supporting Chat Control 1.0. It lists Slovakia as having approved the mandate; ČTK reported Slovakia among the four that voted against.

What it changes in the record

Nothing changes. The governments page and every country page show the position and the two Council votes separately, because they answer different questions. The record’s blocking-minority sum uses the first question only: whether the governments against mandatory scanning could stop a final text that contains it. They hold 32.9 %, 2.1 points short of the more than 35 % that four or more governments need. That is arithmetic, not a forecast of any vote. To try other combinations, use the blocking minority calculator. If a number here is wrong, tell us and it is corrected within 24 hours.

Sources

• Brussels Record, “Where the 27 governments stand”, governments page, as of 10 October 2026.
• Council of the EU, press release on the Council’s position, 26 November 2025.
• ČTK, “EU podpořila Chat Control, brojí proti dětské pornografii. Česko hlasovalo proti”, Deník.cz, 27 November 2025.
• Council of the EU, voting result 12382/26 on Regulation (EU) 2026/1881, 10 August 2026, written procedure completed on 23 July 2026.
• Brussels Record, “Only one of 27 governments is on record for scanning suspects only”, 5 October 2026.
• Brussels Record, Hungary: position on Chat Control, as of 10 October 2026.
• Fight Chat Control, fightchatcontrol.eu, member state positions, checked 10 October 2026.

The Council’s position on the permanent Chat Control law, agreed on 26 November 2025, would make voluntary scanning permanent: its press release says the Council wants “to make permanent a currently temporary measure” that lets companies scan their services for child sexual abuse. The European Parliament wants detection orders aimed at individuals or groups linked to child sexual abuse, using “reasonable grounds of suspicion”.

That leaves a second question beside mandatory detection: may scanning reach only people under suspicion, or everyone? Since 3 October the governments page records, for each of the 27, what is on record on it, each row with the document behind it.

What the documents say

Most rows rest on reports by Germany’s Permanent Representation on closed Council meetings, published in full by netzpolitik.org. They record what delegations said, not how they voted.

• Poland, justice and home affairs counsellors, 17 June: general monitoring is to be avoided, and detection in non-public communication may only be targeted (“dass ein generelles Monitoring zu vermeiden sei und Aufdeckung im nicht-öffentlichen Bereich nur gezielt erfolgen dürfe”).
• France, counsellors, 10 June: a broad scope for voluntary detection, with “keinen Spielraum für Verhandlungen”, no room for negotiation.
• Ten governments, ambassadors, 13 March, on the interim rules: Hungary, Belgium, Sweden, Spain, Latvia, Slovakia, Malta, Estonia, Slovenia and Romania “waren nicht zu Zugeständnissen beim Anwendungsbereich bereit”, were not ready to concede on the scope.
• Germany, an internal government position paper reported by dpa on 29 September: voluntary searching “dürfe nicht von einer vorherigen Erlaubnis oder ähnlichen Einschränkungen abhängen”, must not depend on prior permission or similar restrictions.
• The Council itself, document 11956/26 of 10 September: 14 governments replied, and “most Member States responding are in principle opposed to the concept of targeting detection to specific users”. It does not name them.

The numbers

Shares of the EU population, from the record’s own table.

• Suspects only: 1 government, Poland, 8.3 %.
• Everyone, kept broad: 13 governments, 59.2 %: Germany, France, Spain, Romania, Belgium, Sweden, Hungary, Slovakia, Croatia, Slovenia, Latvia, Estonia and Malta.
• Limits, but not suspects only: 4 governments, 16.6 %: Italy, Austria, Finland and Luxembourg.
• Nothing on record: 9 governments, 15.9 %: the Netherlands, Czechia, Portugal, Greece, Bulgaria, Denmark, Ireland, Lithuania and Cyprus.

Of the nine governments against mandatory scanning of private messages, 32.9 % of the EU population, only Poland is on record for scanning suspects only. Slovakia and Estonia are on record for keeping voluntary scanning broad.

What to keep in mind

Most statements are three to seven months old; the newest is Germany’s paper of 29 September. Sweden’s and Romania’s come from governments that are being replaced. Where a government said both things, its row says so: Estonia refused to narrow the interim rules in March and asked in June to narrow the scope to what technology can do.

What it changes in the record

The section “Suspects only, or everyone?” on the governments page, added on 3 October, lists the 27 rows with their sources. The count on mandatory detection does not change: nine governments against, 32.9 % of the EU population. No position label changed. If a row is wrong, or a document moves a government, tell us and it is corrected within 24 hours.

Sources

• Brussels Record, “Suspects only, or everyone?”, governments page, 3 October 2026.
• Council of the EU, press release on the Council’s position, 26 November 2025.
• European Parliament, press release on the Parliament’s mandate, 14 November 2023.
• netzpolitik.org, Markus Reuter, report with the German record of the ambassadors’ meeting of 13 March, 20 March 2026.
• netzpolitik.org, Andre Meister, report with the German record of the counsellors’ meeting of 10 June, 12 June 2026.
• netzpolitik.org, Andre Meister, report with the German record of the counsellors’ meeting of 17 June, 2 July 2026.
• dpa, report on the German government’s position paper, 29 September 2026, via beck-aktuell.
• Council of the EU, document 11956/26 of 10 September 2026, LIMITE, as published by Agence Europe.

The sixth political trilogue on the regulation against child sexual abuse online, the permanent law known as Chat Control 2.0, took place on 29 September 2026 at the Council, under the Irish presidency. The presidency’s overview for this week’s Justice and Home Affairs Council, Council document 13051/26, records that it was “dedicated to reaching general political agreement on detection obligations and own-initiative searches”.

The only official account so far comes from the Parliament. On 30 September it published a statement by its rapporteur, Javier Zarzalejos (EPP, Spain), welcoming an agreement on the tasks of the future EU Centre. The Council has published no outcome: the main results of the home affairs ministers’ meeting on 1 October and of the justice ministers’ meeting on 2 October do not mention the regulation.

What the Parliament confirms

According to the rapporteur, the Centre will receive reports of abuse material from providers, check that they are not unfounded and send them to the relevant authorities. It will keep a database of indicators of known material and search publicly accessible online content for known and new material itself. Its searches will be governed by safeguards, including guidelines set out with the Commission and the European Data Protection Supervisor; a fundamental rights officer will monitor its compliance, and a Victims Consultative Forum will give victims a voice. With the tasks agreed, the Commission can soon launch the selection of the Centre’s seat.

The statement does not mention detection orders. Work on the rest of the regulation, it says, continues “in a constructive spirit” with the Irish presidency.

What the press reports

Agence Europe reports that the Council presidency and the Parliament also reached an agreement in principle on detection orders for large platforms covering public content. MLex reports that the deal on public content is provisional and depends on a deal on the whole law.

Former MEP Patrick Breyer, who campaigns against the regulation and has published several of the Council’s negotiating documents, gives a fuller account. He writes that courts or administrative authorities will be able to order hosting services to scan public uploads for known material, and that such orders could reach any hosting service regardless of its size, which differs from Agence Europe’s report of large platforms. He also reports a clarification on risk mitigation, the measures providers must take to reduce the risk that their services are misused: authorities could not use those measures to force providers into voluntary scanning of private communications.

netzpolitik.org is more cautious. It reports agreement only on the EU Centre, with some points on publicly accessible content, such as images in public cloud storage or on social media, already settled. Who would issue detection orders, independent courts or administrative authorities, and which services they would cover were also negotiated, it writes.

What was not agreed

Detection in private messages and files remains open, by every account. Breyer writes that the Parliament’s negotiators refused the search plans the presidency proposed for the Council, and insisted that any scanning of private communications stay limited to people linked to child sexual abuse. Agence Europe describes private content as one of the most sensitive parts of the text, with the Parliament holding a firm position on the protection of personal data. netzpolitik.org describes the Council as wanting detection orders taken out of the law in favour of voluntary scanning, and the Parliament as wanting to keep mandatory orders as targeted as possible, without agreement yet on whether they would cover individual users, groups of users or parts of a service.

How that compares with what the Council asked

Before the round, the presidency put three questions to the ambassadors in document 13158/26 of 18 September. The first was whether to establish detection orders on publicly accessible content for known material, alongside own-initiative searches by providers in non-public content for known and new material and for the solicitation of children. The second was whether those searches would require a search plan reviewed by a national judicial or independent administrative authority, with providers obliged to use a database of indicators from the EU Centre. The third was whether, if no compromise proved as effective as today’s voluntary practice, non-public content should be left out of the regulation altogether.

If the press accounts are right, the round settled the public half of the first question and none of the private half. The third question remains open: according to Breyer, the Council still wants to keep the voluntary regime of Chat Control 1.0 in place.

The Parliament’s line has been on record since July. According to the presidency’s note 11501/26 of 7 July, its negotiators were ready to discuss detection on condition that end-to-end encrypted communication stays protected and that no general monitoring obligation is imposed, and could accept detection orders and own-initiative searches side by side if both were targeted and came with safeguards.

What does not change

Voluntary scanning of private messages remains legal. Regulation (EU) 2026/1881, Chat Control 1.0, allows providers to scan messages that are not end-to-end encrypted until 3 April 2028.

Nor do the numbers in the Council change. Nine governments are on record against mandatory scanning of private messages, 32.9 % of the EU population, 2.1 points short of the 35 % a blocking minority needs. Germany’s position is conditional, and Belgium, Portugal and Slovenia have not declared a decisive line. Where the 27 governments stand lists every government with its document.

What comes next

• 1 and 2 October 2026: home affairs and justice ministers met in Luxembourg. The Council’s main results of both days, 1 October and 2 October, do not mention the regulation.
• October 2026: technical work on detection continues, according to MLex, Breyer and netzpolitik.org.
• Seat of the EU Centre: the Commission can soon launch the selection, the Parliament’s rapporteur says.
• Next trilogue: no date has been set, Agence Europe and netzpolitik.org report. Breyer expects it in November.
• 3 April 2028: Regulation (EU) 2026/1881 expires, unless the permanent law replaces it first.

This piece will be updated when the Council publishes its account of the round. The Chat Control Tracker carries every step with its source.

Sources

• European Parliament, “Combating child sexual abuse: rapporteur hails deal on new EU agency’s tasks”, press release, 30 September 2026.
• Agence Europe, “‘CSAM’ regulation: co-legislators agree on detection of public content and tasks of EU Centre for Child Protection”, Europe Daily Bulletin 13949, 1 October 2026.
• MLex, “EU can soon seek host city for agency to protect children online, lawmaker says”, 30 September 2026, and “EU child abuse talks advance on public content searches; nonpublic detection unresolved”, 29 September 2026.
• Patrick Breyer, “Chat Control 2.0 Trilogue Update: No mass scanning deal for now”, 30 September 2026.
• netzpolitik.org, Tomas Rudl, “Chatkontrolle-Verhandlungen: EU-Staaten und Parlament weiter uneins”, 1 October 2026.
• Council of the EU, document 13051/26, overview of the current legislative proposals under the Irish presidency, 29 September 2026.
• Council of the EU, “Preparation for the trilogue”, document 13158/26 of 18 September 2026, LIMITE, as published by Patrick Breyer.
• Council of the EU, presidency note to delegations, document 11501/26 of 7 July 2026.
• Council of the EU, Justice and Home Affairs Council, main results, 1 October 2026 (home affairs) and 2 October 2026 (justice).
• Regulation (EU) 2026/1881, EUR-Lex.
• Brussels Record, Where the 27 governments stand and data.json, 2 October 2026.

The note that prepared the ambassadors’ meeting of 23 September can now be read. Document 13158/26 of 18 September, “Preparation for the trilogue”, is marked LIMITE and is listed in the Council’s public register by title only. The former MEP Patrick Breyer has published it in full, and Agence Europe reported on it on 22 September. It runs to five pages and ends with three questions to the Permanent Representatives Committee “in preparation of the trilogue on 29 September 2026”.

The three questions

a) “Do you agree to establish (i) detection orders on publicly accessible content for known CSAM and (ii) own-initiative searches by providers on non-public content for known and new CSAM and the solicitation of children?”

b) “Do you agree in a spirit of compromise that own-initiative searches by providers on non-public content would require a search plan reviewed by a national judicial or independent administrative authority, and that providers would be obliged to make use of a database of indicators provided by the EU Centre?”

c) “If no compromise solution can be agreed providing at least for the same level of effectiveness as the current voluntary practice, would you accept to exclude own-initiative searches or detection orders on non-public content from the scope of this Regulation?”

Non-public content means, above all, private messages. The first question would write providers’ voluntary scanning of them, “own-initiative searches” in the note’s words, into the permanent law. The third asks what governments would accept if that fails.

What the note says about the negotiations

The trilogue “is dedicated to reaching general political agreement on detection obligations and own-initiative searches (Articles 7-11)”. Technical agreement has been reached on own-initiative searches by the EU Centre in publicly accessible content, with the possibility for national Coordinating Authorities to “delay the submission of notifications” that would interfere with investigations. If the trilogue confirms it, the presidency “next intends to launch the process for the establishment of the seat of the EU Centre”.

On private content, the presidency “has consistently communicated the need to establish an effective regime that allows maintaining the current level of reports through the providers’ voluntary searches”. It wants their scope “unchanged compared to the CSA Interim Regulation, that is, to cover known and new CSAM, and the solicitation of children”. The Parliament wants to limit searches to known material.

At a technical meeting on 18 September, the note records, the Parliament “indicated willingness to test an approach that would require providers to prepare search plans outlining the technologies used and other relevant safeguards subject to review by national judicial or independent administrative authorities”. It has also insisted on targeting searches and detection orders on private content. The presidency proposed to target searches “to specific parts of a service or, where possible, to individual users”, and states that “requiring that searches are targeted to specific users only would not generate any added value compared to the possibilities already existing under criminal law”. Detection orders on private content, it says, can be discussed “only once there is agreement on the parameters and the scope of the own-initiative searches”.

For public content the note is brief: “To avoid a general monitoring obligation, it is necessary that detection orders on publicly accessible content are limited to known CSAM”.

What the state of play of 10 September adds

The presidency’s earlier document 11956/26, published by Agence Europe, records the replies to the July reflection paper. “14 Member States replied”, and “most Member States responding are in principle opposed to the concept of targeting detection to specific users.” It also states the Council’s bottom line: “the Council does not want a permanent framework that achieves less than the voluntary regime.” Neither document names a country.

What leaving private messages out would change, and what it would not

It would leave private messages outside the permanent regulation: no detection orders for them, and no permanent basis in this regulation for providers’ voluntary scanning of them. The regulation would still cover public content and set up the EU Centre.

It would not end the scanning of private messages. Voluntary scanning is allowed by Regulation (EU) 2026/1881, the temporary derogation known as Chat Control 1.0, until 3 April 2028. After that date it would need the derogation to be extended again, as it has been twice, or a new legal basis.

And it is a question, not a decision. The governments’ answers are not public, and Coreper publishes no outcome for an item of this kind. What the ambassadors settled on 23 September will show in the position the presidency takes into the trilogue on Tuesday, 29 September.

What it changes in the record

The tracker now links the note itself rather than a report about it. No government’s position changes.

The note also shows the limit of the count this site has kept. Nine governments are on record against mandatory scanning of private messages, 32.9 % of the EU population, 2.1 points short of a blocking minority. But the Council’s own negotiating mandate of November 2025 already imposes no obligation on providers to scan; it makes voluntary scanning permanent instead. The questions put to the ambassadors are whether that voluntary scanning is written into the law, and whether it must be targeted at suspects. After the trilogue, this site will add that count to the governments page: for each government, the document behind its position, and “not known” where there is none.

Record notes are short, dated entries: the documents, what they say, what they change on this site. Sources: Council of the EU, “Preparation for the trilogue”, document 13158/26 of 18 September 2026, LIMITE, as published by Patrick Breyer, paragraphs 11 to 13. Council of the EU, “State of play and way forward”, document 11956/26 of 10 September 2026, LIMITE, as published by Agence Europe. Agence Europe, 22 September 2026. Regulation (EU) 2026/1881, Official Journal of 24 July 2026.

Sweden voted on 13 September. The Election Authority confirmed the result on 19 September: the Social Democrats, the Left Party, the Centre Party and the Greens hold 176 of the Riksdag’s 349 seats; the Moderates, the Sweden Democrats, the Christian Democrats and the Liberals hold 173. On 18 September the Speaker asked the Social Democratic leader, Magdalena Andersson, to explore whether she can form a government the Riksdag will tolerate.

For the child sexual abuse regulation, the result matters for one reason: Sweden’s size.

The arithmetic

Nine governments are on record against mandatory scanning of private messages. Together they represent 32.9 % of the EU population, 2.1 points short of the 35 % that blocks a Council decision. Sweden holds 2.34 %, by the Council’s own 2026 figures.

If a Swedish government moved from support to opposition, the nine would become ten and their share would rise to 35.2 %. That is a blocking minority, and Sweden alone would have closed the gap.

Sweden is not undecided. The outgoing government of Ulf Kristersson supports mandatory scanning. In February 2025 its justice minister, Gunnar Strömmer, told the Riksdag that “the government and a broad majority in the Riksdag are prepared to continue a negotiation at EU level along these lines”. Sweden voted for the Council’s negotiating mandate on 26 November 2025 and for the temporary regime of voluntary scanning on 23 July 2026. The full record is on Sweden’s page.

What the parties said

On 3 September, ten days before the vote, the Swedish internet provider Bahnhof put the same question to every party in the Riksdag: if it gains influence in government, will it work for Sweden to say no in the Council to Chat Control, to general mass surveillance and to proposals that weaken end-to-end encryption?

Andersson’s three possible partners answered plainly. The Centre Party: “we can promise that our party will say no to proposals that include general mass surveillance and weaken encryption, in the Council of Ministers and in the EU negotiations”. The Left Party: “we have opposed proposals for general surveillance and large-scale scanning of people’s private communication”. The Greens said they could support a regulation only on one condition: “that the Chat Control proposal is kept out of the regulation”.

The two parties that could lead a government did not answer the question. The Social Democrats wrote that “well-balanced legislation with built-in safeguards” could prevent and prosecute many crimes, and that “we will always stand on the children’s side”. Andersson herself said in a party leaders’ debate on EU affairs in November 2025 that her party supports the proposal, Dagens PS reported on 1 September. The Moderates wrote: “We therefore cannot give a definitive answer to this question.”

The other three parties of the outgoing majority answered with opposition to general scanning. The Sweden Democrats: “Yes, we will; we will not approve any proposal that means weakening encryption.” The Christian Democrats: Sweden “should not support legislation that entails more general surveillance of people’s private communication”. The Liberals, in the most qualified terms: encryption “should not be broken without suspicion of a crime”. Two of these three, the Christian Democrats and the Liberals, sit in the government that supports mandatory scanning.

Counted together, the six parties that answered with some form of opposition hold 180 of the 349 seats in the new Riksdag.

A survey answer is not a vote. On 9 July, when the European Parliament voted on the temporary regime of voluntary scanning, Swedish members from the Social Democrats, the Moderates, the Centre Party and the Christian Democrats voted against rejecting it. That was a different question, voluntary scanning rather than mandatory, but it shows that party lines in Brussels and pledges in Stockholm do not always meet.

What it cannot change

Not the trilogue on 29 September. The new Riksdag meets on 28 September, and the earliest day a candidate for prime minister can be put to it is 29 September, the same day the presidency and the European Parliament meet. Sweden goes into that week with its outgoing government, and the Council’s line for the trilogue was prepared by the ambassadors on 23 September.

A candidate for prime minister falls only if more than half of the members, 175, vote against. The right-wing parties have 173. Andersson therefore needs none of her three partners to vote with them, which gives each of them a say in what her government will do.

The blocking minority counts later: at the Council’s vote on whatever the trilogues produce, on a date not yet set. By then Sweden will have a government, and before it votes in the Council it will consult the Riksdag’s Committee on EU Affairs, drawn from the new Riksdag.

What it changes in the record

Nothing yet. Sweden’s row on the tracker and on the governments page stays at “supports” until a Swedish government states a different line. A party’s answer to a survey is not a government position. When a government states one, the change will be entered with the document that shows it.

Sources: Swedish Election Authority, final result of the 2026 Riksdag election, 19 September 2026. SVT, the Speaker’s decision of 18 September 2026 and the procedure for the vote on a prime minister. Sveriges riksdag, timetable for the 2026/27 session. Bahnhof, election survey of 3 September 2026, question 1; party answers quoted in our translation from the Swedish. Riksdag, written answer of the Minister for Justice, 5 February 2025. Dagens PS, 1 September 2026. Europaportalen, on the European Parliament vote of 9 July 2026. Population shares: Council of the EU, 2026 figures.

Not every presidency working document reaches the Council’s public register. This one did. Document WK 10939/2026 of 24 July 2026 is a reflection paper on detection obligations and own-initiative searches, five pages on the proposal for a regulation laying down rules to prevent and combat child sexual abuse. It puts five questions to delegations, sets a deadline for their written replies, and lays out the calendar that has governed September.

What it says

The purpose is stated plainly: to investigate “potential paths towards agreement on own-initiative searches and detection orders between co-legislators for the trilogue on 29 September 2026”. The closing section is plainer still: “The Presidency seeks to achieve political agreement on detection obligations and own-initiative searches at the sixth trilogue, which will take place at the Council premises on 29 September 2026.”

The five questions ask whether own-initiative searches by providers in public content need any further regulation; whether the EU Centre should be tasked with such searches; whether detection orders in public content should cover at least known child sexual abuse material; how detection orders and searches in non-public content targeted to specific users linked to child sexual abuse could work in practice, and how those users would be defined; and whether the presidency should explore other options altogether. Written replies were due by Thursday, 3 September 2026, close of business. The paper also asks member states that have not yet done so to review document 9656/26, the Cyprus presidency’s compromise on detection of May 2026.

The two positions, in the presidency’s own words

The paper sets out what each side has said. Among the principles tabled by the European Parliament in response to the Cyprus presidency’s proposal: “No generalised scanning on non-public content”, “End-to-end encryption in interpersonal communications must be fully protected”, and “No detection orders or own-initiative searches for new CSAM or grooming”. On the other side it records “the clear preference of a majority of delegations in the Council to continue with the practice of own-initiative searches by providers for known and new CSAM and the solicitation of children”.

The dates

Written replies by 3 September. Interinstitutional technical meetings on 10 and 18 September. “Delegations will be updated in a meeting of JHA Counsellors on 14 September 2026.” “Political guidance from the Permanent Representatives Committee may be requested on 23 September 2026.” Then the sixth trilogue on 29 September, at the Council premises.

What it changes in the record

The document joins the sources of the Chat Control Tracker. It adds one date this site did not carry: 23 September, when the Permanent Representatives Committee may be asked for political guidance before the trilogue. It changes no count on Where the 27 governments stand, because a reflection paper records no positions by country. And it settles a small question of naming: this site has written of five trilogues, and the presidency’s own paper calls the meeting of 29 June 2026 the fifth and the meeting of 29 September the sixth.

Record notes are short, dated entries: one document, what it says, what it changes on this site. Source: Council of the EU, reflection paper on detection obligations and own-initiative searches, document WK 10939/2026 of 24 July 2026, public register, sections 1 to 4.

After each round of trilogue negotiations the presidency sends delegations a table. The one that sits in the Council’s public register from this spring is document WK 6982/2026 of 19 May 2026: 446 pages in four columns, the Commission proposal, the Parliament’s mandate, the Council’s mandate and the draft agreement, with a status line against each provision. It records what the negotiators settled at the trilogue of 11 May 2026 and what they sent back to technical level. On encryption it says more than the summaries of it do.

What it says about encryption

The draft agreement column carries an article, not only a recital. At line 112a, Article 1(4a), it reads:

“This Regulation shall not prohibit, make impossible, weaken, circumvent or otherwise undermine cybersecurity measures, in particular encryption, including end-to-end encryption, implemented by the relevant information society services or by the users. This Regulation shall not create any obligation that would require a provider of hosting services or a provider of interpersonal communications services to decrypt data or create access to end-to-end encrypted data, or that would prevent providers from offering end-to-end encrypted services.”

The table gives the origin of that wording as the Cypriot presidency’s drafting, and the same text stands in the Council’s mandate column. The row carries no on hold marker, unlike many others in the document.

Parliament had its own guarantee in the same article. Its mandate column, at line 107a, Article 1(3), point (-a), reads: “Nothing in this Regulation shall be interpreted as prohibiting, weakening or undermining end-to-end encryption. Providers shall not in particular be prohibited to offer end-to-end encrypted services.” In the draft agreement column that paragraph is marked “deleted”, with the note “Covered in line 112a”.

The two sentences do different work. Parliament’s forbids reading the regulation a certain way. The agreed wording forbids the regulation from doing the thing, and then says what it may not require: no obligation to decrypt, no obligation to create access to encrypted data, no bar on offering end-to-end encrypted services. Neither settles what detection may demand of services that are not encrypted, and that is the part still open.

What is still open

Where a line is unresolved the table says so in the draft agreement column. The marker “ITM 13.02: ON HOLD” stands against the paragraphs of Article 66 and, with other dates, against Article 57(1), point (g), and Article 51(a); recitals on voluntary detection and on detection orders are marked as linked to that discussion. Elsewhere the entries read “Provisionally agreed (Trilogue 26.02)”, “Trilogue 16.04” or “Trilogue (11.05.): Further discussion at technical level”, so the table doubles as a record of which meeting decided what.

What it changes in the record

The document joins the sources of the Chat Control Tracker. It changes no count on Where the 27 governments stand: that page answers one question, whether providers may be ordered to scan everyone’s private messages, and a table of draft text records no positions. What it does answer is a question readers ask here often, whether the agreed text protects encryption in the binding part or only in the preamble. On 19 May 2026 the draft agreement had it in Article 1(4a).

Record notes are short, dated entries: one document, what it says, what it changes on this site. Sources: Council of the EU, four-column table on the proposal for a regulation laying down rules to prevent and combat child sexual abuse, document WK 6982/2026 of 19 May 2026, public register, lines 107a and 112a; presidency note to delegations, document 11501/26 of 7 July 2026, public register.

The one chapter of Chat Control 2.0 still open is detection: who may search which messages, for what, and on whose order. The text the negotiators work from is the presidency’s compromise on detection, Council document 9659/26 of 26 May 2026, nine pages of explanation and fifteen of draft articles, in the Council’s public register. Until this week this site knew it only through the presidency’s later summary, document 10499/26. The compromise itself says more.

What it says

The proposal splits the online world in two. “Content that is publicly accessible” is defined as “information that has been made available, at the request of a content provider, to a potentially unlimited number of persons without requiring a human decision or selection of who is granted access”. Everything else that is not encrypted is non-public content; encrypted content is outside both regimes, because the co-legislators have provisionally agreed that the regulation “shall not create any obligation that would require a provider of hosting services or a provider of interpersonal communications services to decrypt data or create access to end-to-end encrypted data, or that would prevent providers from offering end-to-end encrypted services”.

On that map the presidency places four components. Providers may search non-public content on their own initiative, a permanent version of the voluntary regime of the expired interim regulation, extended to hosting services, with a duty to “inform the EU Centre in advance” and a power for national authorities to suspend the searches. National authorities may order detection on publicly accessible content where a hosting service “is being misused for online child sexual abuse to an appreciable extent”, with a procedure that “is less detailed” than the one for private content. For private content, the proposal “is to move away from generalised scanning towards scanning of specific users, without a need for these users to be suspects in the criminal law sense”: an order “shall only be issued if” it “concerns specific users”, there are “clear indications, based on information lawfully acquired, that those specific users are related to child sexual abuse” and “have used the service in the 12 months prior to the request”, and the order is “necessary and proportionate”. Orders would run for at most 24 months for abuse material and 12 months for grooming, issued by “independent administrative authorities and/or judicial authorities” at the request of a Coordinating Authority. The fourth component lets the EU Centre search public content itself. What each component may look for, “known child sexual abuse material (CSAM), new CSAM and/or grooming”, “remains bracketed”.

What happened next

The delegations were asked for their views at the counsellors’ meeting of 10 June 2026, the meeting whose German minutes, published by netzpolitik.org on 12 June, record twelve scrutiny reservations and six of them called positive. On 22 June the presidency told the ambassadors that the Parliament “has remained very critical concerning own-initiative searches by providers on non-publicly accessible content, even for known CSAM” (10499/26). On 7 July it recorded the Parliament as “ready to discuss the building blocks on detection” on two conditions, end-to-end encryption protected and no general monitoring obligation (11501/26). These four components are what the technical meetings of 10 and 18 September and the trilogue of 29 September are about.

What it changes in the record

No position changes. Document 9659/26 joins the sources of the Chat Control Tracker and of Who decides, by name. The positions on Where the 27 governments stand answer one question, whether providers may be ordered to scan everyone’s private messages. The compromise narrows that question to orders against named users on “clear indications” short of suspicion in the criminal sense, and for what; what each government said about that narrower order at the June meetings is on its country page where the minutes record it. A row changes only with a document.

Record notes are short, dated entries: one document, what it says, what it changes on this site. Sources: Council of the EU, presidency compromise texts on detection, document 9659/26, 26 May 2026, public register; presidency note to the Permanent Representatives Committee, document 10499/26, 22 June 2026; presidency note to delegations, document 11501/26, 7 July 2026; netzpolitik.org, German delegation’s minutes of the JHA counsellors’ meeting of 10 June 2026, published 12 June 2026.

On 9 September 2026 this site moved Slovenia from Against to Unclear in the record of the 27 governments. Ljubljana said nothing new that day. The change comes from two documents read side by side: a statement by the Ministry of the Interior of 2 October 2025, made under the previous government, and the German delegation’s minutes of the Council working party of 10 June 2026, published by netzpolitik.org on 12 June, in which the delegation of the government confirmed six days earlier called its scrutiny reservation on the presidency’s detection compromise positive.

What the documents say

On 2 October 2025 the Ministry of the Interior announced, as reported that day by Zanima.me, that Slovenia “does not support the proposal in its current form”, the reason being “the disproportionate interference with privacy that the regulation provides for” (translated from the Slovenian report). The proposal was the text then listed for a Council decision on 14 October 2025. That statement is the position in the record, and it was made under the government of Robert Golob.

On 4 June 2026 the National Assembly confirmed the government of Janez Janša (gov.si, 5 June 2026). The Interior portfolio now belongs to Franci Matoz as Minister of the Interior and Public Administration. The record has found no statement by the new government on the file.

On 10 June 2026 the counsellors of the 27 governments held the first substantive discussion of the presidency’s proposal on voluntary detection and detection orders, document 9659/26, which pairs voluntary searches by providers in non-public content with detection orders for publicly accessible content and targeted orders against specific users (presidency note to Coreper, document 10499/26). The German minutes record: “LTU, GRC, SVK, MLT, BGR, ROU, FIN (mit Hinweis auf kritische Haltung des nationalen Parlaments), SVN, CZE, SWE, DNK und BEL legten Prüfvorbehalt ein, wobei LTU, GRC, MLT, SVN, SWE und BEL diesen als positiv bezeichneten.” Twelve delegations entered a scrutiny reservation; six, Slovenia among them, called theirs positive.

What it changes in the record

A scrutiny reservation is not a vote, and “positive” is the German delegation’s word for how Slovenia’s representative described it, not a Slovenian statement. It is, though, the only recorded signal from the new government, and it points the other way from October 2025. The record therefore lists Slovenia as Unclear since 4 June 2026, keeps the 2025 statement on the country page as the last stated position, and says so in the changelogs of the Chat Control Tracker, Where the 27 governments stand and Who decides, by name.

Governments on record against mandatory scanning: nine instead of ten. Their share of the EU population: 32.9 per cent instead of 33.3. Distance to a blocking minority, which needs four governments and more than 35 per cent: 2.1 points instead of 1.7. Slovenia’s 0.47 per cent could not close that gap alone; Belgium (2.63) or Portugal (2.38), both listed as unclear, could. The article of 8 September on the blocking minority carries an update at the top rather than a silent rewrite.

What would move Slovenia back to Against, or on to For: a statement by the government or the minister, a recorded vote, or minutes in which its delegation takes a position on detection itself. The record changes on the day such a document appears, and the changelog says so.

Record notes are short, dated entries: one document, what it says, what it changes on this site. Sources: Zanima.me, “Slovenija sprejela stališče proti nadzoru zasebne komunikacije”, 2 October 2025; Government of Slovenia, “National Assembly confirms new government cabinet”, gov.si, 5 June 2026; Ministry of the Interior and Public Administration, gov.si; netzpolitik.org, “Interne Dokumente: Trilog zur Chatkontrolle geht in entscheidende Phase”, 12 June 2026, with the German delegation’s minutes of the JHA counsellors’ meetings of 21 May and 10 June 2026; Council of the EU, presidency note to Coreper, document 10499/26, 22 June 2026; Slovenia in the record, changelog of 9 September 2026.

On 7 July 2026 the Irish presidency sent the 27 delegations a note on the outcome of the fifth trilogue on the Child Sexual Abuse Regulation, Chat Control 2.0, and on the next steps. It is document 11501/26, seven pages, and it sits in the Council’s public register. Until today this site dated the sixth trilogue from internal minutes published by netzpolitik.org on 2 July. The Council’s own note says the same, in its own words, and a little more.

What it says

The fifth trilogue of 29 June “brought significant progress by reaching provisional agreement on almost all the provisions of the proposed Regulation with the exception of detection”. Closed, according to the note: the scope of the regulation, risk assessment and mitigation measures, removal, blocking and delisting orders, and the requirements for national authorities. Age verification is out: the co-legislators “agreed that this Regulation was not the place to regulate age verification”. Voice messages stay within the scope of the regulation but are excluded from detection.

On detection, the one open question, the note records the Parliament as “ready to discuss the building blocks on detection, as proposed by the Cyprus Presidency in May 2026, conditional to the protection of end-to-end encrypted communication and to the respect for the prohibition of a general monitoring obligation”, and as willing to accept “the coexistence of detection orders and own-initiative searches, if a targeted approach and necessary safeguards were applied”. The technical teams were told to look for landing zones inside that frame. The note names no member state.

The dates

Technical meetings on 10 and 18 September prepare “the sixth trilogue scheduled on 29 September 2026 at the Council premises”. The counsellors of the 27 governments meet on the file on 14 September. Two days after the trilogue, on 1 and 2 October, justice and home affairs ministers meet in Luxembourg; the file is not on the draft agenda the Council published in June (document 10983/26), so anything the negotiators bring back would reach ministers under any other business.

What it changes in the record

The date of the sixth trilogue now rests on the Council’s own document rather than on leaked minutes alone. The Chat Control Tracker, Where the 27 governments stand and Who decides, by name were updated today with the note, the technical meetings and the ministers’ meeting of 1 and 2 October. The article on what the 29 September trilogue can decide was corrected: it gave 8 and 9 October for that meeting. The positions of the 27 governments do not change; the note does not speak for any of them.

Record notes are short, dated entries: one document, what it says, what it changes on this site. Sources: Council of the EU, presidency note to delegations, document 11501/26, 7 July 2026, public register; draft agendas for Council meetings during the Irish presidency, document 10983/26, 25 June 2026; Justice and Home Affairs Council, 1 and 2 October 2026, Council meeting calendar.