- >At the beginning of the month, the Danish Presidency decided to change its approach with a new compromise text that makes the chat scanning voluntary, instead.
Hmm, so this will probably make the life for those who don't scan quite hard and if they experience a high profile scandal getting out of it will not be easy I assume.
I'm not sure what to think of it, not being mandatory and requiring risk assessment sounds like "Fine, whatever don't do it if you don't want to do it but if something bad happens it's on you". May be fair to some extent, i.e. Reddit and Telegram can decide how much they trust their users not to run pedo business and be on the hook for it.
On the other hand, it is a backdoor and if the governments go crazy like they did in some other countries where high level politicians are implicated with actual pedophiles and have a tendency for authoritarianism Europe may end up having checking user chats for "enemies of the state" instead of CSAM materials. Being not mandatory here may mean that you get constant bullying because you must be hiding something.
by emptysongglass
1 subcomments
- I am ashamed to be Danish. Where are the mass protests of hundreds of thousands, the mass walkouts from our workplaces until our government at last respects our human dignity?
Our government has today turned the EU into a tool for total surveillance I don't know if there can be any return from. Our democratic processes have been abused, and our politicians shown to be nothing but craven, self-interested agents of control.
- Misleading title, the council approves their mandate for negotiations with parliament. It’s still a long way to go before it turns into law and I think it’s rather unpopular in parliament.
by jasonvorhe
2 subcomments
- Good old salami tactics still work. Same goes for going way over target to then settle for your actual goal.
Good old democracy at work.
by general1465
2 subcomments
- Is there still a loophole for politicians not to be tracked? Because if so, some people will make a lot of money by creating a political party and turning citizens into politicians for yearly fee and thus bypassing this whole law.
by LudwigNagasena
0 subcomment
- Sad to see Europe morph from postal secrecy to chat control. I can’t imagine 19th century intellectuals would do anything other than laugh in the face of censors who would suggest that the governments need to read personal correspondence to protect children and/or national interests against Prussia/Russia/China.
- Honest question. The EU was created as an economic and trade institution. How has it morphed into a wierd political institution, which NATO was already supposed to be?
The root question: how did an organization that ushered in things like the Euro become a body that decides whether Europeans are allowed to have personal privacy?
- The trick is that because they could not pass the proposal that enforces message scanning, now this proposal defines "high risk activities" and in the case of high risk activity, the national authorities can force someone to comply (i.e. start to scan messages, block, stop activity).
Here is the actual text: https://data.consilium.europa.eu/doc/document/ST-15318-2025-...
High risk classification is at the end of the text.
Some highlights of what is defined as high risk, and thus can be forced to go through mandatory scanning or forbidden:
- Encrypted messaging follows closely due to privacy concerns and the potential for misuse. Posting and sharing of multimedia content are also high-risk activities, as they can easily disseminate harmful material.
- The platform lacks functionalities to prevent users from saving harmful content (by making recordings, screenshots etc.) for the purpose of the dissemination thereof (such as for example not allowing recording and screenshotting content shared by minors)
- Possibility to use peer-to-peer downloading (allows direct sharing of content without using centralised servers)
- The platforms’ storage functionalities and/or the legal framework of the
country of storage do not allow sharing information with law enforcement
authorities.
- The platform lacks functionalities to limit the number of downloads per user
to reduce the dissemination of harmful content.
- Making design choices such as ensuring that E2EE is opt-in by default, rather than opt-out would require people to choose E2EE should they wish to use it, therefore allowing certain detection technologies to work for communication between users that have not opted in to E2EE
Also, a lot of these points do not sound like they are about the safety of children
- Platforms lack a premoderation system, allowing potentially harmful content
to be posted without oversight or moderation
- Frequent use of anonymous accounts
- Frequent Pseudonymous behavior
- Frequent creation of temporary accounts:
- Lack of identity verification tools
Based on the light of the proposal, Hacker News is very dangerous place and need to have its identity verification and CSAM policies fixed, or face the upcoming fines in the EU.
by HeavyStorm
0 subcomment
- Honest question: let's say I get an email and encrypt it with a highly secure key, or maybe I just encrypt a file and send it through WhatsApp. That might not be as easy or secure as a double ratchet, but, is it against chat control?
by johnwayne666
1 subcomments
- Does this already include the parliament's position based on a trilogue or will there be amendments before it's voted in parliament?
- How is it possible this thing can just keep coming back and back? There should be a law that gives these kinds of bills a cooldown period of 2 years or so that prevents them from being reintroduced with slightly different wording.
- One thing with chat control I don't get is why can't it be vetoed by a single member? That doesn't seem like part of regular trade policy competency of the EU
by throw_a_grenade
0 subcomment
- The crux is in those „risk assessments”, to be approved by authorities. IIUC those authorities will be able to designate e.g. Signal „high risk” and slap penalties unless they „mitigate” the risk. Hard to tell what will happen without seeing final regulation.
- They're are merely extending the current policy, it was set to expired early next year.
- I know it's the recognized term for 'officially designated authority', but 'competent authority' seems to conflate two traits that do not necessarily co-habit.
by deafpolygon
0 subcomment
- The wording on all this is incredibly vague. The intentions are pretty clear, but as the saying goes… the road to hell…
- Why follow the EU's press release instead of stating what's happening? The EU parliament voted - many times. They voted AGAINST having this law at all. The EU council is now threatening to fully override parliament, but "gives parliament another chance" to agree, in hopes this makes the member states more likely to cooperate.
More correct would be to state the in power EU governments have decided to use the EU council power to override the will of both the EU parliament and the member states' own parliaments - for now, by threatening parliament with the override.
by thomasjeff1
0 subcomment
- Oh, but we are terrified of child sexual abusers online :D
- Is this the end of secure communication within EU?
- Orwell would be proud.
- Taking the reasons at face value (for the sake of argument) I guess what I'm confused about is why this would be necessary. I would think there were already laws/regulations/liability reasons/etc requiring companies to make efforts to ensure they're not hosting CP and other such things? Am I wrong?
by constantcrying
0 subcomment
- I just want to reiterate that in Germany getting convicted of gang raping a 15 year old (and stealing her phone and purse and filming the rape) is something which gets you probation. Yes, the crime was proven, there was no doubt about the guilt.
In this context putting the entirety of the population under the suspicion of facilitating child rape is completely and utterly deranged.
by giuliomagnifico
1 subcomments
- In a nutshell, there will be no more intrusions into chats, but only obligations for the companies to provide preferential channels for victims of these crimes.
by raverbashing
0 subcomment
- Note this is the council position
The path from position to actual implementation (details) is long
And you can bet there's still a lot of opposition of people (with actual involvement in the legislative process)
And legal hurdles for implementation as well
(this all reminds me of the discussion around the copyright directive where people here were decrying it was going to be the end of memes. So, how did that go again?)
- This is a major win! Basically: It's now (still) voluntary for services to implement scanning for CSAM material. Not mandatory. End-to-end encryption will continue to be legal.
Source: Swedish national public service radio (Sveriges Radio) interviewing Jon Karlung, CEO of Bahnhof AB - a major privacy-centric and politically outspoken ISP in Sweden. Think XS4ALL (RIP) but in Sweden. Here's the interview: https://www.sverigesradio.se/artikel/efter-flera-ar-eu-overe... (Swedish speech).
Here's their blog post (in Swedish, use browser translation tools):
https://bahnhof.se/2025/11/26/eu-bromsar-chat-control/
by ChrisArchitect
1 subcomments
- [dupe] https://news.ycombinator.com/item?id=46056358
- They could have subpoenaed the unencrypted Gmail accounts of Maxwell, Epstein and Barak like two decades ago. They can still subpoena Barak's Gmail and other accounts, especially after Giuffre's allegations about "a well known prime minister".
I have the feeling this will not happen.
by jauntywundrkind
0 subcomment
- Given how badly the EU just folded on GDPR, data protection and AI laws (which were good laws generally imo, and tragic to see useful exercise of sovereignty erased), I want to have hope that this might not stand.
But unfortunately I feel like the big tech interests probably somewhat want this happen, are happy to hand the citizenry over to the state. That we won't hear much from them over this all. With some notable Signal sized / Medium Tech exceptions.
It sure does seem like there's a huge legitimacy crisis the EU council is creating around itself by going so far against the will of the people, by intruding so forcibly into literally everyone's life.
- Seems… fine? At least i dont see any invasion of privacy or encryption related obligations in this proposal.
The EU ostensibly wants to improve innovation, i wonder how these new assessment regulations help with that, especially for SME and startups.
Hacker News