If a message is not end-to-end encrypted, treat it as readable by the company that runs the service. In the European Union, that is not a paranoid habit. It is how the law works, today.
Regulation (EU) 2026/1881 — the temporary rule nicknamed Chat Control 1.0 — lets providers of messaging and webmail choose to scan unencrypted content and related traffic data to detect child sexual abuse material and the solicitation of children, and to report and remove it. It is voluntary, not a mandate. It does not cover audio. And it does not apply to “interpersonal communications to which end-to-end encryption is, has been or will be applied.” Nothing in the text should be read as prohibiting or weakening end-to-end encryption.
That last line protects encrypted apps under the law now in force. It is not a promise about the permanent law still being negotiated, and it is not a reason to keep sending your private life through a service the provider can already read.
Status as of 12 November 2026. The previous temporary regime expired on 3 April 2026. The new regulation was adopted on 24 July 2026, published on 28 July, and entered into force three days later: 31 July 2026. It applies until 3 April 2028.
What this means in practice
A VPN does not help here. The scanning the regulation permits happens on the provider’s systems, after your message has already arrived there. HTTPS is not end-to-end encryption. End-to-end encryption means only the devices in the conversation can read the content.
Some of the largest services have already said, in their own reports, that they scan unencrypted private messages or accounts:
Meta runs media-matching on images and video in Messenger and Instagram Direct “on surfaces that are not end-to-end encrypted.” In 2024 it actioned about 1.5 million pieces of material in private threads that included an EU user.
Microsoft publishes annual EU CSAM reports for services including Outlook, Teams, Skype, and GroupMe.
Google says it uses automated tools, including hash matching and machine learning, “to analyze the content of your Google Account for CSAM.” Gmail is a Google Account service, and webmail is in the regulation’s scope. Google’s CSAM report covers its platforms as a whole, not Gmail alone.
WhatsApp and other chats that are end-to-end encrypted sit outside this temporary law. An Instagram or Messenger thread that is actually end-to-end encrypted does too. An ordinary Gmail, Outlook, or unencrypted Instagram DM does not.
What’s next: Chat Control 2.0
The temporary regulation was always a bridge. The permanent proposal — the Child Sexual Abuse Regulation, or Chat Control 2.0 — is still in trilogue.
As of the sixth political trilogue on 29 September 2026, negotiators had a provisional agreement on the tasks of a new EU Centre and, in principle and as part of a package, on detection orders for public content limited to known material. They had not agreed on scanning private messages, according to the Council presidency (document trail via Brussels Record).
The Parliament has pushed for any private-content detection to be targeted, limited to known material, and a last resort. The presidency said it did not have a mandate to agree to detection orders in private content, and that end-to-end encrypted content would be excluded from the own-initiative searches the Council wants. Those are bargaining positions, not a finished law.
A seventh trilogue is “tentatively” set for December 2026 at the Parliament. MLex and former MEP Patrick Breyer have reported 8 December; the presidency note does not name a day, so we treat that date as unconfirmed.
This file still matters for every end-to-end encrypted app. Earlier fights have included client-side scanning: checking content on the device before it is encrypted. That would pierce the protection the temporary law leaves in place. Signal’s president, Meredith Whittaker, wrote in October 2025 that if Signal had to choose between building “a surveillance machine into Signal or leaving the market, we would leave the market.”
Our view
We think the fight against child sexual abuse is necessary. We do not think ordinary private correspondence should be treated as a dataset.
Our rule is simple, and we keep it ourselves: do not put personal details, or anything you would not want a stranger or a company to read, on a channel that can be read. If you would not want it forwarded, logged, or handed over, do not send it unencrypted.
End-to-end encryption is not magic. It protects the content of the message, not necessarily all metadata — who talked to whom, when, and from where. The person you are writing to can still take a screenshot. A stolen phone can still give everything away. Encrypting mail on Tuta or Proton does not make a copy sitting in someone else’s Gmail private. They are not a reason to stay on a service that can already open the envelope.
What we recommend
Check the app. End-to-end encryption should be the default, not a hidden toggle, and it should apply to the conversation you are actually using. If the company can reset your password and still show you years of old chats, it can read them. “Encrypted” that only means HTTPS is not enough.
For messaging with family and friends, we recommend:
Session. No phone number. Messages are end-to-end encrypted and onion-routed, a genuine metadata advantage. Session dropped the Signal protocol in late 2020, and with it perfect forward secrecy; a V2 protocol meant to restore PFS is still under design.
Signal. End-to-end encryption is on by default for messages and calls, and the protocol is the one others copy. You still need a phone number to register, though usernames can hide that number from other users. Metadata protection is weaker than Session’s because Signal runs centralized servers.
Radar. A Signal fork from the Cake Wallet team, with built-in Bitcoin payments over Lightning. Messages and calls are always end-to-end encrypted, it is open source (AGPLv3), and existing Signal contacts come with you. Like Signal, it requires a phone number; Session is the option if you want to avoid that. Radar is not affiliated with Signal.
For email, we recommend Tuta Mail or Proton Mail. Mail between two users of the same service is end-to-end encrypted. Tuta also encrypts subject lines. A normal message to Gmail is not end-to-end encrypted on Gmail’s side; both providers offer a password-protected option for those cases, and you have to share the password separately. Proton encrypts subject lines in storage, but not end-to-end.
Move the conversations that matter, a private channel only works if both sides are on it.
The temporary law expires in April 2028, unless a permanent one replaces it first. The practical step does not require permission from Brussels: send private things only on channels that cannot be opened in the middle.