EU Council cancels vote on controversial online child protection law - updated

Proposed legislation has sparked intense debate over privacy and encryption integrity

Update: The EU Council has now withdrawn the vote on a controversial legislative proposal aimed at protecting children online by mandating the scanning of private digital communications.

Critics, dubbing the proposal "Chat Control", argue it infringes on privacy by requiring internet service providers to scan private messages, emails, social media interactions and photos for child sexual abuse material (CSAM).

The proposal acknowledges the challenges of banning encryption outright and instead suggests ‘client-side scanning' or ‘upload moderation'. This involves analysing content on devices before it gets encrypted and sent.

This approach aims to have local algorithms detect and block CSAM or report it to authorities, effectively compromising the core purpose of encryption.

A similar initiative by in August 2021 faced severe backlash from the security community and civil rights groups, leading to its abandonment later that year. Apple has since expressed considerable reservations about the mandating of client-side scanning as part of the Online Safety Act of 2023. This includes a content scanning requirement, though its enforcement remains uncertain due to the absence (at least at the moment) of accredited technology.

The US Earn-It Act proposes a comparable measure.

Opposition is intensifying

Opponents are intensifying their calls to reject the proposal. Signal CEO Meredith Whittaker, in an open letter on Monday, reiterated the dangers of the EU's client-side scanning plan, echoing previous threats to withdraw Signal from the UK if similar measures were implemented.

"There is no way to implement such proposals in the context of end-to-end encrypted communications without fundamentally undermining encryption and creating a dangerous vulnerability in core infrastructure that would have global implications well beyond Europe," Whittaker wrote.

European officials are accused of rebranding the concept under new terminology, like "upload moderation," in an attempt to push the same idea through.

"Some claim 'upload moderation' does not undermine encryption because it occurs before encryption," Whittaker stated. "This is untrue."

The Internet Architecture Board of the Internet Engineering Task Force provided a similar critique in December.

Encrypted communication service Threema echoed these concerns on Monday, warning that mass surveillance is incompatible with democracy, is ineffective and undermines data security.

"Should it pass, the consequences would be devastating: Under the pretext of child protection, EU citizens would no longer be able to communicate in a safe and private manner on the internet," Threema stated.

"The European market's location advantage would suffer a massive hit due to a substantial decrease in data security. EU professionals like lawyers, journalists, and physicians could no longer uphold their duty to confidentiality online. All while children wouldn't be better protected in the least bit."

Threema has also threatened to exit the EU if encryption isn't allowed.

On Tuesday, 37 Members of Parliament signed an open letter to the Council of Europe urging rejection of the proposal.

"We explicitly warn that the obligation to systematically scan encrypted communication, whether called 'upload-moderation' or 'client-side scanning,' would not only break secure end-to-end encryption, but will to a high probability also not withstand the case law of the European Court of Justice," the MEPs said. "Such an attack would be in complete contrast to the European commitment to secure communication and digital privacy, as well as human rights in the digital space."

20th June 15:58

The EU Council and its participants have decided to withdraw the vote on the contentious Chat Control plan.

According to Netzpolitik, "The EU Council did not make a decision on chat control today, as the agenda item was removed due to the lack of a majority, confirmed by Council and member state spokespersons".

A date for a new vote has not been set.