Did EU Chat Control Pass? What Is Actually in Force

Short answer: the part people mean has not passed, and the part that passed says the opposite of what it is usually reported to say.

Two different laws travel under the name “Chat Control”, and nearly every scary summary blends them. One is a temporary permission that is in force now. The other is a permanent regulation that would create detection orders, and that one is still being fought over.

Regulatory status as of 14 October 2026, with sources named below. This is a summary of public documents, not legal advice.

What is in force

Regulation (EU) 2026/1881, adopted 24 July 2026 and published in the Official Journal on 28 July 2026. It is a derogation: it lifts parts of the ePrivacy Directive so that providers may scan for child sexual abuse material. Four things about it are worth reading directly, because they are the ones most commonly got wrong:

• It is voluntary. It permits; it does not require. Its recitals describe “voluntary activities by providers to detect online child sexual abuse on their services.”
• It expressly excludes end-to-end encrypted chats. Article 1(3): it “does not apply to interpersonal communications to which end-to-end encryption is, has been or will be applied.”
• It says so again about encryption generally. Recital 32: “Nothing in this Regulation should therefore be interpreted as prohibiting or weakening end-to-end encryption.”
• It expires. Article 11: “It shall apply until 3 April 2028.”

So the instrument actually in force in the EU today permits voluntary scanning by providers, on communications that are not end-to-end encrypted, for the next eighteen months.

What has not passed

The CSA Regulation, the permanent one proposed in 2022, is the law that would allow authorities to issue detection orders compelling a provider to look. That is the part that generated the “scan every private message” headlines, and it is the part that is not agreed.

Where it actually stood this month, from the Council’s own paperwork: document CM 4365/26, issued by the General Secretariat on 1 October 2026, is the notice of meeting for JHA Counsellors (CSA Regulation) on 5 October 2026. Its one substantive agenda item reads:

“Outcome of the trilogue on 29 September 2026 and next steps”

A file whose counsellors are being briefed on the outcome of the latest trilogue is a file still in negotiation between Parliament and the Council, not one at a vote.

The four months nobody mentions

This is the part that got lost, and it is the most informative thing in the whole timeline.

The Commission proposed extending the old permission (Regulation (EU) 2021/1232) to 3 April 2028. Parliament rejected that extension in March 2026; it had wanted a shorter one, with narrower scope. The old permission then expired on 3 April 2026, which the Council’s own July 2026 statement confirms, and the replacement did not enter into force until the end of July.

So for roughly four months in 2026, voluntary scanning had no basis under the derogation at all. Reporting on both sides of the argument had predicted consequences for that gap in either direction; what is worth noticing is simply that the gap happened, quietly, in the middle of a debate conducted as though the measure were permanent and unstoppable.

(The March vote and the exact end-of-July entry-into-force date come from press and NGO reporting. The Regulation’s articles and recitals, and the Council notice above, are quoted from the primary texts.)

So what does this change for you?

Honestly: very little, and not in the direction the headlines suggest.

If your concern is a credential, such as a password, an API key or a recovery code you need to hand to a colleague, then scanning was never the thing that exposed it. What exposes it is everything that happens after delivery, and none of that has changed:

• the message sits in two chat histories indefinitely;
• it is on every linked device and desktop app;
• it is in the cloud backup, which is often not end-to-end encrypted unless someone switched that on;
• it appeared in a lock-screen preview, where a password is usually the first line;
• it is one long-press from being forwarded.

That was the real problem before this debate and it is the real problem after it. We wrote it up at length for one app in the six places a password stays after you press send, and the same shape applies to what Gmail’s confidential mode does and does not withhold.

The useful reaction to a surveillance debate is therefore not to find a cleverer way to put the same durable secret into the same durable channel. It is to stop sending things that have to persist, and to send something that stops working instead. The options are compared in how to hand someone a password without leaving a copy.

Where WaxSeal fits, and where it does not

WaxSeal is built on a thesis that sounds backwards until you look at it: the carrier should be a public channel. The sender encrypts the text on their own device for the devices of named recipients; the ciphertext goes to a vault the organisation controls and which cannot read it; and what travels through the chat app is an ordinary photo carrying an eight-byte reference. Not the secret. Not a link to the secret.

That is a deliberate choice rather than a compromise. A photo in a chat is unremarkable, nothing in it is a secret-bearing URL for a preview bot or a mail scanner to fetch, and forwarding it grants nobody anything, because access is bound to the recipient’s registered device and released locally by Face ID or Touch ID. The sender can revoke, expire, read-limit or require a PIN afterwards. Revoking stops further authorised opening; it cannot un-show what someone has already read, so a credential you no longer trust still gets rotated.

It also assumes something specific about who is on the other end: people you have already established trust with, out of band. WaxSeal is for handing a secret to a named colleague, not for meeting a stranger privately.

And the boundary, stated plainly because it is the thing that makes the rest credible: none of this is a way to put material past a lawful detection order, and we would not help with that. The property being claimed is narrower and checkable: an interceptor on the public channel gets no plaintext, from the channel, the network or the vault, individually or combined. What they can still see is a photo, some traffic and some metadata.

The one-line version

The temporary, voluntary permission passed and runs to 3 April 2028, and it explicitly does not touch end-to-end encrypted chats. The permanent regulation with mandatory detection orders has not passed and was still in trilogue as of October 2026. Meanwhile the things that have always leaked your passwords (the chat history, the backup, the linked laptop) never needed a law to do it.

Sources

• Regulation (EU) 2026/1881 of 24 July 2026, OJ L, 2026/1881, 28 July 2026: Articles 1(3) and 11, recitals 8, 12 and 32.
• Commission proposal COM/2025/797 (CELEX 52025PC0797), extending Regulation (EU) 2021/1232.
• Council of the European Union, General Secretariat, CM 4365/26, 1 October 2026: notice of meeting, JHA Counsellors (CSA Regulation), 5 October 2026.
• Council press material, July 2026, on the expiry of the previous interim measure and its reinstatement.