Ingress: the Chat Control 2.0 package, which extends EU communication controls, is back on the Council's table under the Danish Presidency. Critics say the law is being pushed forward with insecurity rhetoric and misleading claims, even though the proposal would break the end-to-end encryption and open the way for mass scanning on citizens' devices. A decision date of 14 October 2025 has been set.(reclaimthenet.org)

What happened?

Reclaim The Net reports on 29.9.2025 that Denmark is accused of spreading false or exaggerated allegations to justify the urgent adoption of Chat Control 2.0 - critics say the Mass Surveillance Act. The aim is to break the Council's previous stalemate and get the package through during the presidency.(reclaimthenet.org)

Digital rights organisation EDRi says that Denmark's new text recycles previous versions that have already failed and does not address the core issues: large-scale scanning of private communications and weakening of encryption. (European Digital Rights (EDRi))

What would the law do?

According to the EFF, Chat Control 2.0 would oblige communication and storage services - including end-to-end encryption - to scan all communications and files for "harmful material". The technical implementation would be based on client-side scanning: content would be scanned on the user's device before being encrypted and sent. In practice, this means access to everything on the device - regardless of suspicion.(Electronic Frontier Foundation)

Euronews summarises that if scanning is extended to encrypted services, it must be done on the user's device - which erodes the integrity of the encryption.(euronews)

Why is this a problem?

  • Encryption is weakened at the system level. More than 500 cryptography researchers warn in an open letter that forced device scanning creates new vulnerabilities and "function creep" for other purposes(TechRadar)
  • False positives and non-targeting. Campaign website FightChatControl points out that automated scanners often make mistakes and expose innocent people to false suspicions - while draining resources away from properly targeted protection. (Fight Chat Control)
  • Age verification and compulsory identification. According to EDRi, the proposal would make large-scale age and identity checks likely, which would limit anonymous expression and could discriminate against people without digital identifiers. (European Digital Rights (EDRi))

Nextcloud's analysis also shows that the package is at odds with the EU's own cybersecurity objectives and democratic ideals. (Nextcloud)

Timetable and political situation

According to several sources, the decisive date for the EU Council is Tuesday 14 October 2025.The Danish Presidency has made the package a priority, and the minority that was previously formed in December 2024 is now under pressure. Germany's final position will be key - internal disagreements could determine whether the blocking line remains or a "compromise" emerges that would still force the scan.(Tuta)

Why does it matter?

Chat Control 2.0 is not a narrow anti-crime tool, but a general scanning mandate for private communications. It would affect journalists, activists, fugitives from violence, corporate executives - and ordinary users whose security relies on strong encryption. As CyberScoop summarises, the technical requirement would effectively mean that applications would have to have access to the contents of the message before encryption. (CyberScoop)

What's next?

  • Follow the domestic government and Parliament's EU positions before 14 October 2025.
  • Check with services (e.g. Signal, WhatsApp, Proton) for possible reactions and impact assessments - some operators have previously hinted at exiting the market if encryption is broken(Electronic Frontier Foundation)
  • Take care of your own security: up-to-date operating systems, secure backups and a zero-trust approach will reduce the damage if new attack surfaces open up at the system level.

Sources (selected)

Reclaim The Net - Denmark and Chat Control 2.0 (29.9.2025); EFF - why Chat Control is mass surveillance; EDRi - Danish text doesn't solve problems; Euronews - scan on device breaks encryption; 500 cryptographers open letter (TechRadar article); Tuta - decision moment 14.10.2025; CyberScoop - technical impact on encrypted applications(reclaimthenet.org)