The September 29 trilogue did not stop a scan. It failed to close a permanent one, and the posts the next day treated that miss as the result.
@TutaPrivacy wrote on September 30 that “we did it,” that the EU Parliament continues to oppose Chat Control 2.0, and that the next trilogue is in November. End-to-end encryption, they said, still has to be protected. @echo_pbreyer posted the same afternoon that there was no “dirty deal,” that Parliament stood firm, and that the threat remains, with the next showdown likely in November. @LyudaKozlovska called it blocked again, and listed what Council had wanted: “voluntary” scanning of private chats under search plans that start unless an authority vetoes them. Those posts describe a meeting, and the meeting is not the statute.
What the meeting actually did
The permanent file is the Child Sexual Abuse Regulation, procedure 2022/0155(COD). This was the sixth political trilogue. The Irish Presidency wanted a deal on the whole package. Patrick Breyer’s note from September 30 says that plan was blocked. The contested piece was the Council’s demand to allow unrestricted scanning of private messages and files, under what the governments have been calling search plans. Parliament’s negotiators held that scanning of private communications has to stay limited to persons linked to child sexual abuse. Breyer also records a textual point he treats as a win: the draft will say authorities cannot force voluntary scanning of private communications through the back door of “mitigation measures.”
That blocks one proposal. It does not repeal anything already in force, and it is not the only line in the note.
The part they did settle, on a preliminary basis, is public content. Parliament’s press release on September 30 quotes rapporteur Javier Zarzalejos. He says the Commission can soon start selecting a seat for a new EU Centre, because the institutions agreed its tasks. The Centre receives reports of child sexual abuse material from providers, checks that they are not unfounded, and sends them on. It keeps a database of indicators of known material. It proactively searches publicly accessible online content for known and new material. He lists constraints on that search: guidelines set with the Commission and the European Data Protection Supervisor, technology requirements taken from the regulation, a fundamental rights officer, a victims forum. He says work on the rest of the regulation continues with the Irish Presidency.
Breyer’s account of the same preliminary agreement is harsher, and it is the account I would not drop just because the press release is cleaner. He says administrative authorities, not only courts, can order hosting providers to scan publicly accessible content for known material. He says those platforms will have to continuously monitor all public uploads, not only uploads by users already suspected of a crime, which is the limit Parliament had proposed. He says the order can go to any hosting provider, any size. Council and Parliament have not published the compromise text. Brussels Record’s September 30 update says Council document 13051/26 records that the trilogue took place, and that the institutions have not published an outcome. Until they do, the continuous-monitoring sentence is Breyer’s reading. The Centre’s task list is on the Parliament site. I can use both. I cannot pretend I have read an article they have not released.
What Council asked for, and did not get, is spelled out in the same note, as the incoming proposal. Providers could scan non-public content, including messenger chats and non-public hosted files. A search plan could start unless an authority vetoed it. That would make permanent what the interim regulation allows only until 2028. “Voluntary” searches could be pulled into risk-mitigation rules, so a fine becomes the reason to scan. On the mandatory side, administrative authorities could order scans of private messages and email with no court and no named suspect, and detection could extend past known images into AI classification of suspected content. heise, on September 28, reported the Council line from leaked documents: a permanent law must not fall short of the scanning providers already do under the temporary regime. Parliament did not take that package on the 29th.
The private question moves to technical talks through October. Breyer expects another political trilogue in November. The Parliament release does not name a month. November is his date, not a published one.
The statute that did not need the meeting
The scan already in force is Regulation (EU) 2026/1881. Council adopted the extension on 23 July. It hit the Official Journal on 28 July. It applies until 3 April 2028. eucrim’s summary is the one I am using: providers of number-independent interpersonal communications may voluntarily process communications data, to the extent strictly necessary, to detect and report child sexual abuse and to remove the material. The regulation does not apply where end-to-end encryption is, has been, or will be applied. Agence Europe reported that same carve-out when Council adopted the text.
The chats inside that permission are the ones a provider can already read. Unencrypted mail. A DM product that holds the plaintext. Voluntary is the legal name for running a detector and filing a report. It does not mean the message stayed with the two people who sent it.
From 1 October 2026 to 3 April 2028 is 550 days. That clock does not pause because a permanent text slipped a round. Breyer’s fallback warning, in the same September 30 note, is that if Parliament keeps refusing a broader permanent power, Council will try to leave the interim regulation running beside whatever 2.0 becomes. It is already running. It does not need a November compromise to stay there.
He calls that interim regime a proven disaster, and he cites German police data for two figures: over half of investigations target minors themselves for consensual sexting, and 75% of flagged chats are not actionable. I have not re-checked those tables. I am not adopting his percentages as a count I made. The legal fact does not need them. A provider that can read an unencrypted chat is already allowed to scan it and send a report, until 3 April 2028. A meeting that failed to replace that permission did not cancel it.
@TutaPrivacy is aimed at the right object. End-to-end encryption is outside the current derogation, and the ugly version of this fight is a detection order, or a client-side scan, that reaches chats the provider cannot already read. Brussels Record, writing before this trilogue, said earlier rounds had carved encrypted communications out of the permanent draft, which is also how client-side scanning left that text. I would not treat a draft carve-out as finished. October is when someone tries to reopen a sentence.
If the app is actually end-to-end encrypted, the September 29 meeting did not newly expose the thread, and it did not newly guarantee it stays that way. If the app is mail, or a DM product where the company can read the history, the voluntary scan is the law for the next 550 days. A postponed regulation does not switch it off. On Breyer’s reading, the preliminary public deal lets an administrative authority order any hosting provider to watch every public upload. That is the part they were willing to close while the private part slipped.
I do not have the compromise text. The people posting “we did it” do not have it either. What is public is a Parliament release, Breyer’s note, regulation 2026/1881, and the date 3 April 2028. Read the preliminary text when they publish it. Until then, the regulation already in force is the one with an expiry date.