This is the story of how a dead EU surveillance law came back through the back door \u2014 the sequel to our December 2026 deadline warning<\/a>, what the revived law actually says (less than the headlines suggest), and \u2014 most importantly \u2014 exactly where the fight goes from here. Because the fight is not<\/em> over. It has a date: September 2026.<\/p>\n Six facts, all verifiable in the Official Journal:<\/p>\n One more number: a majority of voting MEPs did<\/em> vote to restrict scanning to judiciary-identified suspects \u2014 322 to 255. That amendment passed. And it died anyway, because at second reading, amendments also need an absolute majority. Rapporteur Damian Sippel called the whole maneuver “unfair.” He was being polite.<\/p>\n Think of it as a race condition exploited against a democratic system:<\/p>\n The ordinary legislative procedure assumes both institutions negotiate on roughly equal footing. But Article 294(5) TFEU has a failure mode: if Parliament can’t muster an absolute majority<\/em> (of all MEPs, not just those present) to reject or amend the Council’s position at second reading, the Council’s text passes automatically<\/strong>. No majority needed. Silence is consent.<\/p>\n Now schedule that second-reading vote for the final sitting day before the summer recess \u2014 when, as former MEP Patrick Breyer put it, “significantly fewer MEPs are present on this day” \u2014 and bypass the normal committee scrutiny with an urgent procedure approved July 7. The result: a law that a plurality of present-and-voting MEPs opposed becomes binding on 450 million people.<\/p>\n You don’t need to believe in conspiracies. You just need to read the procedure. It’s a privileged escalation path, and they used it.<\/p>\n Here’s where it gets less scary than the headlines \u2014 and the headlines were pretty scary. I pulled the full text of Regulation (EU) 2026\/1881. Three things matter:<\/p>\n 1. It’s still voluntary.<\/strong> The regulation “enabl[es] providers… to use specific technologies” for detection. That’s permission, not obligation. No provider anywhere is mandated<\/em> to scan anything. That’s why Breyer notes European messaging and email providers “have never implemented chat control measures anyway.” The refusal lever is real, and it’s in the text.<\/p>\n 2. End-to-end encryption is excluded \u2014 in the actual operative text.<\/strong> Not a press-release promise. Article 1(3): “This Regulation does not apply to interpersonal communications to which end-to-end encryption is, has been or will be applied.”<\/em> Audio communications are excluded too. Recital 32 adds that nothing in the regulation “should… be interpreted as prohibiting or weakening end-to-end encryption.” Euronews calls the wording “cosmetic” \u2014 providers weren’t scanning E2EE content anyway \u2014 but cosmetic or not, it’s statutory.<\/p>\n 3. No client-side scanning. Anywhere.<\/strong> The phrase “client-side” appears zero times in the regulation. Client-side scanning \u2014 spyware on your device \u2014 remains Chat Control 2.0 territory, and there it’s currently losing.<\/p>\n What IS covered: the non-E2EE direct-message layers of platforms like Instagram, Discord, Snapchat, Skype, Xbox, plus email services like Gmail and iCloud. Voluntarily. Until April 2028.<\/p>\n And here’s the accountability angle that should actually enrage you: when the derogation lapsed April 3, Google, Meta, Microsoft, and Snap signaled in a joint statement<\/a> they’d “continue to take voluntary action” \u2014 scanning that EFF and netzpolitik point out has been operating without legal basis since the April expiry. The back-door law didn’t start the scanning. It laundered it.<\/p>\n Chat Control 1.0 is the temporary zombie. Chat Control 2.0 \u2014 the permanent CSAR regulation \u2014 is the actual war, and it’s in trilogue right now.<\/p>\n EFF framed it precisely: “This is a zombie proposal. It keeps coming back and must not be allowed to return through the back door.” It just did \u2014 once. The second attempt is scheduled.<\/p>\n Here’s the part most coverage gets wrong. This is not a “lie back and think of the children” moment. It’s a build-and-fight moment, and the law itself concedes the ground:<\/p>\n Signal, WhatsApp, any E2EE service: the operative text of the law does not apply to them. This isn’t a workaround; it’s Article 1(3). Your threat model for DMs should already have assumed the platform can read them \u2014 Instagram and Discord DMs were scannable before this law, during it, and after it. The fix is the same as it’s always been: E2EE for anything that matters.<\/p>\n The regulation only covers “number-independent interpersonal communications services” as defined in the EECC \u2014 and that definition applies to services “normally provided for remuneration.” Your personal Matrix or XMPP server, run for yourself and friends, is a different animal from a commercial provider. And since scanning under 2026\/1881 is voluntary even for covered providers<\/em>, a self-hosted server you control has no scanning path at all. That’s not a loophole \u2014 that’s architecture. (Full disclosure: no first-party EU statement names self-hosted servers explicitly; this is legal analysis from the statutory text, and I’d bet the farm on the text.)<\/p>\n European providers never implemented chat control \u2014 which is living proof that “voluntary” means optional. If you run a messaging or email service in the EU: you are not required to scan. Choosing not to is a lawful, precedented act of resistance. Say so publicly. Every European provider that refuses makes the “voluntary” fiction harder to maintain.<\/p>\n The permanent law is negotiated by people who answer to voters. Fight Chat Control<\/a> and EDRi’s action page<\/a> are running exactly that campaign. The specific asks worth backing come from Breyer’s alternative framework: mandatory detection orders targeting suspects<\/em> instead of indiscriminate scanning, an EU center for removing known abuse material from the open web, and Security-by-Design requirements for messaging apps. That’s a child-safety policy that doesn’t require surveilling everyone. It exists. It’s on the table. It needs votes.<\/p>\n Every piece of the Sovereign Stack<\/a> \u2014 self-hosted services, E2EE defaults, owned identity \u2014 shrinks the surface these laws can reach. Governments can revive zombie procedures. They cannot revive access to data that never existed on a scannable server. The identity migration playbook<\/a> applies here too: pseudonymous, key-based identity is the countermeasure to compulsory age verification, and that fight is coming in September.<\/p>\n As Lyudmyla Kozlovska put it after the July vote: “The real fight for encryption and the privacy of communication is in September, over Chat Control 2.0. Between now and then, the resistance has to be strong enough that no procedural trick can carry it.”<\/p>\n A law that passes without the consent of a voting majority is not a verdict on privacy. It’s a confession that its authors couldn’t win the argument on the merits. They needed an empty chamber. You don’t have to accept the frame that surveillance is inevitable \u2014 the text of their own law exempts encryption, excludes audio, mandates nothing, and expires. Build accordingly. Fight accordingly.<\/p>\n Stay free. Stay encrypted. Stay impossible to scan.<\/p>\nThe 90-Second Timeline<\/h2>\n
![\"Timeline](\"https:\/\/thethriftydev.com\/blog\/wp-content\/uploads\/2026\/08\/01-timeline.png\")
\n
The Back Door, Explained Like You’re a Builder<\/h2>\n
![\"Article](\"https:\/\/thethriftydev.com\/blog\/wp-content\/uploads\/2026\/08\/02-procedure.png\")
What the Law Actually Says: Regulation (EU) 2026\/1881 Explained<\/h2>\n
![\"Covered](\"https:\/\/thethriftydev.com\/blog\/wp-content\/uploads\/2026\/08\/03-scope.png\")
The Real Fight Is September: Chat Control 2.0<\/h2>\n
![\"CSAR](\"https:\/\/thethriftydev.com\/blog\/wp-content\/uploads\/2026\/08\/04-csar2.png\")
\n
The Resistance Stack: What You Actually Do Now<\/h2>\n
![\"Five](\"https:\/\/thethriftydev.com\/blog\/wp-content\/uploads\/2026\/08\/05-resistance.png\")
1. Move your sensitive comms to E2EE. It’s now legally carved out.<\/h3>\n
2. Self-host your messaging. The scope definitions work in your favor.<\/h3>\n
3. Refuse, loudly, if you run a covered service.<\/h3>\n
4. Make September loud.<\/h3>\n
5. Build the infrastructure that makes this permanent.<\/h3>\n
What to Watch<\/h2>\n
![\"Radar:](\"https:\/\/thethriftydev.com\/blog\/wp-content\/uploads\/2026\/08\/06-watch.png\")
\n
Primary Sources<\/h3>\n
\n