Leaked responses from 20 countries to an EU proposal show the majority favor some form of scanning encrypted messages, with Spain wanting an EU-wide E2EE ban
In response to an EU proposal to scan private messages for illegal material, the country's officials said it is “imperative that we have access to the data.”
Context & Ripple Effects
This leak lands mid-way through the EU's Chat Control saga. The Commission's 2022 draft law ordering platforms to scan private messages for CSAM had already drawn warnings that it threatens end-to-end encryption; what was unknown until now is where member states actually stand. The answer: most of the twenty responding governments want some form of scanning anyway, and Spain goes furthest by urging an outright EU-wide E2EE ban.
First-order effects
- Spain's 'imperative that we have access to the data' stance hardens the pro-scanning bloc inside the Council, giving the Commission leverage against the privacy experts who had already called the plan a threat to democratic values.
- Messaging providers serving the EU — WhatsApp, Signal and peers — now face a Council majority actively seeking access to encrypted traffic, not merely a proposal they could lobby down.
Second-order effects
- Encryption defenders escalate: Signal's Meredith Whittaker frames upload moderation as fundamentally undermining encryption, and expert pushback pushes the process toward carve-outs — visible later when Parliament advances a version with an exemption for E2EE services.
- Member-state unity cracks under the pressure: Denmark ultimately withdraws its backing of mandatory scanning in favor of voluntary approaches, forcing proponents to rebuild a coalition.
Third-order effects
- If the pattern holds, EU encryption policy settles into an exemption-and-carve-out regime rather than a clean ban — scanning mandates for non-E2EE services while encrypted apps are nominally spared, leaving the real fight over whether client-side scanning erodes that line.
- The episode cements a precedent other jurisdictions can copy: once a major regulatory bloc extracts state access to private messages, comparable scanning requirements become the default ask for national regulators worldwide.
The trend: Governments are converging on mandated message scanning as a policy default, with encryption-preserving exemptions and member-state defections shaping how far each jurisdiction actually goes.