Chat control evaluation report: EU Commission again fails to demonstrate effectiveness of mass surveillance of intimate personal photos and videos

The EU Council’s current push to make Chat Control 1.0 (Regulation (EU) 2021/1232) permanent is legally and ethically reckless. The Commission’s own 2025 evaluation report admits to a total failure in data collection, an inability to link mass surveillance to actual convictions, and significant error rates in detection technologies. To permanently enshrine a derogation of fundamental rights based on a report that explicitly states “available data are insufficient” to judge proportionality is a violation of EU lawmaking principles.

Detailed Critique

1. The “Argument from Ignorance” on Proportionality

The Report: In Section 3 (Conclusions), the Commission states that “the available data are insufficient to provide a definitive answer” regarding the proportionality of the Regulation. Yet, in the very same paragraph, it concludes: “there are no indications that the derogation is not proportionate.”
The Critique: This is a logical fallacy. The Commission is arguing that because their data is too fragmented to prove the law is bad, it must be good. You cannot permanently suspend the fundamental right to privacy (Article 7, Charter of Fundamental Rights) based on an absence of data. The burden of proof lies with the legislator to demonstrate necessity and efficacy, which this report fails to do.

2. The Broken Link Between Surveillance and Convictions

The Report: Section 2.2.3 explicitly admits: “It is not currently possible… to establish a clear link between these convictions and the reports submitted by providers.” Furthermore, major Member States like Germany and Spain failed to provide usable data on convictions linked to this Regulation.
The Critique: As noted in my blogpost on the previous evaluation, there is no evidence that the mass scanning of private messages contributes significantly to convicting abusers. If millions of private messages are scanned and hundreds of thousands of reports are generated (708,894 in 2024), but the Commission cannot point to a specific number of resulting convictions, the system is a dragnet that violates privacy without a proven benefit to child safety. The system generates “noise” for law enforcement rather than actionable intelligence.

3. High Error Rates and “Black Box” Algorithms

The Report:

• Microsoft (Section 2.1.6) reported that its data was “insufficient to calculate an error rate.”
• Yubo reported error rates for detecting new CSAM/grooming of 20% in 2023 and 13% in 2024.
• The report notes that “human review is not factored into the statistics,” meaning the raw algorithmic intrusion is even less accurate than presented.

The Critique: Making this regulation permanent endorses the use of technology that is admittedly flawed. A 13-20% error rate in flagging “grooming” or new CSAM means thousands of innocent users are flagged, their private communications viewed by corporate moderators, and potentially reported to police erroneously. The fact that a giant like Microsoft cannot even calculate its error rate proves that Big Tech is operating without accountability or transparency. According to the German Police and former EU Commissioner Johansson the actual error rate is far higher (50-75%).

4. Chaos in Data and Lack of EU Control

The Report: The Commission admits that providers “did not use the standard form for reporting” (Section 1) and that Member States provided “fragmented and incomplete” data. The disparity between NCMEC reports sent to Member States vs. reports acknowledged by Member States is massive (e.g., France received 150k reports from NCMEC but has incomplete processing data).
The Critique: The EU cannot effectively oversee this surveillance. If, after three years, the Commission cannot force providers to use a standard reporting form or get Member States to track basic statistics, the Regulation is dysfunctional. Making a dysfunctional temporary fix permanent is poor governance. It cements a system where US tech giants (Google, Meta, Microsoft) act as private police forces with no standardized oversight.

5. Obsolescence via Encryption

The Report: The report notes a 30% drop in reports concerning the EU in 2024, attributed largely to interpersonal messaging services moving to end-to-end encryption (E2EE) (Section 2.2.1).
The Critique: The Regulation is already obsolete. As noted in the previous commentary, as platforms move to E2EE (like Meta), voluntary scanning becomes impossible without breaking encryption (client-side scanning). The drop in reports proves that voluntary scanning is a dying model. Making this Regulation permanent is a desperate attempt to cling to a failing approach rather than investing in targeted investigations and “safety by design” that respects encryption.

6. Failure to Assess Privacy Intrusion

The Report: The conclusion states: “No information was submitted by the providers on whether the technologies were deployed… in the least privacy-intrusive way.”
The Critique: The Regulation requires that the derogation be used only when necessary and in the least intrusive manner. The Commission admits it has no information on whether this legal requirement is being met. To extend a law permanently when the primary safeguard (minimization of privacy intrusion) is not being monitored is a dereliction of duty.

Conclusion

The Council looks to permanently legalize a regime of mass surveillance where:

1. The technology has double-digit error rates (Yubo).
2. The efficacy (convictions) is unproven.
3. The oversight (data collection) is broken.
4. The targets (encrypted chats) are increasingly immune to it.

This confirms the fears raised in the previous evaluation: this is performative security that sacrifices the privacy of all citizens for a system that the Commission admits it cannot properly measure or validate.

Read on: chatcontrol.eu

patrick-breyer.de/en/chat-cont…

L’Ombudsman condanna la Commissione per gli Omnibus e altre leggi fatte con il culo immotivatamente adottate di corsa

La Mediatrice europea, Teresa Anjinho, ha condannato la sua Commissione per mala amministrazione, evidenziato diverse carenze procedurali nella preparazione di proposte legislative sull’Omnibus 1 (il pacchetto di semplificazione sulla due diligence societaria in materia di sostenibilità), sulla Politica Agricola Comune (PAC) e sul contrasto al traffico di migranti. Durante la preparazione di queste proposte urgenti, la Commissione non ha rispettato alcune regole interne, necessarie per garantire che il processo legislativo sia basato su evidenze, trasparente e inclusivo. Certi principi di buona legislazione non possono essere compromessi nemmeno per motivi di urgenza”, ha detto la Mediatrice Anjinho, ricordando che “è essenziale mantenere responsabilità e trasparenza nei processi legislativi”.

ombudsman.europa.eu/it/press-r…

@Politica interna, europea e internazionale

Reality Check: EU Council Chat Control Vote is Not a Retreat, But a Green Light for Indiscriminate Mass Surveillance and the End of Right to Communicate Anonymously

Contrary to headlines suggesting the EU has “backed away” from Chat Control, the negotiating mandate endorsed today by EU ambassadors in a close split vote paves the way for a permanent infrastructure of mass surveillance. Patrick Breyer, digital freedom fighter and expert on the file, warns journalists and the public not to be deceived by the label “voluntary.”

While the Council removed the obligation for scanning, the agreed text creates a toxic legal framework that incentivizes US tech giants to scan private communications indiscriminately, introduces mandatory age checks for all internet users, and threatens to exclude teenagers from digital life.

“The headlines are misleading: Chat Control is not dead, it is just being privatized,” warns Patrick Breyer. “What the Council endorsed today is a Trojan Horse. By cementing ‘voluntary’ mass scanning, they are legitimizing the warrantless, error-prone mass surveillance of millions of Europeans by US corporations, while simultaneously killing online anonymity through the backdoor of age verification.”

The Three Hidden Dangers of the Council’s “Voluntary” Deal

The Council’s mandate stands in sharp contrast to the European Parliament’s position, which demands that surveillance be targeted only at suspects and age checks are to remain voluntary. The Council’s approach introduces three critical threats that have largely gone unreported:

1. “Voluntary” Means Indiscriminate Mass Scanning (The Chat Control 1.0 Trap)
The text aims to make the temporary “Chat Control 1.0” regulation permanent. This allows providers like Meta or Google to scan all private chats, indiscriminately and without a court order.

• The Reality: This is not just about finding known illegal images. The mandate allows for the scanning of private text messages, unknown images, and metadata using unreliable algorithms and AI.
• The Failure: These algorithms are notoriously unreliable. The German Federal Police (BKA) has warned that 50% of all reports generated under the current voluntary scheme are criminally irrelevant.
• Breyer’s comment: “We are talking about tens of thousands of completely legal, private chats being leaked to police annually due to faulty algorithms and AI. This is no more reliable than guessing. Calling this ‘voluntary’ does not make the violation of the digital secrecy of correspondence any less severe.”

2. The Death of anonymous communications: Age Checks for Everyone
To comply with the Council’s requirement to “reliably identify minors,” providers will be forced to verify the age of every single user.

• The Reality: This means every citizen will effectively have to upload an ID or undergo a face scan to open an email or messenger account.
• The Consequence: This creates a de facto ban on anonymous communication—a vital lifeline for whistleblowers, journalists, political activists, and abuse victims seeking help.
• Unworkable alternative: Experts have warned that other methods for “Age assessment cannot be performed in a privacy-preserving way with current technology due to reliance on biometric, behavioural or contextual information… In fact, it incentivizes (children’s) data collection and exploitation. We conclude that age assessment presents an inherent disproportionate risk of serious privacy violation and discrimination, without guarantees of effectiveness.”

3. “Digital House Arrest” for Teenagers
Under the guise of protection, the Council text proposes barring users under 17 from using apps with chat functions—including WhatsApp, Instagram, and popular online games—unless stringent conditions are met.

• The Reality: This amounts to a “Digital House Arrest,” isolating youth from their social circles and digital education.
• Breyer’s comment: “Protection by exclusion is pedagogical nonsense. Instead of empowering teenagers, the Council wants to lock them out of the digital world entirely.”

A Dangerous Road to 2026

Today’s vote was far from unanimous, with the Czech Republic, the Netherlands, and Poland voting against, and Italy abstaining, reflecting deep concerns within the EU about the legality and proportionality of the measure.

Negotiations (“Trilogues”) between the Council and the European Parliament will soon begin, with the aim of finalizing the text before April 2026.

“We must stop pretending that ‘voluntary’ mass surveillance is acceptable in a democracy,” Breyer concludes. “We are facing a future where you need an ID card to send a message, and where foreign black-box AI decides if your private photos are suspicious. This is not a victory for privacy; it is a disaster waiting to happen.”

Background Information & Contact

About the Vote: The Council mandate was today endorsed by the Committee of Permanent Representatives (COREPER).
About the Procedure: The text will now be negotiated with the European Parliament. The Parliament’s mandate (adopted in Nov 2023) explicitly rules out indiscriminate scanning and demands targeted surveillance based on suspicion.

More information: chatcontrol.eu

patrick-breyer.de/en/reality-c…