EU Chat Control – When Trust Is No Longer Enough

Protecting Children Without Sacrificing Freedom

Every democratic society eventually faces the same difficult challenge. It must protect its citizens from serious crime while preserving the very freedoms that define a free society. These two responsibilities are not in conflict. A democratic state has a duty to fulfil both. That is precisely why the rule of law and fundamental rights are tested whenever exceptional threats appear to justify exceptional measures.

Protecting children from sexual abuse is unquestionably one of the most important responsibilities of any state. Few would dispute that offenders must be prosecuted, victims supported, and child sexual abuse material removed and prevented by every lawful means available. On this point there is broad public consensus. The real debate begins only when the discussion turns to the methods used to achieve those goals.

A Legislative Proposal with Far-Reaching Consequences

For several years, the European Union has been working on legislation that could fundamentally change the way online child sexual abuse is addressed. At the heart of the proposal lies the question of whether providers of digital communication services should be permitted – or even required – to automatically scan private messages for known child sexual abuse material, previously unknown images, or signs of so-called grooming.

These proposals are commonly referred to as EU Chat Control. Although the term is politically contested and not an official designation, it accurately captures the central issue. Under certain circumstances, private communication could become subject to automated content analysis even when there is no concrete suspicion against the overwhelming majority of the people whose messages are being examined.

At first glance, the answer may seem obvious. If such measures can improve the protection of children, why should anyone oppose them? Yet it is precisely this apparent simplicity that calls for careful scrutiny. In a constitutional democracy, a legitimate objective alone is not enough to justify every exercise of state power. The means employed must be measured against the same constitutional standards as the purpose they are intended to serve.

When a Legitimate Goal Does Not Justify Every Measure

Among the most important legal safeguards are respect for human dignity, the right to privacy, the confidentiality of communications and the principle of proportionality. These protections do not exist merely for times of calm. Their true significance becomes apparent precisely when governments seek broader powers in response to serious threats.

The debate over EU Chat Control therefore reaches far beyond technical questions about data processing or encryption. It concerns the fundamental relationship between state authority and individual liberty. Should a democratic society be allowed to subject private communications to automated analysis without any concrete suspicion? Is the importance of a legitimate objective alone sufficient to justify such a profound intrusion into confidential personal conversations? And what would such a step mean for the very concept of privacy in an increasingly digital world?

These questions are not directed against the protection of children. Nor are they arguments against prosecuting serious crime. They concern a far more fundamental principle: that even well-intentioned government action must remain subject to constitutional limits.

Citizens Must Never Become Objects of Suspicion

The German Basic Law does not protect individual freedom because legislators wished to shield criminals. It protects freedom because a democratic state must never treat its population as a collection of potential offenders. Intrusions into particularly sensitive areas of private life therefore require a clear legal basis, a legitimate objective and convincing constitutional justification.

Targeted surveillance is normally based on concrete evidence. It focuses on identified individuals, is limited in scope and duration, and operates under strict legal safeguards. The automated examination of private communications follows an entirely different logic. Because the identity of offenders is unknown, the communications of vast numbers of innocent people are examined first in order to identify the few who may eventually become suspects.

Legally, those individuals are not treated as criminal suspects. Technically, however, their communications are processed as though they might contain evidence of wrongdoing. That represents a profound shift in the relationship between citizens and the state.

Trust Cannot Replace Fundamental Rights

There is another aspect of this debate that often receives too little attention. Trust cannot be created by legislation. It is earned through transparency, accountability and the consistent observance of clearly defined legal limits.

Surveillance measures require citizens to place considerable trust in public authorities. They are expected to believe that newly granted powers will be used only for their stated purpose, will never be gradually expanded and will not later be applied to different political or criminal investigations. Yet such assurances cannot bind future governments. Administrations change, political majorities shift, laws evolve and technical systems can always be adapted for additional purposes.

For that reason, the legality of a far-reaching surveillance infrastructure cannot depend solely on confidence in those who happen to hold office today. What ultimately matters is the authority the law actually creates – and whether it contains effective safeguards against future expansion.

Why Political Assurances Are No Longer Enough

Public confidence in national governments and European institutions has declined noticeably in recent years. This is not simply the result of broken political promises. It also reflects repeated experiences in which powers initially presented as limited have gradually expanded, temporary measures have become permanent, and legislative decisions have later been corrected by constitutional courts.

This does not mean that every new security measure is unlawful. It does, however, explain why official assurances are now viewed with greater scepticism than they were a generation ago. Anyone proposing a legal framework that enables the automated analysis of private communication cannot simply ask citizens to trust that such powers will always be exercised responsibly.

Fundamental rights are not expressions of confidence in those who govern. They are deliberately established limits on governmental power. Their purpose is to protect individual freedom even when political majorities pursue different priorities or when serious threats appear to make broader state powers seem unavoidable.

A Defining Question for the Digital Age

The debate over EU Chat Control is therefore about far more than software, algorithms or messaging services. It raises a fundamental question that every democratic society must answer: how far may the state go in protecting its citizens without endangering the very freedoms it exists to preserve?

The answer cannot depend solely on the importance of the objective being pursued. It must also take into account the powers that are created, the people they affect and the long-term consequences of allowing confidential communication to lose its protected status. That is why any serious constitutional examination does not begin by asking whether protecting children is important enough. It begins by asking whether a democracy may place the communications of its entire population under automated scrutiny in order to identify a small number of offenders.

What the European Union Is Actually Proposing

Anyone seeking to assess whether EU Chat Control is compatible with the principles of a constitutional democracy must first understand what the proposal actually entails. Political slogans alone are of little help. Few terms have become as widely used – and at the same time as widely misunderstood – as Chat Control.

It is important to begin with one clarification. Chat Control is not an official term used by the European Union. Rather, it has emerged through public and political debate as a convenient label for a range of legislative proposals aimed at combating child sexual abuse online.

The discussion began with a proposal put forward by the European Commission in 2022. Its stated objectives are to improve the detection of child sexual abuse material, strengthen the protection of children against online grooming, and enhance cooperation between online service providers, law enforcement agencies and a newly proposed European Centre dedicated to combating child sexual abuse.

Why Is Chat Control Being Discussed at All?

The most controversial aspect of these proposals concerns one simple question: should private digital communications be subject to automated content analysis?

This is where the debate truly divides. Supporters argue that such measures are indispensable for investigating some of the most serious crimes imaginable. Critics, by contrast, warn that they would fundamentally undermine the confidentiality of private communications.

Before these competing arguments can be evaluated fairly, it is worth understanding the technological background.

A significant proportion of today’s digital communication takes place through messaging services protected by end-to-end encryption. In simple terms, a message is encrypted on the sender’s device and can only be decrypted on the recipient’s device. During transmission, even the service provider itself cannot normally read its contents.

This technology protects far more than everyday conversations between friends and family. It also safeguards confidential exchanges between doctors and patients, lawyers and clients, journalists and their sources, businesses and employees, as well as many forms of communication within public institutions.

Yet the same encryption that protects privacy also presents challenges for criminal investigations. Because service providers cannot access message contents, investigators argue that offenders are increasingly able to exploit encrypted services without fear that communications can be examined. It is precisely this perceived investigative gap that the European proposals seek to address.

Three Technologies  –  Three Very Different Challenges

Public debate often treats the proposed detection methods as though they were technically identical. In reality, they involve three fundamentally different technologies, each raising distinct legal and practical questions.

The first concerns known child sexual abuse material. Detection in these cases relies on what are known as hash values – unique digital fingerprints assigned to individual files. If an image or video has already been identified as illegal and its hash stored in a reference database, the same file can later be recognised automatically without analysing the image itself. Since the system compares digital fingerprints rather than interpreting visual content, this method is generally regarded as comparatively reliable.

Far more complex is the detection of previously unknown material. Here no digital fingerprint exists. Instead, algorithms – or increasingly, artificial intelligence systems – would have to assess whether an image is likely to depict child sexual abuse.

Unlike hash matching, this process is based on probabilities rather than certainty. As a result, the risk of false positives and incorrect suspicions inevitably increases.

The third area concerns the detection of online grooming. Grooming refers to situations in which adults establish contact with minors for the purpose of preparing sexual exploitation or abuse.

Unlike image files, conversations cannot simply be matched against a known reference. An automated system would have to interpret human language and evaluate its meaning. Whether a conversation is criminal often depends on its wider context: the ages of those involved, their relationship, previous exchanges, cultural nuances and countless other factors. Human communication is therefore far less predictable than identifying a previously known digital file.

Between Technological Progress and Constitutional Limits

This is where the real controversy begins. Supporters argue that advances in technology could significantly improve the identification of offenders and strengthen the protection of children.

Critics counter that any automated scanning system inevitably processes the communications of countless innocent people before identifying the comparatively small number of potential offenders. They also question the reliability of such technologies, the possibility of false accusations and the consequences that an erroneous assessment could have for those affected.

Ultimately, however, the debate extends well beyond technological capability. The fact that something can be done does not answer the question of whether it should be done. A democratic society must therefore decide not only what technology makes possible, but also where constitutional principles require clear legal boundaries.

A Debate That Is Far From Over

The political negotiations remain ongoing.

The European Parliament, the Council of the European Union and the European Commission continue to hold differing positions on several key aspects of the proposal. Earlier drafts have already been revised, individual provisions amended and various compromise models discussed. The final shape of any future legislation therefore remains uncertain.

One question, however, survives every revision.

Can a constitutional democracy subject private communications to automated examination without individual suspicion in order to combat the most serious crimes? This question cannot be answered by technology alone. Nor can it be resolved solely through criminal policy. It is, above all, a constitutional question.

Before any assessment can be made of whether such powers are lawful, proportionate and compatible with democratic principles, it is necessary to examine the fundamental rights that protect confidential communication – and the limits that constitutional law places on state interference.

Why Fundamental Rights Matter Most in Difficult Times

Few concepts are invoked as frequently in political debate as the rule of law. Yet surprisingly little attention is paid to what distinguishes a constitutional democracy from a state whose powers continue to expand without meaningful restraint.

The difference does not lie in whether crime is prosecuted. Every functioning state has both the right and the responsibility to protect its citizens and enforce the law. The true distinction lies elsewhere.

A constitutional democracy is not defined by the absence of state power. It is defined by the willingness of the state to place legal limits upon itself. This principle is one of the most important lessons of European history.

Modern constitutions were not written during periods of stability and comfort. They emerged from the experience of authoritarian rule, political persecution and the abuse of governmental power. Their purpose was never to make governing easier. Their purpose was to ensure that political power could never determine its own limits.

Freedom does not exist because governments pursue worthy objectives. Freedom exists because governments themselves are bound by law.

Fundamental Rights Do Not Exist to Protect Criminals

This is why constitutional rights protect citizens not only from criminals but also from excessive state power.

At first glance, this idea may seem counterintuitive. Nearly every expansion of governmental authority is introduced with a legitimate objective: combating terrorism, fighting organised crime, preventing tax fraud or protecting children from sexual abuse. Few people would question the importance of these goals.

But constitutional law asks a different question. It asks not only what government seeks to achieve, but how it seeks to achieve it.

If the importance of an objective alone were sufficient to justify restrictions on liberty, fundamental rights would gradually lose their meaning. They would protect individuals only until they became inconvenient.

That is precisely why constitutional democracies require more than good intentions. Every intrusion into individual freedom must have a clear legal basis, pursue a legitimate aim and satisfy the principle of proportionality.

The more serious the intrusion, the stronger the constitutional justification must be.

Human Dignity as the Foundation

It is no coincidence that Germany’s Basic Law begins with a sentence that has shaped constitutional thinking for more than seven decades:

“Human dignity shall be inviolable.”

This principle is far more than an opening declaration. It binds every branch of government.

It establishes that every individual possesses an inherent value that the state must respect and protect. No person may be reduced to a mere object of governmental action.

From this fundamental idea, the German Federal Constitutional Court has developed a number of rights that have become increasingly important in the digital age.

These include the right to informational self-determination, the constitutional protection of the confidentiality and integrity of information technology systems, and the constitutional guarantee of the privacy of correspondence and telecommunications.

Although these rights differ in their legal foundations, they all pursue the same objective. They preserve a protected sphere in which individuals can think, communicate and develop freely without constant fear of observation or surveillance.

Freedom Requires a Protected Private Sphere

This protected sphere is not a privilege reserved for people who have something to hide.

It is one of the essential conditions of a free society. People speak differently with their partners than with their employers. They confide different thoughts to close friends than to public authorities. They discuss illnesses with doctors, legal concerns with lawyers and deeply personal matters with members of their families. These conversations are not merely private.

They are part of what makes individual freedom possible. A democratic society depends upon the existence of spaces in which citizens may communicate without fearing that every word could one day become the subject of analysis.

When people begin to expect that private conversations may be examined, even indirectly, behaviour changes. Ideas are expressed more cautiously. Sensitive topics are avoided. Trust declines. Freedom rarely disappears overnight.

More often, it slowly contracts – not through open prohibition, but through the awareness that someone may always be watching.

The Constitutional Standard

It is precisely here that the debate over EU Chat Control acquires its true constitutional significance.

The issue is no longer simply whether a new investigative tool may assist law enforcement. The deeper question is whether the state may enter one of the most protected areas of private life without any concrete suspicion directed at the individual concerned.

This question cannot be answered by political preferences, ideological convictions or public opinion. It can only be answered by the principles of constitutional law.

That is why the next step in this discussion must examine the specific fundamental rights that protect confidential communication – and whether the proposed European measures are capable of meeting the constitutional standards that every democratic government must ultimately respect.

When Exceptions Become the Rule

Laws are never created in a vacuum.

They are responses to changing societies, emerging threats and political challenges. Security legislation, in particular, is often introduced during periods of heightened public concern. Terrorist attacks, organised crime and horrific offences naturally increase the demand for decisive government action.

In such moments, expanding state powers can appear not only reasonable but necessary. The more difficult question is what happens once those powers have been established. History shows a recurring pattern.

New surveillance or investigative powers are usually introduced for a clearly defined purpose. They are presented as exceptional measures designed to address a specific threat and are often described as temporary or narrowly limited.

Over time, however, circumstances change. New risks emerge. Technology evolves. Political priorities shift.

With each new challenge comes the temptation to use existing powers for purposes that extend beyond their original scope.

The Logic of Function Creep

This gradual expansion has a well-established name in legal and social science: function creep.

The term describes the process by which powers or technologies introduced for one narrowly defined purpose are gradually applied to additional objectives.

An exceptional measure slowly becomes routine. A limited power becomes a permanent feature of government. Not every expansion is necessarily unlawful. Democratic societies must be able to respond to changing circumstances.

The real danger arises when the cumulative effect of many small extensions fundamentally alters the balance between individual liberty and state authority – often without attracting the same level of public scrutiny that accompanied the original legislation.

Seen in isolation, each individual step may appear reasonable. Taken together, they can transform the relationship between citizens and the state.

Lessons from Earlier Political Decisions

German legal history offers several examples of this dynamic.

One of the most widely discussed was the Access Impediment Act (Zugangserschwerungsgesetz) adopted in 2009. Its stated purpose was to make websites containing child sexual abuse material inaccessible through internet blocking.

Few questioned the objective. The controversy centred on the method. Critics argued that blocking websites did not remove illegal material. It merely made access more difficult while leaving the underlying content online. Instead, they advocated international cooperation aimed at removing the material directly from the servers on which it was hosted.

This debate gave rise to the principle that became known as “Delete rather than block.”

In practice, the legislation was never fully implemented and was later repealed. Regardless of one’s political view at the time, one important lesson remains. Even measures introduced for unquestionably legitimate purposes must still satisfy the constitutional requirements of necessity, effectiveness and proportionality.

Another lesson can be found in the evolution of surveillance legislation more broadly. During the past two decades, both national constitutional courts and European courts have repeatedly reviewed laws expanding governmental powers.

Some provisions were declared invalid. Others were permitted only after significant safeguards had been introduced or legal limits substantially tightened.

These judgments do not demonstrate that security legislation is inherently incompatible with constitutional democracy.

They demonstrate something far more important: Governments regularly approach – or exceed – the constitutional limits placed upon state power.

Why Trust Alone Is Never Enough

Supporters of expanded investigative powers often argue that new authorities will be used only for clearly defined purposes. Such assurances may well be offered in good faith. But constitutional safeguards cannot depend upon good faith alone.

Governments change. Parliamentary majorities change. Legislation changes. Technical infrastructures, however, often remain in place for decades.

That is precisely why constitutional rights are designed to protect citizens regardless of who holds political office.

Their effectiveness must not depend upon confidence in today’s government. They must continue to function equally well under tomorrow’s. This consideration is particularly important in the debate over EU Chat Control.

Once a technical infrastructure capable of automatically analysing private communications has been established, an unavoidable question follows. Will it always remain restricted to its original purpose? Or will future governments seek to extend its use in response to new political priorities, new forms of crime or new security concerns?

History offers enough examples to justify asking that question. The answer cannot rest upon political promises alone. It must be found in the legal limits that the legislation itself creates.

The Real Constitutional Test

This is why the debate over EU Chat Control cannot be reduced to a simple question of whether children deserve better protection.

Of course they do. The real constitution – question is whether a democratic society should create a technological infrastructure capable of routinely examining private communications in pursuit of that objective. At this point, the discussion moves beyond criminal investigation. It becomes a debate about the relationship between freedom and state power. It also marks the point at which constitutional analysis truly begins. The central question is no longer whether such technology exists.

It is whether the German Basic Law, the jurisprudence of the Federal Constitutional Court and the wider framework of European fundamental rights permit powers of this kind – and whether the current proposals are capable of satisfying those constitutional standards.

Featured image created with ChatGPT using my prompt.