EU message scanning is no longer a proposal — it's a live reality for millions of citizens, and the next fight is over whether it forces providers to break end-to-end encryption. The derogation to the ePrivacy directive was extended and now runs until April 2028, meaning voluntary scanning by providers is already the default on most large platforms. Two separate legislative files are in play: one allows voluntary scanning, the other would make it a legal duty. The technical answer — whether encryption holds for everyone or breaks for everyone — will decide the outcome.
The two-track legal path
Right now, scanning checks whole messages even if only specific content is targeted. The voluntary regime covers a narrow category of known material. A mandate would apply to all conversations without suspicion. That's the crux. Most large platforms already use voluntary scanning, so for many users it's not a future threat — it's the current system.
The second file is the one that worries privacy advocates. It would turn scanning into a legal obligation. To comply, providers would need to decrypt traffic, which directly collides with end-to-end encryption. EU officials have flagged VPNs as a loophole in age verification rules, and file storage falls within the same scanning scope as live chat.
Why crypto users are exposed
Ethereum co-founder Vitalik Buterin called the revival of scanning a cybersecurity risk in July. His point: breaking encryption for one purpose weakens it for all. Crypto users face specific exposure because wallet recovery flows, seed phrase backups, and trading group chats travel over consumer apps. Those apps are exactly where scanning mandates would apply.
Marina Markezic argues that constitutional principles protecting privacy still apply to digital communications. Supporters of the rules counter that platforms already hold data, so targeted scanning adds little new intrusion. European Commission officials have stated the goal is limited to abuse material. The gap between that stated goal and the technical means is where the fight sits.
What happens next
Next negotiation rounds in autumn will be decisive for the future of encryption. Until then, users can reduce exposure by choosing apps that publish their encryption model and moving sensitive files off consumer chat. The clock runs to April 2028, but the real deadline is the autumn sessions — that's when the technical path gets locked in.
