Almost half. In 2024 Germany’s federal police received 205,728 reports of suspected child abuse material from US providers, and 99,375 of them, or 48.3 per cent, turned out to be criminally irrelevant. Each began with software flagging a private message or image, and each landed on a police desk to be sorted. Chat Control, the EU plan to make this kind of scanning bigger and eventually compulsory, treats that as an acceptable price.
Table of contents
What the scanners already get wrong
The 2024 figures come from the federal police (BKA), as cited by the digital rights site Reclaim The Net. They come from the voluntary scanning that providers carry out today, which is the lighter version of the idea.
The accuracy has improved. For January to May 2026 the Interior Ministry puts the share of criminally relevant reports at around 60 per cent, according to netzpolitik.org. That still leaves roughly four in ten reports with nothing in them. In January alone the BKA logged 20,888 reports and rated 53 per cent as relevant. Do the subtraction, and thousands of reports in a single month had nothing criminal in them.
The panic that did not arrive
In March Parliament voted against extending the temporary exemption that allows this scanning, and it lapsed in early April. Police and interior ministers warned of a drastic decline in reports.
The data did not deliver a collapse. Monthly reports slipped from 19,054 in March to 15,643 in April and 14,463 in May. The BKA itself said it saw no concrete connection to the lapse and noted that monthly figures fluctuate considerably. Reports kept arriving by the thousands without the legal cover.
Anyone who says children are only safe if every private chat is open to inspection should explain that.
Read also: Europe’s Surveillance Rules Are Being Written Around the Exceptions
Two laws, one appetite
There are two files on the table. The first is the temporary rule, now back in force as Regulation (EU) 2026/1881 until 3 April 2028. It permits voluntary scanning and excludes end-to-end encrypted chats. The second is the permanent Chat Control regulation the Commission proposed in 2022, which would write detection duties into law. It has been stuck for four years, which says a lot about how the idea survives contact with lawyers.
What the lawyers already said
In April 2023 the Council’s own Legal Service described an order to scan all users’ communications as general and indiscriminate screening. That finding came from inside the institution that now negotiates the text.
In February 2024 the European Court of Human Rights ruled in Podchasov v. Russia that forcing a service to weaken its encryption violates the right to private life. The case concerned Russia and Telegram. The logic travels.
Signal’s answer
Scanning an encrypted conversation leaves only two designs. The provider breaks the encryption, or the scanning happens on your phone before the message is locked. Both open the letter before it is sealed.
Meredith Whittaker, president of the Signal Foundation, called the approach a “mass surveillance free-for-all” in October 2025 and said Signal would leave the European market rather than build scanning into its service. That was a response to an earlier text, and the principle still stands. A messenger that exits when ordered to break its own product is giving the only honest answer available.
Where Chat Control stands after 29 September
Negotiators met for the sixth time on 29 September. They settled the tasks of the planned EU Centre on child sexual abuse and agreed that authorities can order hosting providers to scan public content for known material. Nobody objects to searching public content.
They did not agree on private messages. Parliament wants scanning limited to people linked to abuse, ordered by a judge, and kept away from encryption. The Council’s own mandate from November 2025 dropped mandatory detection orders.
MEP Patrick Breyer, who follows the talks closely and opposes scanning, says the Council side nevertheless asked at the table for mandatory orders on private communications, issued by administrative bodies. Treat his account as that of an interested party.
Read also: Europe’s Digital ID Will Outlive Its Promises
A final round is expected in November.
A test for November
Child abuse is real, and its victims deserve a state that acts. What works is targeted investigation: a judge authorises a measure against a named suspect, police do the work, and the evidence survives in court. Parliament’s mandate describes exactly that.
So apply three checks to the final text. Can an administrative body order the scanning of private messages without a judge? Can it do so without suspicion of the person scanned? Does anything in it touch end-to-end encryption? One yes on any of the three, and the text is mass surveillance with a child-safety label. MEPs should vote it down.
The revived interim law already demands that providers publish their error rates and false positives, with the first reports due on 1 February 2027. Lawmakers expect the mistakes. German police have been counting them for years.
Opinion pieces on ExtraFokus.eu reflect the views of their authors.
