Glossary
Twelve terms that carry most Chat Control conversations — each in plain language, none requiring the others.
- Chat Control
- The colloquial name for two EU instruments: the ePrivacy derogation in force ('1.0', voluntary scanning, until April 2028) and the draft CSA Regulation ('2.0', potentially mandatory detection). Most confusion about Chat Control comes from mixing them up.
- Derogation report (Article 3(1)(g)(vii))
- The transparency report the derogation itself requires from every provider that scans under it — no scanning, nothing to file. This is why filing one is the strongest public evidence of Chat Control use, and it is a different thing from DSA transparency reports, which all large platforms must publish whether they scan private messages or not. The Commission's COM(2025) 740 names exactly five filers for 2023 and 2024: Google, LinkedIn, Meta, Microsoft, Yubo.
- ePrivacy derogation (Regulation 2021/1232)
- The exception to EU confidentiality rules that lets providers voluntarily scan private communications for child sexual abuse material. Reinstated in July 2026 and in force until April 2028; end-to-end encrypted communications are formally excluded.
- CSA Regulation (“Chat Control 2.0”)
- The proposed permanent regulation (2022) whose detection orders could make scanning mandatory, including via scanning on the user's device. Still in negotiation; not law.
- End-to-end encryption (E2EE)
- Encryption where only the communicating devices hold the keys — the provider cannot read message content, so it has nothing meaningful to scan server-side. Signal, WhatsApp, Threema, Olvid, Wire and Element use it by default.
- Client-side scanning
- Scanning content on the user's device before encryption is applied. The mechanism by which mandatory detection could reach E2EE apps, and the central controversy of Chat Control 2.0.
- Hash matching
- Comparing a fingerprint (hash) of an image or video against a database of known abuse material. Detects only previously identified content; the most established scanning method, and the one Google's error figures refer to.
- PhotoDNA
- Microsoft's perceptual hash-matching technology (2009), licensed widely across the industry. A perceptual hash survives resizing and small edits, unlike an exact file hash.
- Classifier
- A machine-learning model that flags previously unseen content as potentially abusive. Catches new material, at the cost of a higher false-positive risk than hash matching.
- NCMEC / CyberTipline
- The US National Center for Missing & Exploited Children and its reporting pipeline. US law requires providers to report detected material there — a US regime, distinct from the EU derogation, though NCMEC reports about EU users appear in the Commission's statistics.
- Detection order
- Under the draft 2.0 regulation, a binding order requiring a specific service to scan for specific material. The mechanism that would turn scanning from voluntary into mandatory.
- Trilogue
- The closed-door negotiation between the Council, Parliament and Commission that produces the final text of EU law. The 2.0 trilogue collapsed over suspicionless scanning in June 2026 and continues.
- Metadata
- Who talked to whom, when, how often, from where. Not protected by E2EE and not the subject of Chat Control scanning — but revealing enough that it deserves its own scrutiny.