Glossary
Twelve terms that carry most Chat Control conversations — each in plain language, none requiring the others.
- Chat Control
- The colloquial name for two EU instruments: the ePrivacy derogation in force ('1.0', voluntary scanning, until April 2028) and the draft CSA Regulation ('2.0', potentially mandatory detection). Most confusion about Chat Control comes from mixing them up.
- ePrivacy derogation (Regulation 2021/1232)
- The exception to EU confidentiality rules that lets providers voluntarily scan private communications for child sexual abuse material. Reinstated in July 2026 and in force until April 2028; end-to-end encrypted communications are formally excluded.
- CSA Regulation (“Chat Control 2.0”)
- The proposed permanent regulation (2022) whose detection orders could make scanning mandatory, including via scanning on the user's device. Still in negotiation; not law.
- End-to-end encryption (E2EE)
- Encryption where only the communicating devices hold the keys — the provider cannot read message content, so it has nothing meaningful to scan server-side. Signal, WhatsApp, Threema, Olvid, Wire and Element use it by default.
- Client-side scanning
- Scanning content on the user's device before encryption is applied. The mechanism by which mandatory detection could reach E2EE apps, and the central controversy of Chat Control 2.0.
- Hash matching
- Comparing a fingerprint (hash) of an image or video against a database of known abuse material. Detects only previously identified content; the most established scanning method, and the one Google's error figures refer to.
- PhotoDNA
- Microsoft's perceptual hash-matching technology (2009), licensed widely across the industry. A perceptual hash survives resizing and small edits, unlike an exact file hash.
- Classifier
- A machine-learning model that flags previously unseen content as potentially abusive. Catches new material, at the cost of a higher false-positive risk than hash matching.
- NCMEC / CyberTipline
- The US National Center for Missing & Exploited Children and its reporting pipeline. US law requires providers to report detected material there — a US regime, distinct from the EU derogation, though NCMEC reports about EU users appear in the Commission's statistics.
- Detection order
- Under the draft 2.0 regulation, a binding order requiring a specific service to scan for specific material. The mechanism that would turn scanning from voluntary into mandatory.
- Trilogue
- The closed-door negotiation between the Council, Parliament and Commission that produces the final text of EU law. The 2.0 trilogue collapsed over suspicionless scanning in June 2026 and continues.
- Metadata
- Who talked to whom, when, how often, from where. Not protected by E2EE and not the subject of Chat Control scanning — but revealing enough that it deserves its own scrutiny.