Notes / 26 Jul 2026

Five providers, verbatim

Providers that scan under the ePrivacy derogation don't just get permission — they get homework. Article 3(1)(g)(vii) of Regulation 2021/1232 requires each of them to publish and submit an annual report on their processing of personal data, to their supervisory authority and to the Commission.

The Commission's latest implementation report, COM(2025) 740 (27 November 2025), states it plainly: "Google, LinkedIn, Meta, Microsoft and Yubo submitted reports, for both 2023 and 2024."

Five companies. Not the hundreds that people sometimes imagine when they hear "the EU scans your messages" — and not zero, either. The same report carries the providers' own error ratios and the volumes flowing through the system; we've put those on the numbers page.

Every status on this site follows from evidence of this kind, in order of strength: the Commission's reporting first, companies' own EU filings second, their policies third. When someone asks how we know who scans — this sentence is how.

— ScanRecords, 26 Jul 2026. Subscribe by RSS · corrections