ScanRecords

How to actually get out of the scanning

Everything on this page follows from the record: what is scanned today, what cannot be, and which settings quietly undo your protection. No products to buy — just choices.

1. The only real opt-out is the app you use

Scanning under Chat Control happens at the provider, with the provider's keys. End-to-end encrypted apps have nothing readable to scan and are formally excluded from the derogation. These are the tracked apps that cannot read your messages:

2. Mind the backup trap

WhatsApp chats are E2EE — but an unencrypted cloud backup hands a readable copy to Apple's or Google's servers anyway. Either disable chat backups or turn on end-to-end encrypted backup (Settings → Chats → Chat backup). The same logic applies anywhere: encryption in transit means little if a plaintext copy rests somewhere else.

3. Email is the scanned zone

Gmail and Outlook are scanned in the EU under the derogation — their operators are two of the five providers filing its reports. Proton states it does not scan content and cannot read stored mail; GMX makes no clear statement. If your correspondence is sensitive, the mailbox provider is a bigger decision than any setting inside it.

4. A VPN does not help here

A VPN moves your traffic, not your messages — scanning happens where the message is processed, at the provider. Against Chat Control specifically, a VPN changes nothing. Choose the app, not the tunnel.

5. Know what still leaks

E2EE protects content. Metadata — who you talk to, when, how often — is visible to most providers regardless (Signal and Threema minimize even that). And nothing here protects a device someone else unlocks.

6. What this doesn't cover

All of the above concerns the rules in force today. The draft Chat Control 2.0 could reach into E2EE apps via scanning on your device, before encryption — which is why the sentence "we cannot read your messages" is one of the things this archive watches daily.

Every claim above traces to the checker, the numbers, or a company's own archived documents. Send this page to the person who asked you "so what do I do?"