Chat Control, the Online Safety Act and the KIDS Act: How the EU, UK and US Are Each Building Message Surveillance Into Law

Over the last ten days, hundreds of thousands of people have watched my videos about governments reading private messages. This is the long version. Every law, every power, every source. Check every one of them yourself. Do not take my word for any of it.

What actually happened in Brussels

On the ninth of July, the European Parliament voted on a law critics call Chat Control, the extension of Regulation 2021/1232. It allows tech companies to scan private messages, emails and photos on unencrypted platforms such as Gmail, Facebook Messenger and Instagram.

Here is the part most coverage buried. Three hundred and fourteen MEPs voted against it. Two hundred and seventy-six voted for it. A clear majority wanted the law dead.

It passed regardless. The vote was staged the day before summer recess, under a rule requiring an absolute majority of three hundred and sixty-one votes to reject a Council position. Absent seats counted as support. The rejection fell forty-seven votes short. The law now runs until 2028.

One genuine safeguard did survive the same session. MEPs passed an amendment excluding end-to-end encrypted services such as Signal and WhatsApp from the scanning regime. That is real, and it matters. But the larger law, Chat Control 2.0, which would force scanning inside those same encrypted apps, has already failed five rounds of negotiation. Talks resume in September. Nothing here is finished.

Britain moved first and moved further. New rules under the Online Safety Act came into force on the eighth of January, requiring platforms to scan content before it reaches you. Beneath that sits the Investigatory Powers Act 2016, which lets the Home Secretary issue secret Technical Capability Notices ordering companies to remove encryption, notices the companies are legally barred from confirming even exist.

America is a step behind but walking the same road. The KIDS Act passed the House on the twenty-ninth of June, covering age verification and platform duties. No on-device scanning yet. The direction of travel is unmistakable.

The power has already been used

None of this is theoretical. Ask Apple.

The UK Home Office ordered Apple to build a backdoor into iCloud. Apple refused to build it, and instead switched off Advanced Data Protection, its strongest encryption tier, for every UK customer. Apple challenged the order in court. Apple lost. Today, anyone in Britain using an iPhone has weaker protection on their cloud data than a customer holding the identical device anywhere else in the world.

The most valuable technology company on earth was handed an order by one government. It held the line everywhere it could, and still folded in the one place that mattered.

The machine that does not work

Now the evidence. Does any of this protect a single child?

Amazon’s automated scanning system flagged over one million pieces of content as suspected child abuse material. Ninety-nine point six percent were false alarms, according to the European Commission’s own implementation reporting. Germany’s Federal Criminal Police say nearly half of everything these systems generate is not even criminally relevant. By the Commission’s own evaluation, genuinely illegal content among everything scanned runs to roughly one case in tens of millions.

Patrick Breyer, a former Member of the European Parliament, called it five years and millions of euros spent on an algorithm that cannot protect children, money that should have reached real investigators and the survivors still waiting for support that never arrived.

They did not fund the people who protect victims. They funded the machine that watches everybody else.

One rule for them

This is the part that should genuinely annoy you.

Ursula von der Leyen, President of the European Commission, the institution behind Chat Control, uses Signal with disappearing messages set to auto-delete. EU politicians are exempt from the law they wrote.

In Britain, Downing Street confirmed in June that Keir Starmer uses disappearing WhatsApp messages, during the very parliamentary inquiry seeking his records. Before him, Boris Johnson lost roughly five thousand WhatsApp messages from the pandemic period, gone before anyone thought to ask.

In America, senior officials planned live military strikes over Signal. In March 2025, National Security Advisor Mike Waltz accidentally added The Atlantic’s editor-in-chief, Jeffrey Goldberg, to a Signal group called Houthi PC Small Group. Defense Secretary Pete Hegseth then posted precise strike details inside it, weapons packages, targets and launch times for F-18s, drones and Tomahawk missiles, hours before the Yemen strikes went ahead.

Eighteen officials sat in that chat, among them Vice President Vance, Secretary of State Rubio, Director of National Intelligence Gabbard, Treasury Secretary Bessent and CIA Director Ratcliffe. A Defense Department Inspector General investigation later confirmed Hegseth disclosed strike timing and aircraft counts over an unsecured personal device roughly two to four hours before execution. It became a federal lawsuit and a formal government finding, not a rumour. They trust encryption with the nation’s deepest secrets. They do not trust a citizen with a private conversation.

Who this actually endangers

Supporters say this protects the vulnerable. In practice it does the opposite.

A woman planning her escape from a violent partner depends on one safe, private channel to arrange it for herself and her children. A journalist protecting a source depends on the same thing. A whistleblower exposing corruption depends on it too. These are precisely the people this machinery puts at greater risk, while genuine investigators drown under false alerts that a struggling algorithm cannot tell apart from a family photo.

It goes further than messages

In Britain, the surveillance state reaches well beyond your inbox.

In Bristol, data on over ninety percent of the population was fed into a police prediction system built jointly with the city council, drawing on mental health records, housing status and free school meals, assigning risk scores to children. Nobody was told. A legal challenge feels inevitable.

More than seventy AI policing tools now operate across England and Wales, most with no meaningful oversight. Facial recognition vans are rolling out across seven forces. In June, the Commissioner of the Metropolitan Police argued publicly that police should not have to wait for legislation before deploying new technology. Meanwhile, seventy-four percent of Britons say they expect large-scale unrest this year. That is the precise moment the state chose to build a machine that tries to predict who might cause trouble, before anyone has done anything at all.

New surveillance tools are tested first on people with the least power to object, migrants at the border. Then, quietly, they are turned on everyone else.

The comparison nobody wants to make

North Korea does not ask permission to watch its citizens. Neither does China. Neither does Russia.

We are not them, and the distinction is real. In China there is no vote to lose, no court to challenge a backdoor order, no journalist forcing the documents into daylight. Here, Apple could fight, even if it ultimately lost. Signal can simply refuse and walk away from a market. Parliament rejected Chat Control twice before a procedural manoeuvre revived it on the third attempt.

But be precise about what separates us from them. It is no longer the technology. The scanning tools, the prediction models, the facial recognition vans, the machinery itself, is now functionally identical. What remains different is intent, law, and your ability to object while that is still possible.

Infrastructure like this is never switched off once it exists. It only ever expands. Every government in history that built a surveillance machine eventually found a reason to use it.

Where this lands by 2028

Chat Control 1.0 expires in 2028. What happens by then.

The realistic path is fragmentation. Britain drifts furthest toward surveillance, its machinery already half-built. Europe keeps fighting itself toward an uneasy compromise. America stays freer at federal level while individual states pull in opposite directions. Encrypted platforms such as Signal will be forced, country by country, to choose between compliance and simply leaving.

There is a version of this story with a different ending, and it depends on ordinary attention rather than luck.

Use properly encrypted tools. Signal for messages, Proton Mail for email. Watch September, when Chat Control 2.0 negotiations resume, and contact your MEP before that vote rather than after it, when it still changes an outcome. And talk about it. Every one of these laws has depended on one thing above all else: that nobody was paying attention long enough to object.

Every topic I cover gets the same treatment before it reaches you: a full research pass, then a separate deep-dive cross-check against primary sources to make sure what survives is accurate. This one went through that process like every other. That is precisely why it is worth your attention rather than a scroll past.

The vote in Brussels proved something worth holding onto. Three hundred and fourteen people said no, and the number that mattered was still forty-seven votes shy of turning that no into a stop. The gap between losing a vote and losing the fight is not as wide as it looks from here. It closes the moment enough people decide to stand in it.

Read the fuller weekly take and subscribe at raw.natschooler.com.

---

Frequently asked questions

Did Chat Control pass in the EU? Yes. On the ninth of July 2026, the European Parliament failed to block the extension of Regulation 2021/1232, sometimes called Chat Control 1.0. Three hundred and fourteen MEPs voted to reject it against two hundred and seventy-six in favour, but rejection required an absolute majority of three hundred and sixty-one votes, so the law stands and now runs until 2028.

Does Chat Control scan Signal or WhatsApp? No, not under this law. The same July session passed an amendment excluding end-to-end encrypted services such as Signal and WhatsApp from the scanning regime. A separate, broader proposal known as Chat Control 2.0, which would reach inside encrypted apps, has failed five rounds of negotiation and resumes in September 2026.

What does the UK Online Safety Act require? The Online Safety Act requires platforms to scan content before it reaches users, with new duties in force from the eighth of January 2026. Separately, the Investigatory Powers Act 2016 allows the Home Secretary to issue secret Technical Capability Notices ordering companies to weaken or remove encryption, and the recipient is legally barred from confirming the notice exists.

Did the UK force Apple to build a backdoor? Yes. The Home Office ordered Apple to build backdoor access to iCloud data. Apple refused to build the backdoor but disabled Advanced Data Protection, its strongest encryption tier, for all UK customers, challenged the order in court, and lost.

Does the United States have an equivalent law? The closest equivalent is the KIDS Act, which passed the House of Representatives on the twenty-ninth of June 2026 and covers age verification and platform safety duties. It does not currently mandate on-device or message scanning, though the direction of policy travel mirrors the EU and UK.

Do the scanning systems actually catch abuse material accurately? Not reliably. Amazon’s automated scanning system flagged over one million pieces of content as suspected abuse material, of which 99.6 percent were false alarms according to European Commission implementation reporting, and Germany’s Federal Criminal Police report that close to half of all referrals are not criminally relevant.

Are politicians exempt from the surveillance rules they pass? In practice, senior officials in all three jurisdictions use disappearing or encrypted messaging themselves. European Commission President Ursula von der Leyen uses Signal with disappearing messages, and UK Prime Minister Keir Starmer has used disappearing WhatsApp messages during a parliamentary inquiry into his own record-keeping.

Is Telegram end-to-end encrypted? No, not by default. Ordinary Telegram chats, including groups and channels, use client-server encryption on Telegram’s own MTProto protocol, meaning Telegram’s servers hold the keys and can access message content if compelled. True end-to-end encryption only applies inside Telegram’s optional Secret Chats, a feature that is off by default, limited to one-to-one conversations, unavailable on desktop, and rarely switched on by most users, which means Telegram falls outside the same protection Signal and WhatsApp carry as standard.

What was “Signalgate”? In March 2025, US National Security Advisor Mike Waltz accidentally added a journalist, The Atlantic’s Jeffrey Goldberg, to a Signal group chat where Defense Secretary Pete Hegseth then shared precise Yemen strike details, including weapons packages, targets and launch times, hours before the operation. Eighteen senior officials were in the chat, and a subsequent Defense Department Inspector General investigation confirmed the disclosure, alongside a federal lawsuit over the officials’ use of an unsecured personal app for classified-adjacent military planning.

---

Sources — check everything yourself

• EU Chat Control vote (314 v 276, absolute majority procedure, runs to 2028) — The Record · Euronews
• Chat Control legislative history and Chat Control 2.0 status — Wikipedia
• Patrick Breyer statement on cost, survivor support and BKA data — patrick-breyer.de
• Scanning error rates and false positives, Commission evaluation — Digital Escape Tools
• Client-side scanning explained — Max Planck Institute for Security and Privacy
• UK Online Safety Act and Ofcom powers — The CyberSec Guru
• Bristol predictive database, 70+ AI policing tools, Met Commissioner remarks (June 2026) — Liberty
• UK predictive policing prototype and facial recognition vans — Biometric Update
• Home Office AI policing white paper, roughly 100 AI projects — Biometric Update
• Surveillance tested on migrant communities first — Migrants’ Rights Network
• UK-EU police data-sharing architecture — Statewatch
• Ipsos: 74% of Britons expect large-scale unrest in 2026 — Ipsos
• Keir Starmer disappearing WhatsApp messages — The Sun
• Boris Johnson WhatsApp messages, Covid Inquiry — The Independent
• Telegram encryption architecture, MTProto vs Secret Chats — ESET · Telegram’s own technical FAQ
• “Signalgate”: Houthi PC Small Group chat leak — Wikipedia · CBS News
• DoD Inspector General findings on Hegseth’s Signal use — Defense News