Chat Monitoring in the EU: What Has Changed

Reports that the European Union is introducing mandatory reading of all private messages regularly appear on social media. However, the monitoring of information from chats in the EU is governed by several legal frameworks with different scopes. The Digital Services Act primarily concerns public content and the obligations of online intermediaries, while the confidentiality of private communications is protected by separate rules.

The most controversial debate concerns the detection of child sexual abuse material. In this area, the EU is considering permanent legislation while also using temporary exemptions from the ePrivacy rules. These measures should not be equated with a general authorization for government authorities or platforms to read any private communication.

Why the Issue of Chat Monitoring Has Become Relevant

The reason for these legislative initiatives is the spread of illegal material, grooming, and other forms of child exploitation through digital services. In 2022, the European Commission proposed a separate regulation that would establish obligations for providers to assess risks, detect, report, and remove such content. As of August 2026, the final permanent legislation is still being discussed by the EU institutions.

At the same time, lawmakers seek to preserve the confidentiality of communications. Article 5 of Directive 2002/58/EC — the ePrivacy Directive — requires the confidentiality of communications to be ensured and prohibits the interception, monitoring, storage, or surveillance of communications by third parties without the users’ consent, except in cases provided for by law.

Therefore, chat monitoring in the EU is based on an attempt to strike a balance. Platforms must respond to illegal content, but interference with private communications must have a legal basis, a specific purpose, and comply with the principles of necessity and proportionality.

What Rules Apply in the European Union

Regulation (EU) 2022/2065, or the Digital Services Act, establishes obligations for intermediary services concerning illegal content, moderation transparency, and systemic risk management. Its provisions have applied in full since February 17, 2024. The regulation does not establish a universal obligation to monitor every user message.

Ordinary email services and private messaging between a defined group of users are not considered online platforms for the purposes of the DSA. However, public functions of the same service — such as open channels, feeds, groups, or platforms for distributing information to an unlimited number of people — may fall under its rules.

The processing of personal data is governed by Regulation (EU) 2016/679 — the GDPR. A platform must have a lawful basis for processing, inform users of the purposes of processing, comply with data minimization requirements, and ensure data security. The ePrivacy Directive also applies specifically to electronic communications.

A separate temporary regime concerns the voluntary detection of online child sexual abuse material. The previous exemption expired on April 3, 2026. On July 23, 2026, the Council of the EU finally approved new temporary legislation allowing providers to resume such voluntary measures until April 3, 2028, while a permanent mechanism is being discussed.

Which Chats and Services May Be Subject to Regulation

EU regulation of messaging services depends not on the name of an application but on the nature of a specific function. One service may simultaneously provide private messaging, public channels, cloud storage, and a social feed. Different obligations apply to each function.

The following may fall under regulation:

• messaging and electronic communications services — under ePrivacy, GDPR, and specific rules;
• social networks and forums — under the DSA where they publicly distribute user-generated content;
• open groups, channels, and comments — as public platform functions;
• private chats — primarily as confidential interpersonal communication;
• corporate communication systems — taking into account GDPR, employment law, and internal policies.

A post in an open channel does not carry the same expectation of confidentiality as a message sent to a specific recipient. Therefore, chat monitoring in Europe in public spaces more often means moderation, handling complaints, removing illegal material, and complying with orders from competent authorities.

Are Private Messages Monitored?

There is no general rule requiring all services to continuously read all private communications in the EU. On the contrary, the confidentiality of communications in the EU is protected by the ePrivacy Directive, the GDPR, and Articles 7 and 8 of the Charter of Fundamental Rights of the European Union.

Exceptions may exist on the basis of law. Access to messages may take place as part of a criminal investigation, provided that national procedures and judicial safeguards are followed. Separately, a temporary European regime allows providers to voluntarily use certain technologies to detect material related to child sexual abuse. It does not authorize arbitrary searches for political opinions, commercial disputes, or ordinary private conversations.

It is important to distinguish between automated analysis and a person actually reading a conversation. Message monitoring in messaging apps may involve matching an image against a known digital identifier, analyzing suspicious behavior, or reviewing a message following a complaint. Each operation must have a legal basis and appropriate limitations.

The claim that the Digital Services Act authorized mass scanning of all private messages is incorrect. The DSA expressly excludes ordinary interpersonal communication services from the definition of online platforms. Specific proposals concerning the fight against child sexual abuse are part of a separate legislative process.

What This Means for Ordinary Users and Businesses

For ordinary users, chat monitoring in the EU does not mean that the confidentiality of communications has been abolished. However, privacy is not absolute: a message may be submitted to a platform through a complaint, examined as part of a lawful procedure, or processed using technology permitted under specific legislation.

Online platforms must have clear moderation policies, mechanisms for reporting illegal content, and procedures for appealing decisions. Very large services must additionally assess systemic risks associated with the dissemination of illegal information, effects on minors, and the use of recommendation algorithms.

Companies face separate risks when using corporate chat systems. An employer cannot freely read employees’ messages simply because the service belongs to the organization. There must be a lawful purpose, employee notification, a limited scope of monitoring, and compliance with the GDPR.

Users and businesses should consider:

• separating public channels from confidential communications;
• avoiding the distribution of unverified accusations and illegal material;
• reviewing the service’s privacy policy and moderation rules;
• using corporate policies governing the storage of and access to messages;
• documenting the legal basis for data processing and data retention periods;
• consulting a lawyer when receiving a request from a platform or government authority.

For businesses, EU messaging regulation means assessing not only the security of a service but also the roles of the parties involved in data processing. Almanova Law can review corporate communications policies, employee notices, and the compliance of processes with GDPR and ePrivacy requirements.

Frequently Asked Questions

Do EU authorities read all private messages?
No. Current law does not provide EU institutions with general, continuous access to all private communications.

What does chat monitoring in Europe mean?
The term may refer to moderation of public channels, processing of a complaint, lawful access as part of an investigation, or specific automated detection of certain categories of illegal content.

Does the DSA apply to WhatsApp, Telegram, and other messaging apps?
It depends on the function. Private communication between specific participants is not considered an online platform under the DSA, while public channels and social features may fall under its requirements.

Can a service analyze private messages?
Only where there is a legal basis and the requirements of the GDPR and ePrivacy rules are observed. A special temporary regime applies to certain measures aimed at detecting child sexual abuse material.

Does encryption protect private messages?
End-to-end encryption limits third-party access to the content of communications. However, it does not prevent a message from being checked on a device, reported by the recipient, or accessed through unencrypted backups.

What changed in 2026?
On April 3, 2026, the previous temporary exemption from the ePrivacy rules expired. In July, the EU institutions adopted new temporary legislation allowing providers to continue voluntary detection of child sexual abuse material until April 3, 2028. Permanent rules remain under negotiation.

Are companies required to monitor employees’ communications?
There is no general obligation. Monitoring is permitted only where there is a lawful purpose, a transparent internal policy, and compliance with the principles of necessity, proportionality, and data minimization.

Where can someone report unlawful access to messages?
A user can contact the platform, the relevant national data protection authority, or a court. The GDPR provides mechanisms for cross-border data processing.