Leaked Document Reveals Spain's Plan to Ban EU Encryption

A leaked European Council document obtained by WIRED in May 2023 revealed that Spain held the most extreme position among EU member states on a proposal to require scanning of private encrypted messages, ostensibly to combat child sexual abuse material. Spanish representatives stated that it would be "desirable to legislatively prevent EU-based service providers from implementing end-to-end encryption." The majority of 20 surveyed countries expressed support for some form of message scanning.

Critics and privacy advocates warned that mandating backdoors or client-side scanning would effectively destroy the security guarantees of end-to-end encryption for hundreds of millions of people across the EU. Estonia cautioned that companies would likely either redesign systems to allow decryption or exit the EU market entirely if such a law passed.

Spain's wish to outlaw end-to-end encryption never became law, but the scanning it was meant to enable is back. The interim rule letting Meta, Google and Microsoft voluntarily scan unencrypted messages lapsed on April 4, 2026, then returned when only 314 MEPs voted to reject the Council's revived text, short of the 360 needed, as Euronews reported; the new derogation runs to April 3, 2028. The permanent CSA Regulation is the real fight: five trilogues, including the June 29 round billed as final, ended without a deal, with encryption now agreed as protected and the open question whether detection is mandatory or voluntary, targeted or mass. Both sides now count down to the next trilogue on September 29, per EDRi.