PostEU Surveillance Laws:

EU Surveillance Laws: Communications content and metadata 1. Temporary CSAM scanning derogation ("Chat Control 1.0") Voluntary scanning of unencrypted messages for CSAM. Passed (revived July 2026). In force until April 2028. 2. Regulation to Prevent and Combat Child Sexual Abuse (CSAR / "Chat Control 2.0") Permanent framework: risk assessments and detection orders. Mandatory encryption scanning stripped from Council position. Not passed. Trilogues ongoing. 3. ePrivacy Regulation Proposed update to 2002 ePrivacy Directive. Withdrawn (October 2025). 4. Data Retention Directive 2006/24/EC EU-wide telecoms metadata retention. Invalidated by CJEU (2014). No replacement exists; national regimes remain. 5. Terrorist Content Online Regulation (EU) 2021/784 One-hour removal orders for terrorist content. Passed. In force since June 2022. Law-enforcement access to stored data 6. e-Evidence Regulation (EU) 2023/1543 & Directive (EU) 2023/1544 Cross-border production and preservation orders (10 days / 8 hours emergency). Passed. Fully applicable from August 2026. 7. Law Enforcement Directive (EU) 2016/680 Police data-protection rules including biometric data of suspects. Passed (2016). Travel, borders, identity databases 8. PNR Directive (EU) 2016/681 Airlines transfer passenger records on extra-EU flights to national units. Passed. In force. 9. API Regulation (EU) 2025/13 Central router for Advance Passenger Information and PNR. Passed (December 2024). Live January 2025. 10. Interoperability Regulations (EU) 2019/817 & 2019/818 Common Identity Repository, European Search Portal, Biometric Matching Service, Multiple Identity Detector. Passed (2019). Biometric matching service live May 2025; search portal live June 2026. 11. Entry/Exit System (EES) Biometric registration (face + fingerprints) of third-country nationals at borders. Passed. Fully deployed across Schengen borders (April 2026). 12. ETIAS Pre-travel authorisation for visa-exempt nationals, screened against EU databases. Passed. Operational expected Q4 2026. 13. Revised Eurodac Expanded biometric database (includes children age 6+) for asylum and migration. Passed. Applicable from June 2026. 14. Screening Regulation (EU) 2024/1356 Identity, security, health and biometric checks for irregular arrivals (up to 7 days). Passed. Applicable from June 2026. 15. Prüm II Regulation (EU) 2024/982 Automated DNA, fingerprint, facial image, vehicle and police record exchange via central router. Passed. Router operational Q2 2027. Biometrics and AI for identification 16. AI Act (Regulation (EU) 2024/1689) Prohibits real-time remote biometric ID in public spaces for law enforcement (narrow exceptions allowed). High-risk biometric rules delayed to December 2027. Passed. Core prohibitions active. Related instruments 17. European Media Freedom Act (EU) 2024/1083 Restricts spyware against journalists; narrow derogations for serious crimes with judicial authorisation. Passed. Main provisions active from August 2025. 18. EU KIDS Act Minimum age, age assurance, AI companion rules. Does not require message scanning. Proposed only. Legislative procedure started September 2026.