After seven EU countries in a row failed to broker an EU Member State position on the controversial CSA Regulation, in late 2025, the government of Denmark pulled off what had previously seemed near-impossible.

One camp of countries, including Denmark themselves, had been fiercely pushing for mandatory scanning of private messages at scale, including in encrypted environments. Another camp, spearheaded by countries including Poland, Czechia and the Netherlands, was boldly pushing in the other direction. These countries rightly urged their peers not to let the important goal of this law be used as justification to implement mass surveillance or undermine the protections offered by end-to-end encryption.

That’s why on November 13 2025, Denmark’s proposal to eliminate forced detection entirely, and add protections for encrypted communications, came as such a surprise. Could it really be that after so many years of deeply polarised debates, EU government leaders have finally agreed that even when pursuing the most important societal goals (like protecting children), basic fundamental rights, constitutional protections and technical reality still apply? Did the citizen campaign FightChatControl.eu play a role? And how has this been possible even though Germany, previously a data protection champion, reportedly removed its long-running opposition to “chat