Egidio

The Threat Intelligence Lab → Message scanning in the UK

Regulatory dossier · updated 26/07/2026

The UK's own "Chat Control" — and it isn't Brussels'

Headlines about "Chat Control" usually mean the EU's proposal. The UK left the EU in 2020, years before that text existed, and isn't bound by it. But Britain has been fighting an older, homegrown version of the same argument since 2023 — and it's the one that already made Apple pull a feature from every UK iPhone.

📍 Status as of 26 July 2026: no UK messaging service has been ordered to scan encrypted messages. Ofcom holds the legal power to do so under the Online Safety Act and is expected to publish final guidance on how it would use that power around April 2026. Separately, the Apple encryption standoff — a different law, a different dispute — ended in the UK withdrawing its demand in August 2025, after Apple had already pulled its strongest iCloud encryption from UK customers in February 2025.

Two laws, two disputes, one underlying question

It's easy to conflate three separate things that all touch on the same tension — detecting illegal content in private communications versus preserving end-to-end encryption. In the UK they're genuinely distinct: the Online Safety Act 2023 is the law that gives the regulator Ofcom power to order message-scanning technology; the Investigatory Powers Act 2016 is the separate, older law under which the Home Office ordered Apple to build a backdoor into iCloud; and the EU's Chat Control is a Brussels regulation the UK has had no vote on since 2020. None of the three depend on the others.

What the Online Safety Act actually allows

Section 121 of the Online Safety Act lets Ofcom issue a Technology Notice requiring a platform to use "accredited technology" to identify and remove child sexual abuse material — including, in principle, inside private messaging. Ofcom opened a consultation on how it would use this power in December 2024, and is due to publish final guidance for providers by around April 2026. Separately, in June 2025 Ofcom consulted on additional safety measures for its existing codes of practice, with a statement expected by autumn 2026.

Source: Ofcom, Online Safety Act consultations, December 2024 and June 2025 · Internet Watch Foundation, "The Online Safety Act (OSA) Explained."
2023
The Online Safety Act receives Royal Assent — a UK law, unconnected to the EU's later Chat Control proposal.
UK Parliament.
Dec. 2024
Ofcom opens its consultation on how it would use Technology Notice powers under Section 121.
Ofcom.
Feb. 2025
Apple withdraws Advanced Data Protection (end-to-end encrypted iCloud backup) from UK customers rather than build the access the Home Office had secretly demanded.
Reuters · TechRadar, February 2025.
7 Apr. 2025
The Investigatory Powers Tribunal issues a public judgment on Apple's challenge to the Technical Capability Notice.
Investigatory Powers Tribunal.
Aug. 2025
The UK government withdraws its demand for UK-wide access to encrypted iCloud data, after pressure from the US administration. Legal challenges from Privacy International and Liberty continue into 2026.
JURIST, August 2025.
~Apr. 2026
Ofcom's expected date for final guidance to providers on Technology Notice powers under the Online Safety Act.
Ofcom.

Why no Technology Notice has been issued against WhatsApp or Signal

The power exists on paper; nobody has used it against an end-to-end encrypted service. The reason isn't political reluctance alone — it's technical. Scanning the content of an encrypted message before it's sent, on the device, is the only way to inspect it without breaking encryption for everyone, and no version of that technology has been shown to work at scale without either weakening the underlying security guarantee or producing large numbers of false positives. Commentators reading the Ofcom consultation record this as the practical reason the power hasn't yet been exercised against messaging apps, not as evidence the power has been quietly shelved.

⚠️ Separately, from 8 January 2026, "cyberflashing" and "encouraging or assisting serious self-harm" were formally designated priority offences under the Online Safety Act — widening what platforms must proactively act against. This designation doesn't itself create new message-scanning powers; it adds these offences to the list Ofcom's existing Section 121 power could, in principle, be used against.

Why this matters to Egidio's families, without Egidio depending on any of it

Whichever way the Online Safety Act's message-scanning powers are eventually used, Egidio's approach doesn't change: nothing analysed on your phone is ever transmitted anywhere. Egidio detects scam and manipulation attempts in calls and messaging apps entirely on-device — it doesn't need a regulator's permission to protect you, and it isn't waiting on Ofcom's guidance to keep working exactly as it does today.

Technology Notice

An Ofcom order under Section 121 of the Online Safety Act requiring a platform to use accredited detection technology for CSAM — not yet issued against an encrypted messaging service.

Technical Capability Notice

A separate, secret order under the Investigatory Powers Act 2016 — the instrument the Home Office used against Apple, unrelated to Ofcom or the Online Safety Act.

End-to-end encryption

Cryptographic protection ensuring only sender and recipient can read a message. The point every UK proposal in this space has run into without resolving.

🔒 Egidio never needed a law to protect without transmitting. See how this architecture works on our Methodology page.

Frequently asked questions

Is the UK covered by the EU's Chat Control regulation?

No. The UK left the EU in 2020, before Chat Control existed as a proposal, and is not bound by EU regulations. The UK has its own, separate law covering similar ground: the Online Safety Act 2023, which predates the current EU text and gives Ofcom power to order message scanning through what the Act calls a Technology Notice.

Can Ofcom already force WhatsApp or Signal to scan messages?

Not yet in practice, though the legal power exists. Section 121 of the Online Safety Act lets Ofcom require a provider to use accredited technology to detect child sexual abuse material, including in private messaging. Ofcom consulted on how it would use this power from December 2024 and is due to publish final guidance by around April 2026. No Technology Notice has been issued against an end-to-end encrypted service as of July 2026.

What happened between Apple and the UK government?

Under the Investigatory Powers Act 2016, the Home Office issued Apple a secret Technical Capability Notice ordering access to UK users' encrypted iCloud backups. Apple refused to build a backdoor and instead withdrew Advanced Data Protection from UK customers in February 2025. Apple challenged the notice at the Investigatory Powers Tribunal; by August 2025 the UK government had withdrawn the demand following pressure from the US administration, though related litigation continued into 2026.

Is this the same debate as the EU's Chat Control?

The underlying tension is the same — detecting illegal content in private communications versus preserving end-to-end encryption — but the legal instruments are different and unconnected. The EU's Chat Control is a proposed regulation still being negotiated in Brussels; the UK's Online Safety Act is already law, enforced by Ofcom, and the Apple dispute ran under a third, unrelated UK law.

Explore further

The UK's under-16 social media ban Chat Control: the EU regulation (FR original) Our verification methodology All our sources
Cite this page Egidio — The Threat Laboratory, "The UK's "Chat Control": the Online Safety Act, not Brussels", egidio.app/en/laboratoire/online-safety-act-message-scanning-uk/. Licensed CC BY 4.0.

Free to reuse, including commercially, with attribution. Reuse terms.