The European Commission’s attempt to access end-to-end encrypted data has faced another setback. Known initially as Chat Control 2.0, the initiative is set to return in a new form called Going Dark or ProtectEU by summer 2026. The plan could potentially extend its scope to include VPN services, raising privacy concerns across the EU.
The Going Dark initiative is the European Commission’s next effort to allow law enforcement authorities to access encrypted data in a “lawful manner.” Essentially, it is being seen as Chat Control 3.0, following the rejection of Chat Control 2.0. Some EU member states are pushing to expand the plan’s reach to cover VPN services, which could affect how people use secure internet connections across Europe.
The Commission and certain member states are also exploring new rules regarding data retention. A recent “Presidency outcome paper” reveals discussions about metadata retention, including information on which websites users visit, who communicates with whom, and the frequency of those interactions. The goal, according to the document, is “to have the broadest possible scope of application.”
Mullvad, a European VPN provider, has actively opposed Chat Control 2.0 for the past three years, despite potential business benefits from the legislation. The company emphasizes it will continue fighting Going Dark vigorously, regardless of whether VPNs are included in the scope.
Mullvad also assures users that if Going Dark becomes law, it will never compromise customer privacy. The VPN service pledges to maintain its strict no-logging and no-surveillance policies, even under new legal pressures.
The European Commission is expected to reintroduce its encrypted data access proposals by summer 2026. Privacy advocates, VPN providers, and citizens across the EU are closely watching how ProtectEU will evolve and whether VPN services will be directly impacted.