Is the EU Becoming a Surveillance State? What Changes in 2026

TL;DR. Three big shifts are reshaping privacy in the EU during 2026. Chat Control 1.0 expired in April, but a permanent message-scanning regulation is still in trilogue with a target deal by July. Every member state must offer a digital identity wallet by the end of 2026 under eIDAS. And the bloc's regulatory and tax load keeps growing, which the EU's own Draghi report flags as a drag on small business. This article explains each change in plain language, with sources.

"Surveillance state" is a heavy phrase, and it gets thrown around loosely. So this article tries to do something more useful than sound an alarm: lay out exactly what is changing in EU privacy and digital-identity law during 2026, what is confirmed versus still being negotiated, and where the legitimate concerns are. Sources are linked throughout so you can check the claims yourself.

The short version is that none of this arrives as a dramatic crackdown. It arrives as a directive, a framework, a "simplification effort." That gradualism is precisely why the bigger picture is easy to miss.

What is EU Chat Control, and what happened in 2026?

Chat Control is the informal name for the EU's proposed Child Sexual Abuse Regulation (CSAR). The stated goal is one nobody disputes: detecting and stopping the spread of child abuse material. The controversy is about the method.

Earlier versions of the proposal would have required messaging platforms to scan the contents of private messages, including on end-to-end encrypted services, before they were sent. Security researchers call this client-side scanning. The objection is straightforward: if your own device scans your messages before encrypting them, the protection encryption is meant to provide is effectively undone, and the same mechanism built to find abuse material can later be pointed at anything.

Here is the 2026 timeline:

April 3, 2026: The voluntary scanning regime, Chat Control 1.0, expired. The European Parliament had voted 311 to 228 to reject extending the ePrivacy derogation that let platforms scan messages voluntarily.
May to June 2026: Trilogue negotiations on the permanent CSAR regulation continued, with a target deal aimed at July 2026.
Where it stands: The Council, representing member-state governments, still favors broad scanning powers. The Parliament is the institution pushing back. The most aggressive encryption-breaking language has been softened, but new elements such as age-verification triggers have been added.

Critics, including the Electronic Frontier Foundation, warn these additions create room for mission creep, where a narrowly justified power gradually expands. Germany's Max Planck Society reviewed client-side scanning and concluded it delivers "more monitoring, but not more protection." The proposal keeps returning in modified form, which is what makes the direction of travel notable regardless of any single vote.

The EU digital identity wallet: optional, or inevitable?

While the messaging debate gets the headlines, a quieter change is arriving on a fixed legal deadline. Under the revised eIDAS regulation (Regulation (EU) 2024/1183), every EU member state must make a digital identity wallet available to citizens, residents, and businesses by the end of 2026. This is a legal requirement, not a goal.

The wallet itself is genuinely useful. It links your national digital ID with credentials like your driving licence, diplomas, professional qualifications, and bank account in a single app. That consolidation is also the source of concern. A single credential that proves who you are across both public and private services, and that you are expected to use for a widening range of everyday interactions, is powerful infrastructure.

The open questions are about practice rather than statute. How optional does it stay once major services start expecting it? How selectively can you actually disclose individual attributes rather than your whole identity? Those answers depend on implementing rules still being written and enforcement that has barely begun. The architecture, though, is being built now, and infrastructure is far harder to change after adoption than before it.

Regulation and taxes: the pressure on entrepreneurs

Surveillance gets attention. Bureaucracy is the slower, quieter pressure, and on this point the EU's own institutions are unusually candid.

Mario Draghi, former president of the European Central Bank and former prime minister of Italy, delivered a landmark report on European competitiveness that Brussels could not ignore. His diagnosis was blunt: the EU's reporting and due-diligence frameworks are a major source of regulatory burden, and small companies and startups face near-insurmountable obstacles, from fragmented capital markets to compliance layers that large firms absorb and small ones cannot.

The EU's response, the Competitiveness Compass launched in early 2025, promised an "unprecedented simplification effort." The follow-through is telling. By September 2025, of the report's 383 recommendations, only about 11 percent had been fully implemented, and roughly a quarter had not been touched at all.

The tax side compounds it. In 2024, tax revenue including social contributions reached 40.4 percent of GDP across the EU, exceeding 45 percent in Denmark, France, and Belgium. It is not a coincidence that the most tax-competitive economies on the continent, the Baltic states such as Estonia and Latvia, also produce outsized startup activity relative to their size. Capital and talent are mobile, and they move toward places that treat building a business as something to encourage.

So, is the EU a surveillance state?

The honest answer is more nuanced than the phrase suggests. The EU is not an authoritarian state, and many of these measures are defended on genuinely reasonable grounds: protecting children, modernising identity, ensuring corporate accountability, funding public services. Each one, taken alone, sounds responsible.

The concern is cumulative. Persistent attempts to scan private communication, mandatory digital identity infrastructure, and a steadily growing compliance and tax load together describe a trajectory in which privacy is increasingly treated as a loophole to close and entrepreneurship as an activity to manage. Whether that trajectory continues depends heavily on how the open negotiations of 2026 resolve.

How to protect your privacy under the new rules

You do not have to accept every default. None of the following is about evading accountability; it is about keeping a reasonable boundary between your private life and systems designed to log it.

Use end-to-end encrypted messengers such as Signal, and follow the CSAR outcome, since it directly affects how private those apps can remain.
Treat the digital ID wallet as opt-in for as long as it is. Learn what selective disclosure your national wallet supports before you rely on it.
Separate your real identity from low-stakes signups. A rental phone number lets you verify accounts without handing your primary number to every service that asks.
Control what your connection reveals. A VPN keeps your traffic and location from becoming a default data point, and an anonymous eSIM provides mobile data that is not automatically tied to your verified national identity.

Which of these you need depends on your threat model. For most people the practical takeaway is simpler: privacy in the EU is shifting from a default to a deliberate choice, so it is worth understanding the changes before they are fully in place.

Frequently asked questions

Is EU Chat Control still happening in 2026? The voluntary scanning regime (Chat Control 1.0) expired on April 3, 2026 after Parliament rejected extending it. The permanent CSAR regulation that could mandate scanning is still in trilogue negotiations, with a target deal aimed at July 2026. It is not settled.

Will the EU digital identity wallet be mandatory? Every member state must make a wallet available by the end of 2026 under Regulation (EU) 2024/1183. It is presented as optional for citizens, but the infrastructure is designed for broad public and private use, and how optional it remains in practice will depend on rules still being written.

Does Chat Control break encryption? The most aggressive versions would have required client-side scanning, which security researchers say undermines end-to-end encryption in practice. The current negotiating text has softened that language, but privacy groups warn newer provisions could reintroduce similar effects.

Which EU countries have the highest taxes? By tax revenue as a share of GDP in 2024, Denmark (45.8 percent), France (45.3 percent), and Belgium (45.1 percent) were the highest, against an EU average of 40.4 percent.

Is it legal to use a VPN or anonymous SIM in the EU? Yes. VPNs are legal across the EU, and using privacy-protecting connectivity is lawful. The legality of a service is separate from how you use it.

Sources

nadanada provides anonymous eSIM, VPN, and rental phone numbers payable via Bitcoin Lightning Network. No accounts. No KYC.