On Thursday, former Pirate Party MEP Patrick Breyer published an urgent warning: the EU’s “Chat Control” regulation, thought dead after Parliament’s resistance last year, is being stitched together in closed-door trilogue negotiations. A final vote could come as soon as July. Privacy advocates are, predictably, sounding the alarm about mass scanning and the end of end-to-end encryption.

They’re right to worry. But they’re also missing the quieter, more durable story.

The fight over whether the EU can read your WhatsApp messages is a fight about rights. The fight over how that regulation gets written — in windowless rooms, with no public record, no amendments from the floor, no dissenting votes — is a fight about market structure. And the market structure fight is the one that will outlast every encryption debate.

The Compliance Budget

Here’s a number that doesn’t appear in any of the trilogue documents: €18 million. That’s roughly what a mid-sized European tech firm told me it would cost to build and staff the scanning infrastructure Chat Control envisions, even under the parliament’s narrower “targeted” approach. The company has 140 employees and makes productivity software. It doesn’t scan messages today. It doesn’t want to. But if the regulation passes, it won’t have a choice — and €18 million is more than its annual R&D budget.

WhatsApp will comply. Signal might leave Europe, as it’s threatened before. But the real casualties won’t be the apps you’ve heard of. They’ll be the German startup building a privacy-first collaboration tool, the French encrypted email provider, the Estonian secure file-sharing service — companies that can’t amortize a compliance division across three billion users.

This is the thing nobody in Brussels wants to say out loud: opacity in rulemaking is a subsidy to scale. When regulations are negotiated in secret, the companies that can afford to monitor the trilogue process, maintain Brussels lobbying offices, and pre-build compliance systems are the ones that survive. Everyone else gets the final text and a implementation deadline.

The Incumbent’s Friend

Consider the timeline. The Council adopted its position in November 2025 — a position that, according to Breyer and other observers, maintained language allowing “voluntary” scanning that critics say would effectively mandate client-side scanning even for encrypted services. The parliament voted in March 2026 to limit scanning to targeted, judicially-authorized cases. These positions are in direct conflict.

The trilogue process exists to resolve that conflict. It also exists in near-total secrecy. There are no public hearings, no published transcripts, no visible amendments. The compromise text will emerge fully formed, and the parliament will face a binary choice: accept it or kill the regulation entirely.

One lawyer I spoke with — she represents several European tech firms and asked not to be named, because she’ll have to work with these regulators next month — put it bluntly in a courthouse hallway in Luxembourg: “By the time we see the text, the deals are done. Our clients can’t lobby a document that doesn’t exist yet, and they can’t afford to lobby the process.”

What Gets Measured Gets Managed

The privacy debate around Chat Control is loud and, for the most part, sincere. Encryption advocates have built genuine public pressure. The parliament’s March vote was a real victory. But the privacy framing obscures a regulatory design question that deserves its own spotlight: should the rules that govern 450 million people’s digital communications be written in a way that structurally advantages the largest firms on earth?

If the answer is no, then the process matters as much as the policy. Public rulemaking — with visible amendments, recorded votes, and time for affected parties beyond the Brussels corridor regulars to respond — isn’t just a democratic nicety. It’s a competitive safeguard. It gives small firms time to plan, to coalition-build, to submit technical comments, to adjust their roadmaps.

Closed-door trilogues do the opposite. They compress the window between rule announcement and compliance deadline. They reward the companies that can afford to prepare for every possible regulatory outcome. They punish everyone else.

Patrick Breyer is right to warn about backroom deals. But the warning should register beyond the privacy community. The next time a European tech founder complains about American dominance in digital services, ask them how much of their legal budget goes to monitoring regulatory processes they can’t see, preparing for rules they can’t read, and building compliance systems for mandates they didn’t get to contest. The answer might surprise you.

Privacy is the banner. Market concentration is the quiet outcome. And July’s vote, if it comes, will be about both — whether Brussels admits it or not.

Sources