Apple built this exact tool in 2021. Within weeks, security researchers showed it could flag innocent people's content. Apple killed it 16 months later. The UK just gave tech companies three months to build it anyway, threatening prison for executives who refuse.
The proposal is for something called client-side scanning. End-to-end encryption (the technology that protects your WhatsApp or Signal messages) works by scrambling your messages on your phone before they leave it. Nobody intercepting them can read them. Client-side scanning changes that sequence: your phone checks every image and message against a database of prohibited content before encrypting it. The lock stays in place, but the inspection happens first. When the government says "scan for nude images," technically they mean "scan everything."
The people who invented internet security have already ruled on this. Ronald Rivest helped create RSA encryption, the system behind every padlock icon you see in a browser. Whitfield Diffie invented public-key cryptography, the math that all web security is built on. In October 2021, both co-signed a paper with twelve other leading cryptographers, concluding that device-level scanning undermines security for everyone while giving law enforcement only unreliable gains. Once that infrastructure is on every phone, any government can point it at whatever they decide to ban next.
The EU spent three years trying to pass something identical. Germany blocked a Council vote in October 2025. On March 26, 2026, the European Parliament voted 307 to 306 to reject it. One vote. German federal police data from those debates showed roughly 48% of the 300,000 chats reported annually under existing scanning rules were false positives, innocent people's messages treated as criminal evidence.
There is one more consequence the announcement left out. The government wants to block nude images on children's devices but not adults'. Enforcing that line means every device in the UK needs to know whether its owner is a child. The only way to do that is mandatory age verification. Signal pointed out where this lands: every UK resident would need to prove their identity just to communicate privately. That means 67 million people submitting identification to use software they already own.
The EU rejected this by one vote two and a half months ago. The UK is now attempting it alone.
NEW: U.K. advances proposal to force Apple, Google, Signal, & other platforms to scan private content on users’ devices — executives could face prison if they refuse.