u/Far_Tower_4693

Here are my thought on things that might be good to have if we get the worst possible versions of the DSA, Chat Control 2.0 and ProtectEU.

If "app stores" are defined as any graphical user interface where you can download software, that's going to be a massive hit to the availability of open source software, but I don't see how they would stop people from updating software they already have using terminal commands.

Old hardware from before any hardware level backdoors that might come in the ProtectEU legislation.

Iso files for a few different Linux distros, including Tails (Tor is included and on by defaukt iirc) and Devuan or Artix (problematic for other reasons but unlikely to enforce age verification, see the systemd discussions). "Linux from scratch" might come in handy.

Install files for the Tor browser, WireGuard, possibly even the i2p router and Kiwix (for Wikipedia). Instructions on how to use these tools.

Wikipedia as a zip file.

What else might be nice to have?

Om man läser det här läckta dokumentet låter det som att EC vill inkludera även telefonsamtal i Chat Control, och vad är grejen om "period of non-disclosure"?

Politico-läckan i fråga, via Patrick Breyer:

Telefonsamtal inkluderas: se sida 5, botten av sidan

"Period of non-disclosure": sida 4, artikel 15, rad 352

https://www.patrick-breyer.de/wp-content/uploads/2026/05/8612-2026-Document-CSAM-%E2%80%94-presidency-compromise.pdf

This looks worrying. The EU Comission wants to include phone calls as well. And what's with the period of non-disclosure? "Line 352: Period of non-disclosure by providers – align with TCO Regulation (6 months) or insist on Council mandate? (12 months)."

Phone calls included: see page 5, bottom segment.

Period of non-disclosure: see page 4, article 15, line 352

Link: https://www.patrick-breyer.de/wp-content/uploads/2026/05/8612-2026-Document-CSAM-%E2%80%94-presidency-compromise.pdf

I've really tried to figure this out but I still don't get it. EU officials say nothing will be logged with their age verification app. The eidas 2.0 law says every action will be logged and kept for 5 years (Article 9).

Some amendment drafts mention 10 years retention of logs. Other amendment drafts mention a differentiation between certified wallets (logging requirement) and uncertified wallets (no logging requirement. The architecture reference framework mentions that details of logging requirements can be found under Topic 19 in the Annex, but if you go to the Annex no topic 19 exists.

I guess you have to assume that everything will be logged and kept for 5-10 years, which would make this "privacy preserving" app really look a lot more like centralized government surveillance, and you might be better off using literally any other app?