Signal's president Meredith Whittaker does not negotiate on encryption. In multiple public statements, she has made clear that when — not if — UK regulators demand the company build a backdoor into private messages, Signal will leave. No special carve-outs. No "we'll do it for children." Exit the market entirely. That is not posturing. It is a stated business decision. And as of April 7, 2026, that threat moved from abstract to imminent. The UK's Ofcom regulator has reached its self-imposed deadline to publish final guidance on Section 121 of the Online Safety Act — a legal mechanism that grants the regulator power to compel any encrypted messaging service operating in the UK to install what the government calls "accredited technology" to scan private communications for child sexual exploitation and abuse (CSEA) and terrorism content. The new CSEA reporting duty went live on April 7. Ofcom's guidance on how Section 121 technology notices will work is due in April 2026. That deadline is now.
This is not a policy proposal or a white paper. This is a regulatory enforcement mechanism with teeth. Ofcom already possesses the power to impose penalties of up to £18 million or 10 percent of qualifying worldwide revenue — whichever is greater — against any platform that fails to comply. In extreme cases, Ofcom can obtain a court order forcing payment processors, advertisers, and ISPs to cut off a service entirely. Apple, which operates in the UK and is subject to Ofcom's authority, already capitulated in February 2025 by disabling end-to-end encryption for UK iCloud users. Signal operates in the UK too. The company knows exactly what is coming. What is less clear is whether Ofcom will actually pull the trigger, or whether the regulator is waiting to see how Europe's parallel Chat Control proposal develops before acting unilaterally.
The scanning architecture that Ofcom is considering reveals why security experts are alarmed. The proposal does not flag suspicious messages and then scan them. It scans every message on your device before it is encrypted — a process called client-side scanning — and compares each message against databases of known illegal content using what regulators call "perceptual hashing" or "digital fingerprints." Alec Muffett, a security engineer who worked on privacy at Facebook, told Computer Weekly that Ofcom's proposals display "a horrifying lack of safety by design" and that the architecture amounts to "the risk of creating an enormous cloud surveillance engine." The difference between what Ofcom is proposing and a general-purpose surveillance backdoor is, in Muffett's assessment, nonexistent. Perceptual hashing is not magic. It produces false positives. It can be reverse-engineered. And once the scanning infrastructure exists, any government — now or in the future — can repurpose it to scan for political content, dissent, or anything else the state deems a threat. That is why the scanning architecture itself is the actual threat, independent of what regulators claim they intend to use it for.
The conditions that created this moment are straightforward. In 2023, the UK passed the Online Safety Act, which gave Ofcom unprecedented authority over digital communications. Section 121 of that act allows the regulator to issue a "technology notice" — a binding order — requiring any service to implement scanning technology. The UK Government's National Security Technology Centre went further in January 2026, releasing guidance suggesting that creating applications like Signal or WhatsApp could constitute "hostile activity." Sweden's parliament is simultaneously considering a law requiring messaging apps to store and provide access to user communications. The UK is watching Europe's Chat Control proposal closely; if Brussels moves first, London will have political cover to act. If Europe stalls, the UK may wait rather than act alone. But the regulatory architecture is in place. The deadline has been set. The only variable now is whether Ofcom exercises the power it has been given.
Signal is not bluffing about departure. The company operates in an estimated 190 countries and does not have deep roots in any single market. The UK represents a meaningful user base but not an existential business. The decision to exit would be painful but survivable. Complying with a backdoor mandate is not survivable — at least not while maintaining any credible claim to offer encryption. Apple chose compliance over principle and is now selling UK users a product that does not deliver the privacy it advertises elsewhere. Signal is not going to make that choice. For Meredith Whittaker, the principle is not negotiable: there is no way to implement a safe backdoor. If Ofcom issues a Section 121 notice against Signal, Signal will leave the UK. WhatsApp and iMessage face a different calculation. Meta and Apple have different business models, different shareholder bases, different geographies. They may comply. The precedent would then be established: rich, compliant companies get to stay. Companies that refuse to compromise on encryption leave. Users lose options. The UK market becomes a surveillance jurisdiction where encryption is theoretical.
The real story here is not whether Ofcom acts in April — it is that the UK has built the legal and bureaucratic machinery to compel encryption backdoors in a Western liberal democracy for the first time since the 1990s Clipper Chip proposal failed. The machinery is not hypothetical. It is not a threat. It is activated. Ofcom has the authority. The deadline has passed. What remains is a decision. And the existence of that machinery matters regardless of whether Ofcom immediately uses it. Companies have to plan for the possibility. Users have to understand that encrypted communications in the UK may not be encrypted for much longer. The broader Freedom Tech ecosystem is shipping regardless: Core Lightning's v26.04rc3 release candidate, currently in testing, introduces negative routing fees that improve Lightning liquidity without any regulatory touchpoint. Fedimint's v0.11.0 releases, shipping the same week as the Ofcom deadline, include NAT traversal for home mints — infrastructure for private, federated money that runs independently of any jurisdiction's rules. The Human Rights Foundation announced 1.5 billion satoshis in Bitcoin Development Fund grants in April 2026, supporting open-source projects in jurisdictions where freedom of communication is already restricted. These developments matter because they assume what Ofcom's machinery implies: that encrypted communication and private money will face increasing state pressure, and the only answer is infrastructure that lives outside the reach of state mandates.
Watch three things. First, the actual text of Ofcom's April 2026 guidance. Does it frame Section 121 technology notices as mandatory or conditional? Does it explicitly contemplate client-side scanning or leave room for alternative approaches? The language will tell you whether Ofcom believes it has the regulatory authority to compel scanning, or whether it is hedging. Second, Signal's official response to the published guidance. If the company issues a formal statement, it will be the clearest signal — no pun intended — of whether exit is genuinely on the table or whether negotiations are happening behind closed doors. Third, the EU Chat Control vote. If Brussels moves toward mandatory scanning, the UK will have political cover to act. If Europe stalls, London may wait. The two jurisdictions are watching each other, and the outcome in one will likely determine the outcome in the other. The machinery is built. The question is whether it gets used.