Chat control survives despite 314 negative votes

The European Parliament voted on whether to kill a temporary permission for tech companies to scan non-encrypted messages for child sexual abuse material. More MEPs voted to reject it than to keep it: 314 against, 276 in favour, 17 abstentions (Greens/EFA, La Voix de France). The measure survived anyway. At this stage of the process, Parliament needed an absolute majority of all 720 members to reject the text, meaning 361 votes. Every empty seat worked like a vote in favour. The fight over "chat control" is no longer only about scanning. It is about how the EU keeps temporary powers alive when the permanent law is blocked.

What the Permission Covers

The rule at issue is Regulation 2021/1232, a temporary exception to EU privacy law. Normally, companies cannot inspect message content. The exception lets providers like Microsoft, Google and Meta voluntarily scan for known child abuse imagery and grooming patterns in services where the company can still read or process the content (EUR-Lex, CADE Project).

End-to-end encrypted services are excluded. Parliament amended the text to protect any communication to which encryption "is, has been or will be applied" (European Parliament LIBE). WhatsApp and Signal stay outside the framework. Webmail and cloud messaging, where providers retain access, stay inside it (The European Post, RTVE).

The permission is not new. It first applied in 2021 and expired on 4 April 2026 after earlier renewal attempts stalled. The Council (where national governments sit) revived the text and sent it to Parliament in July. The extension runs until April 2028.

How the Vote Rule Became the Story

Parliament was at what EU law calls "second reading," the stage where it can reject a Council text only by an absolute majority of all MEPs. That threshold protects the Council's position: a slim turnout or a divided opposition cannot block it. The rule is legally sound. But in this case, it meant a measure that most voting MEPs wanted dead passed because 129 members did not show up or did not vote.

The Council also used an urgency procedure, which compressed the timeline and limited Parliament's room to amend the text or extend debate (CADE Project, Greens/EFA). German digital-rights group Digitalcourage called the combination a political manoeuvre (Digitalcourage). That charge matters politically even if the procedure followed EU treaty rules, because lawful process can still produce weak accountability when the voting threshold protects the status quo.

The Permanent Law Nobody Can Pass

The temporary permission keeps getting renewed because the EU cannot agree on a permanent replacement. The Commission proposed a comprehensive regulation in 2022 that would create risk assessments and possible scanning orders for online services (Commission proposal). That proposal remains stuck. Its most contested element is "client-side scanning," where a device would check messages before encryption makes them unreadable, effectively bypassing encryption without breaking it.

The Council split reflects how differently governments weigh child safety against communications privacy. Denmark pushed for a tougher approach during its EU presidency (Frihedsbrevet). A group of governments led by Germany and Poland, enough to block a Council deal, stopped the permanent file before the summer break (EDRi). Germany's own position is fractured: Berlin accepted restoring voluntary scanning with encryption protected, while German federal data-protection authorities rejected any form of client-side scanning outright (BfDI, Zeit). That internal split signals that Germany can block the permanent law but cannot build a stable alternative. In Poland, digital-rights voices described even the voluntary permission as dangerous, treating users as suspects and providers as "a private police force" (Onet/OKO.press).

The missing evidence gives both sides room to make claims they do not have to prove. Supporters say any lapse in scanning risks losing vital child-abuse reports. Critics warn about false positives and outsourcing law enforcement to private companies (Euronews, 24.hu). No transparent, EU-wide audit of scanning accuracy, false-positive rates or prosecution outcomes exists. The EU has now extended the permission twice without requiring either side to show its work. The encryption carve-out is a real win for privacy advocates. But the EU has also made something normal: a "permanent temporary" exception to communications confidentiality, renewed through a rule that turned absence into consent. The Commission, the Council and Parliament all owe a public accounting of what voluntary scanning actually produces before the next deadline in April 2028.