Chat Control Survives Parliament Rebuff

The European Parliament has kept alive a temporary power allowing technology companies to scan non-encrypted messages for child sexual abuse material, even though more MEPs voted against it than for it. The numbers were stark: 314 against, 276 in favour and 17 abstentions (Greens/EFA, La Voix de France). Yet the measure survived.

The reason lies in the machinery of EU law rather than the headline vote. At this point in the process, Parliament needed an absolute majority of all 720 MEPs to kill the text. That meant 361 votes. Every empty seat, in effect, helped the measure through. The argument over "chat control" has moved beyond the question of scanning itself. It is now also about how the EU keeps temporary powers running when the permanent law is politically stuck.

What the Permission Covers

The rule in question is Regulation 2021/1232, a temporary carve-out from EU privacy law. Under the ordinary rules, companies cannot inspect the content of private communications. This exception allows providers such as Microsoft, Google and Meta to scan voluntarily for known child abuse images and grooming patterns in services where the company can still read or process the material (EUR-Lex, CADE Project).

End-to-end encrypted services remain outside the scheme. Parliament amended the text to protect any communication to which encryption "is, has been or will be applied" (European Parliament LIBE). WhatsApp and Signal are therefore not covered. Webmail and cloud messaging services, where providers retain access to content, remain within reach (The European Post, RTVE).

This is not a new permission. It first came in during 2021 and expired on 4 April 2026 after earlier efforts to renew it stalled. The Council, where national governments negotiate, revived the text and sent it back to Parliament in July. The extension now runs until April 2028.

How the Vote Rule Became the Story

Parliament was at what EU law calls "second reading". At that stage, it can reject a Council text only with an absolute majority of all MEPs, not merely a majority of those voting. The rule gives protection to the Council’s position: low turnout or a fragmented opposition cannot easily overturn it.

That may be legally tidy, but politically it produced an awkward result. A measure that most voting MEPs wanted to stop passed because 129 members were absent or did not vote.

The Council also used an urgency procedure, shortening the timetable and reducing Parliament’s scope to amend the text or lengthen the debate (CADE Project, Greens/EFA). German digital-rights group Digitalcourage called the combination a political manoeuvre (Digitalcourage). The charge has force even if the procedure complied with EU rules. Lawful process can still leave weak accountability when the threshold protects the status quo.

The Permanent Law Nobody Can Pass

The temporary permission keeps coming back because the EU still cannot agree on a permanent replacement. The Commission proposed a wider regulation in 2022, built around risk assessments and possible scanning orders for online services (Commission proposal). That file remains blocked. Its most disputed element is "client-side scanning", where a device checks messages before encryption makes them unreadable. In practical terms, it would get around encryption without technically breaking it.

The split in the Council shows how differently governments balance child protection and communications privacy. Denmark pushed for a tougher line during its EU presidency (Frihedsbrevet). A group of governments led by Germany and Poland, large enough to block a Council deal, stopped the permanent file before the summer break (EDRi).

Germany’s own position is divided. Berlin accepted the restoration of voluntary scanning with encryption protected, while German federal data-protection authorities rejected any form of client-side scanning outright (BfDI, Zeit). That tells its own story: Germany can block the permanent law, but it has not built a stable alternative. In Poland, digital-rights advocates described even the voluntary permission as dangerous, saying it treats users as suspects and providers as "a private police force" (Onet/OKO.press).

The absence of hard evidence gives both sides room to make claims without proving them. Supporters say any gap in scanning risks losing vital child-abuse reports. Critics warn about false positives and the outsourcing of law enforcement to private companies (Euronews, 24.hu). There is no transparent EU-wide audit of scanning accuracy, false positives or prosecution outcomes.

The EU has now extended this permission twice without requiring either camp to show its workings. The encryption carve-out is a real gain for privacy advocates. But something else has also been normalised: a supposedly temporary exception to communications confidentiality, renewed through a rule that turned absence into consent. Before the next deadline in April 2028, the Commission, the Council and Parliament owe the public a clear account of what voluntary scanning actually delivers.