Chat Control Passes On Absences

The European Parliament has kept alive a temporary EU permission that allows tech companies to scan non-encrypted messages for child sexual abuse material. More MEPs voted to kill the measure than to keep it: 314 against, 276 in favour, 17 abstentions (Greens/EFA, La Voix de France). Yet the measure survived.

The reason lies in the machinery. At this stage, Parliament needed an absolute majority of all 720 MEPs to reject the text. That meant 361 votes. Every empty seat, in practice, helped the text survive. The fight over "chat control" is therefore no longer only about scanning messages. It is about how the EU keeps temporary powers in place when the permanent law is politically blocked.

What the Permission Covers

The rule is Regulation 2021/1232, a temporary exception to EU privacy law. In normal circumstances, companies cannot inspect the content of private communications. This exception allows providers such as Microsoft, Google and Meta to voluntarily scan for known child abuse imagery and grooming patterns in services where the company can still read or process the content (EUR-Lex, CADE Project).

End-to-end encrypted services remain outside the measure. Parliament amended the text to protect any communication to which encryption "is, has been or will be applied" (European Parliament LIBE). WhatsApp and Signal, used across Malta as casually as a phone call from Il-Belt to Mosta, are not covered. Webmail and cloud messaging, where providers still have access, remain inside the framework (The European Post, RTVE).

This permission is not new. It first applied in 2021 and expired on 4 April 2026 after earlier renewal attempts stalled. The Council, where national governments sit, revived the text and sent it back to Parliament in July. The extension now runs until April 2028.

How the Vote Rule Became the Story

Parliament was at what EU law calls "second reading". At that stage, it can reject a Council text only by an absolute majority of all MEPs, not merely a majority of those voting. The threshold protects the Council’s position: low turnout or a divided opposition cannot easily block it.

The rule is legally valid. But in this case it produced a politically awkward result. A measure that most voting MEPs wanted to reject passed because 129 members were absent or did not vote.

The Council also used an urgency procedure, which compressed the timetable and reduced Parliament’s room to amend the text or stretch the debate (CADE Project, Greens/EFA). German digital-rights group Digitalcourage called the combination a political manoeuvre (Digitalcourage). That charge matters even if the procedure followed the treaties. A lawful process can still leave weak accountability when the threshold protects the existing position.

The Permanent Law Nobody Can Pass

The temporary permission keeps being renewed because the EU cannot agree on a permanent replacement. The Commission proposed a broader regulation in 2022, built around risk assessments and possible scanning orders for online services (Commission proposal). That proposal is still stuck.

The most contested part is "client-side scanning". This means a device checks messages before encryption makes them unreadable. In effect, it bypasses encryption without technically breaking it.

The split in the Council shows how differently governments balance child protection against communications privacy. Denmark pushed for a tougher approach during its EU presidency (Frihedsbrevet). A group of governments led by Germany and Poland, large enough to block a Council deal, stopped the permanent file before the summer break (EDRi).

Germany’s own position is divided. Berlin accepted the return of voluntary scanning with encryption protected, while German federal data-protection authorities rejected any form of client-side scanning outright (BfDI, Zeit). That split shows Germany can block the permanent law, but has not built a stable alternative. In Poland, digital-rights voices described even voluntary scanning as dangerous, treating users as suspects and providers as "a private police force" (Onet/OKO.press).

For Malta, this is not an abstract Brussels argument. A small state with a large digital economy, iGaming operators, fintech firms and service providers cannot treat EU digital regulation as something happening elsewhere. Rules on who may inspect communications, under what legal cover, and with what audit trail become domestic policy the moment they apply.

The missing evidence gives both sides room to make claims without having to prove enough. Supporters say any lapse in scanning risks losing vital child-abuse reports. Critics warn about false positives and the outsourcing of law enforcement to private companies (Euronews, 24.hu). There is still no transparent, EU-wide audit of scanning accuracy, false-positive rates or prosecution outcomes.

The EU has now extended the permission twice without forcing either side to show its workings. The encryption carve-out is a real win for privacy advocates. But the Union has also normalised a "permanent temporary" exception to communications confidentiality, renewed through a rule that turned absence into consent. Before the next deadline in April 2028, the Commission, the Council and Parliament owe the public a clear accounting of what voluntary scanning actually produces.