The European Parliament has voted to advance parts of the EU’s “chat control” regime, allowing tech companies to scan messages for child sexual abuse material until 2028. The measure—widely criticized by privacy and cryptography advocates—was set to expire in April, forcing lawmakers to decide whether to extend it.
While a majority backed the plan, the outcome was narrowly shaped by parliamentary procedure. According to HowTheyVote, 276 lawmakers supported the extension to stop it being rejected, while 314 voted against extending it. With the rejection threshold requiring 361 votes, the regulation moved forward after failing to secure enough opposition.
Key takeaways
- The Parliament’s vote revives the expired “Chat Control 1.0” framework, with scanning permitted until 2028.
- A carve-out was approved for communications where end-to-end encryption is used or will be used, excluding them from the rules in the relevant context.
- Because the regulation now goes to the EU Council, implementation ultimately depends on ministers from member states.
- Negotiations on a permanent “Chat Control 2.0” are set to resume in September, keeping encryption and scanning scope at the center of the fight.
What the Parliament approved—and what it tried to limit
EU lawmakers on Thursday largely voted against extending the “chat control” regulation, often described by critics as a form of mass surveillance. The mechanism allows certain forms of message scanning aimed at detecting child sexual abuse material. Supporters argue that the objective is essential for protecting children and disrupting the distribution of abusive content.
However, Parliament also approved an exemption aimed at preserving encryption. The decision excludes “communications to which end-to-end encryption is, has been or will be applied,” according to the exemption text referenced in the Parliament’s adopted materials (see TA-10-2026-0266_EN). For advocates of strong cryptography, this was framed as a meaningful limitation—though not an end to the broader scanning framework.
Pirate Party MEP Markéta Gregorová, whose party pushed for the amendment, called the result “a bittersweet victory.” In remarks cited by the Greens/EFA, she said the amendment secured “an absolute majority” in favor of protecting encryption, while “voluntary mass scanning unfortunately passed.”
Why the vote matters for messaging encryption and compliance
The controversy around “chat control” stems from how it interacts with encryption design. Encryption—especially end-to-end encryption—prevents service providers from reading message contents. Critics argue that forcing or incentivizing scanning undermines that core security principle, even when applied in narrowly defined circumstances.
Even with the end-to-end exemption, the Parliament’s action keeps the EU’s compliance direction moving toward detection mechanisms that may require changes to how platforms handle reporting, detection, and risk management. For developers and infrastructure teams, the immediate relevance is not only legal compliance but also how systems are architected to distinguish between encrypted traffic and other forms of communication, and how detection workflows are implemented without weakening privacy guarantees.
For users, the practical impact is uncertain: the measure advances to the Council, and the final shape will depend on how member states interpret and negotiate the text. Still, the policy direction—scanning permission extending through 2028—signals that the EU is not backing away from the core approach.
How “Chat Control 1.0” was extended after its April expiry
The Thursday vote is part of a process triggered by the expiry of the framework in April. As the rules lapsed, messaging services such as WhatsApp were allowed to adopt their own voluntary approaches to identify and respond to the sharing of abusive material, rather than being bound by an EU-wide framework.
Earlier in the week, on Tuesday, the Parliament voted using a rarely used urgent procedure to return to the question of whether to extend the legal basis. That followed a March decision where Parliament had rejected a temporary extension while a permanent “Chat Control 2.0” proposal was being discussed. In March, the European People’s Party—Parliament’s largest political group—had faced opposition over amendments that would have restricted the scope of scans. Yet in the urgent procedure vote on Tuesday, the group revived the extension push.
The internal political dynamics reflected the broader split in Parliament: while there was strong resistance to extending the scheme without changes, the voting threshold meant that the final outcome still leaned toward continuation of the framework.
Next phase: Council review and renewed “Chat Control 2.0” talks
After Thursday’s approval, the legislation with amendments will be sent back to the Council of the EU. The Council—comprised of member state ministers—must decide whether to approve or reject the text, which means the extension is not fully settled until negotiations complete.
Meanwhile, the fight is expected to continue. Earlier coverage noted that the political conflict over a permanent “Chat Control 2.0” is only beginning. As negotiations resume in September, lawmakers are reported to be divided over whether any scanning should be targeted or applied broadly.
For the crypto sector and privacy-focused communities, the critical uncertainty is how negotiators reconcile two competing goals: child safety and the preservation of message privacy at the protocol level. The end-to-end encryption exemption is a notable development, but the fact that voluntary mass scanning still cleared the procedural hurdle suggests that further rounds could again reshape the balance between compliance and cryptographic protections.
Readers should watch the Council’s stance and the September negotiations closely, because the final “Chat Control 2.0” design will determine whether encryption carve-outs remain meaningful in practice—or whether the scope of scanning expands again during final implementation.
