EU Parliament Approves “Chat Control,” Extending Private Scans to 2028

The European Parliament has moved to revive “chat control” rules that require tech firms to scan messages for child sexual abuse material for a further period ending in 2028, a proposal widely criticized by privacy and cryptography advocates as undermining the logic of encrypted messaging.

In a Thursday vote, the chamber largely rejected extending the regulation—often referred to by critics as “Chat Control 1.0.” But the effort still advanced after lawmakers voted down the move to stop it, meaning the rules can be carried forward. The vote that would have ended the measure failed to secure enough support: 314 lawmakers voted to continue, while 276 supported the extension.

Key takeaways

• The European Parliament approved a continuation of “chat control” rules tied to scanning messages for child sexual abuse material until 2028.
• Lawmakers rejected an attempt to block the extension, which means the legal framework can proceed despite resistance in the chamber.
• An exemption was approved for communications where end-to-end encryption is, has been, or will be applied—an important carve-out for encrypted messaging.
• The final decision now depends on the EU Council, which will either accept or reject the amended legislation.
• Negotiations for a permanent “Chat Control 2.0” framework are expected to restart in September, with disagreement over whether scanning should be targeted or broad.

How the extension cleared Parliament—and why encrypted messaging mattered

The vote follows the expiration of the earlier framework in April. With that window closed, messaging platforms such as WhatsApp were allowed to use their own voluntary approaches to detect and handle cases involving abusive material.

Thursday’s outcome reflects a split within the Parliament. Critics had aimed to prevent the extension, but stopping it required a higher threshold: only 314 lawmakers voted to halt the rules, short of the 361 needed. Instead, the measure advanced with 276 lawmakers voting in favor of ending the opposition move, effectively enabling the legislative path to continue.

Still, Parliament did deliver a partial win for privacy advocates. The assembly approved an exemption excluding communications where end-to-end encryption is, has been, or will be applied. The exemption was included as part of the legislation that Parliament endorsed, as reflected in the text of the adopted act: EU Parliament document TA-10-2026-0266_EN.

MEP Markéta Gregorová of the Pirate Party—who pushed the amendment to protect end-to-end encryption—called the result “a bittersweet victory.” In a statement, she said she was glad an absolute majority supported an amendment that at least preserves encryption, while also noting that “voluntary mass scanning unfortunately passed.” The statement is available via Greens/EFA: Greens/EFA.

Why the Council of the EU is the next gate

Parliament’s version of the laws—incorporating amendments and the end-to-end encryption exemption—will now be sent to the Council of the European Union. The Council is made up of ministers representing member states and has the authority to approve or reject the legislation.

For investors and builders in the crypto and privacy ecosystem, the practical significance is straightforward: if the rules are adopted as drafted, service providers operating in the EU could face pressure to implement scanning mechanisms for certain categories of content, even while encrypted traffic is carved out under specific conditions. The precise compliance burden—and how it will be interpreted by regulators later—will depend on the final Council outcome and the implementing approach that follows.

The “Chat Control 2.0” fight is expected to intensify

This Thursday vote does not settle the broader dispute. The current legislative push is tied to a wider attempt to update the policy into a more permanent framework—commonly labeled “Chat Control 2.0.”

Earlier this week, the European Parliament used a rarely applied urgent procedure to schedule a vote after the previous framework lapsed. According to earlier reporting by Cointelegraph, Parliament voted Tuesday to revisit whether the expired legal framework should be extended—prompting the return to the chamber on Thursday. That background matters because it shows how quickly the institution moved after the expiration in April and why the extension remained politically contested even within the Parliament.

The sequence also highlights tensions inside Parliament. Earlier in March, lawmakers rejected a temporary extension while “Chat Control 2.0” was being discussed. The European People’s Party, the largest group in Parliament, later revived the extension through the urgent procedure on Tuesday. In March, the group had voted against extending the rules, including due to amendments that would have restricted the scope of scanning.

Looking ahead, negotiations for the permanent “Chat Control 2.0” framework are set to resume in September. Key disagreement centers on whether message scanning should be targeted to higher-risk scenarios or applied more broadly. Former MEP Patrick Breyer—cited in the text provided—argued that resistance in Parliament was strong enough that securing a majority for “permanent, suspicionless mass scanning” would be extremely difficult.

What encrypted messaging advocates will watch next

The exemption for end-to-end encrypted communications is likely to remain the focal point for privacy and cryptography advocates as the measure heads to the Council. The immediate question is not only whether the exemption survives final negotiations, but how it will be operationalized in practice—especially for systems that handle encrypted content while still facing EU compliance expectations.

Readers should watch for Council deliberations and the September negotiations on “Chat Control 2.0,” where lawmakers will decide whether scanning rules will remain constrained or expand in scope. The outcome will shape how closely EU policy aligns with encryption-first design—an issue that continues to carry significant implications for users, developers, and the broader credibility of privacy protections across Europe.