The European Parliament has voted to extend legislation permitting technology companies to voluntarily scan users’ private messages for child sexual abuse material, despite a majority of lawmakers opposing the measure. The decision reinstates the legal basis for firms including Meta, Google, and Microsoft to scan private text, email, and social media messages under a bill critics have dubbed “Chat Control.” End-to-end encrypted communications on platforms such as WhatsApp and Signal remain exempt from the provisions.
What the Extended Chat Control Legislation Permits
The regulation allows tech companies to voluntarily scan private digital communications for content suspected of depicting child sexual abuse. This authority had lapsed in April, prompting the European People’s Party (EPP), the largest political group in the Parliament, to push for its reinstatement before the summer recess. “It will mean that private companies may deny your right to have confidential digital conversations,” said Simeon de Brouwer, policy adviser at European Digital Rights. “They could, if they want to, read every message you write, every email you send, every picture you share.”
The Procedural Maneuver That Bypassed Opposition
The EPP resorted to an “urgent procedure” to force fresh votes after negotiations collapsed in March. This mechanism skips preliminary committee debates where amendments would ordinarily be introduced and stipulates that the regulation passes unless an absolute majority of 361 Members of the European Parliament vote against it. While more MEPs voted against the regulation on Thursday than voted for it, the opposition fell short of that threshold by 47 votes. EPP vice-chair Tomas Tobé told lawmakers earlier in the week: “We cannot go to the summer recess knowing that our children are not protected.”
Civil rights activist and former MEP Patrick Breyer called the ruling a “farce” that “damages democracy.” In a blog post, Breyer argued: “Our children are the real losers in this undemocratic process. Trying to protect children with suspicionless mass surveillance is like frantically mopping the floor while the faucet is still running. Blanket chat control is just as unacceptable as indiscriminately opening everyone’s physical mail.”
What Is Chat Control and Why Does It Matter for Privacy?
Chat Control refers to the legislative framework that permits technology companies to scan private digital communications for suspected child sexual abuse material. Critics argue that the measure undermines the confidentiality of digital conversations and creates a legal loophole that could be expanded to include encrypted services in the future. Proponents maintain that voluntary detection activities have helped identify and rescue victims of online child sexual abuse, and that disallowing such scans leaves children unprotected. The extension will remain in effect until 2028, or until permanent legislation currently under discussion replaces it.
How the Vote Affects Users in the US, UK, Australia, and Canada
While the legislation applies directly to EU member states, its implications extend globally. Major technology firms operating across multiple jurisdictions—including the United States, the United Kingdom, Australia, and Canada—may adopt consistent scanning practices across their platforms to simplify compliance, potentially affecting users worldwide. The exemption for end-to-end encrypted services provides a meaningful privacy safeguard, but the precedent of permitting mass message scanning raises concerns among digital rights advocates about the long-term trajectory of online surveillance.
What Users Should Do Now to Protect Their Digital Privacy
For individuals concerned about the privacy of their digital communications, the most immediate step is to use end-to-end encrypted messaging services that have publicly committed to not scanning message content. Look for a messaging application that offers default end-to-end encryption with independently audited security protocols and a clear privacy policy that explicitly states no content scanning occurs. Additionally, consider using a reputable no-log VPN service when communicating over public Wi-Fi networks to prevent metadata exposure. Regularly review the privacy settings on social media and email platforms to understand what data those services can access. For enterprise users, conducting a privacy impact assessment of all communication tools used within the organization is a prudent first step toward ensuring compliance with evolving data protection standards.
