The European Parliament has voted to reinstate a temporary legal framework permitting online platforms to voluntarily scan private messages, including emails and direct messages, for child sexual abuse material (CSAM), effectively reviving a surveillance regime that expired in April after lawmakers previously blocked its extension. The approval came on Thursday after a motion to reject the proposal fell far short of the required absolute majority, clearing the way for the return of what critics call “Chat Control 1.0.”<\/p>\n
The motion to reject the proposal received 314 votes in favor, 276 against, and 17 abstentions \u2014 well below the 361 votes needed for an absolute majority of all Members of the European Parliament (MEPs). This outcome allowed the legislation to proceed without a full committee review after being fast-tracked through an urgency procedure agreed upon the previous day. The restored regulation, originally enacted as Regulation (EU) 2021\/1232, grants providers of communications services legal certainty to voluntarily deploy automated detection tools on private communications that are not<\/a> protected by end-to-end encryption.<\/p>\n Several amendments intended to introduce stronger privacy safeguards also failed because they required the same absolute majority threshold. An amendment that would have limited scanning to users specifically authorized by a judicial order received 322 votes in favor and 255 against \u2014 a majority of those voting, but still short of the 361-vote bar. Another amendment addressing encrypted communications similarly failed despite majority support among voting MEPs.<\/p>\n The revived temporary derogation from the EU’s ePrivacy Directive allows companies such as Meta<\/a>, Google<\/a>, Microsoft<\/a>, and Apple<\/a> to voluntarily scan private communications for CSAM, provided those services do not use end-to-end encryption. Public social media content and cloud storage were already outside the scope of this temporary measure and remain scannable under separate legal bases. End-to-end encrypted services are technically outside the mandatory scope of the rule, though privacy advocates warn that the framework could encourage voluntary client-side scanning implementations that undermine encryption guarantees.<\/p>\n The temporary framework is expected to remain in effect until 2028 or until a permanent regulation is adopted, whichever comes first. It is distinct from the proposed Child Sexual Abuse Regulation (CSAR), known as “Chat Control 2.0,” which remains under negotiation and would establish a permanent, more expansive legal framework governing detection and reporting of CSAM and online grooming.<\/p>\n Former Pirate Party MEP Patrick Breyer sharply criticized the outcome, arguing that the legislation advanced “against the will of the majority of voting MEPs” and calling the process undemocratic. He warned that extending the temporary regime could reduce pressure to reach agreement on a permanent child protection framework, potentially prolonging mass surveillance of private communications.<\/p>\nWhat the Restored Framework Actually Permits<\/h2>\n
Privacy Advocates Condemn the Revival<\/h2>\n