The European Parliament voted on 9 July to prolong a temporary exemption from EU privacy rules, permitting online service providers to continue scanning unencrypted private messages, emails and cloud-stored files for child sexual abuse material. The extension, which runs until 3 April 2028, was secured after a motion to reject the Council of the EU’s proposal failed to reach the required absolute majority of 361 votes, stopping at 314. An amendment adopted simultaneously excludes communications protected by end-to-end encryption, meaning services such as WhatsApp, Signal and Threema remain outside the scanning regime, while platforms like Instagram, Snapchat, Skype, Gmail and iCloud can be monitored on a voluntary basis by providers.

According to parliamentary records, the vote split the main political groups. The centre-right European People’s Party, to which Parliament President Roberta Metsola belongs, and a majority of the liberal Renew Europe group backed the extension, arguing that allowing the derogation to lapse would create a legal vacuum endangering children. The Socialists & Democrats were divided. The Greens, the Left, the European Conservatives and Reformists and the Patriots for Europe group opposed the measure, with representatives from Germany’s AfD and Italy’s Lega and Fratelli d’Italia denouncing the procedure as a “democratic scandal” and warning of mass surveillance. The Council, which represents the 27 member states, had unanimously requested the extension and is expected to approve the amended text within three months, though several governments have previously pushed for broader scanning powers that would also cover encrypted communications.

The extension, labelled “Chat Control 1.0” by critics, restores a regime first introduced in 2021 that had expired in April 2025 after the Parliament initially refused to renew it. Under the rules, providers may deploy automated tools to detect known child abuse material and grooming behaviour, but only in unencrypted environments. European providers have historically not used such scanning. The amendment shielding end-to-end encryption carries political weight because it prefigures the Parliament’s position in the parallel negotiation on a permanent regulation, the Child Sexual Abuse Regulation (CSAR), often called “Chat Control 2.0”. That dossier remains deadlocked in trilogue talks between the Commission, Council and Parliament, with the Commission and some member states advocating mandatory scanning of encrypted content, a step the Parliament has consistently rejected.

The path to the vote was shaped by an unusual procedural move. After the March rejection, President Metsola wrote to the Council in June urging it to resubmit the proposal, which it did. The Parliament’s rules then required an absolute majority to block the Council’s text, a threshold opponents could not meet. Viewed from Brussels, the outcome preserves the status quo ante while deepening the institutional rift over encryption. The Council now has three months to accept the Parliament’s amendments; if it refuses, a conciliation procedure will be triggered. The CSAR negotiations continue without a fixed deadline, with the Parliament’s rapporteur maintaining that end-to-end encryption must remain untouched.