EU Parliament approves temporary exception for chat control on second attempt

The background goes back to May 2022, when the EU Commission proposed to legally oblige internet platforms to mass-scan private chat messages for abuse depictions. Until then, this had been done on a voluntary basis. An initial exception in European data protection law had made this possible but was tied to time limits.

Already in March, the Parliament had rejected the unchanged extension of this exception. In fact, a majority of members had already positioned themselves against the project more than three months ago. After this rejection, the exception expired in April, removing the legal basis for platforms to conduct scanning. The EU Commission classifies Europe, according to its own statements, as the world's largest location for depictions of sexual child abuse on the internet. According to a projection by various lobbying organisations, Every second two corresponding images or videos are shared online.

Background: Rejection in March and expiration of the exception

The expiration of the regulation triggered sharp criticism. Friedrich Merz (CDU) spoke of a severe "setback for the protection of our children." Investigative authorities, child protection organisations and several politicians also warned of the consequences. Companies such as WhatsApp, Microsoft, Google and others could soon again be allowed to search private chats for indications of sexual child abuse.

After the surprising change of course, Roberta Metsola brought the topic back onto the agenda at the EU summit in June. She spoke out there for a political agreement on a transitional solution. Subsequently, the EU member states adopted a resolution that provided for the extension of the exception as a transitional solution until a new regulation enters into force.

Urgency procedure and role of the EPP

The European People's Party (EPP), which also includes the German CDU and CSU, had pushed forward the urgency procedure to enable the vote before the summer break. On Tuesday, the members had previously voted by a narrow majority in favour of holding Thursday's vote. Under the urgency procedure, only an absolute majority of all EU parliamentarians (not just those present in the plenary chamber) could have prevented the extension.

Austria's SPÖ and ÖVP announced they would vote for the extension, while FPÖ, NEOS and the Greens – for different reasons – voted against. SPÖ EU delegation leader Andreas Schieder described the provisional voluntary review as "not what we want, but we will agree to it." Schieder also advocated that "platforms must take responsibility." ÖVP member Lukas Mandl said it was "important that platforms may continue to search and children are protected."

Positions of the Austrian parties

The FPÖ rejected chat control as "indiscriminate mass surveillance" and declared this had nothing to do with the protection of fundamental rights. The Greens criticised that the vote from March had not been respected. From the Greens faction it was stated that the process abused a loophole in the procedure.

AfD member of the European Parliament Mary Khan spoke of a democratic scandal. Erik Marquardt, head of the German delegation of the Greens, added that Metsola had massively overstepped her role. The MEPs Martin Sonneborn and Sibylle Berg (both Die Partei) had also criticised the accelerated procedure as inadmissible in a letter to Metsola. Individual members from several factions accused Metsola of having brought the topic back to a vote through the back door.

Criticism of the procedure

However, the Parliament demanded changes to the proposal. The amendments, which the Council of EU countries must now also approve, are apparently intended to delay the extension somewhat. The transitional regulation is to apply until April 2028. This allows the legislative process to continue.

At the core of the debate is the question of whether messenger and other online platforms should be permitted to automatically scan private communication for known abuse material. In doing so, software on the smartphone or computer checks the content of messages, photos and videos directly, before they are encrypted and sent. This so-called client-side scanning allows automated checks on end devices without breaking end-to-end encryption, as is standard with WhatsApp and Signal.

Parliament's amendments and next procedure

Parliament largely rejects client-side scanning and demands, according to its own position, that content that is still to be encrypted must not, as a matter of principle, be automatically scanned. An adopted amendment provides for exempting communication that uses end-to-end encryption from the scope of the law. According to Parliament's will, the exception should also be restricted exclusively to already known abuse material.

Data protection commissioners and civil rights organisations have long criticised the plans and warn of a de facto abolition of the free internet. They judge indiscriminate scanning to be disproportionate mass surveillance that is moreover ineffective in protecting children. Under EU rules, a human must review suspicious cases before tech companies forward them to authorities, in order to rule out programming errors.

Data protection concerns and client-side scanning

Before the transitional regulation enters into force, the EU Commission must comment on Parliament's amendments. Subsequently, the Council of EU member states has three months to adopt or reject the changes. If the Council does not adopt all the changes, a conciliation procedure is initiated to reach an agreement on the law. Council approval was considered a formality, since it had already agreed to the extension in principle.

Outlook: Permanent solution still far off

Independently of the transitional regulation, the European Parliament and the member states continue to work on a permanent legal basis for handling depictions of sexual child abuse on the internet. There is as yet no agreement on its exact design. The new long-term rules can only enter into force once both institutions agree.

Mandl was combative after the vote: "Ich habe kein Verständnis dafür, wenn Kinderschutz zur Verhandlungsmaterie gemacht wird. Das ist unangebracht. Das haben wir heute korrigiert, wenn auch mit einigen Wermutstropfen, weil einige wenige eingebrachte Anträge zur Verwässerung knappe Mehrheiten gefunden haben. Der sprichwörtliche Ball liegt jetzt beim Rat der Regierungen. Ich bin zuversichtlich, dass der Ball bald verwertet wird und wir den Kinderschutz wieder einschalten. Kinderschutz duldet keinen Aufschub." Chat control thus remains, for the time being, a political contentious issue between data protection and child protection.

Google, Meta, Microsoft and Snap had in the meantime announced that they would continue voluntary child protection measures in their messenger services. Platforms had also complained about the lack of a legal basis for scanning. Negotiations between Parliament and the Council on restrictions to the scanning rules had previously failed, due in part to resistance from several countries – including Austria and Germany – on data protection grounds.