EU Parliament clears return of voluntary chat control after procedural maneuver

The regulation is an extension of an exemption that has been in force since 2021 and was repeatedly time-limited. In spring 2026, the European Parliament and member states could not agree on a continuation, causing the time-limited permission to lapse in early April. The new regulation is limited in duration until 3 April 2028. It permits large online services such as Google, Meta, and Microsoft to voluntarily and automatically scan unencrypted private messages and images for depictions of child sexual abuse, with suspected cases reported to authorities.

What the regulation does

The measure is an opt-in permission rather than an obligation: no provider is forced to perform scanning. End-to-end encrypted messengers such as WhatsApp, Signal, and Threema are explicitly exempt from the regulation, as scanning their content is technically impossible without the key. Affected by the regulation are unencrypted services from US providers, including Gmail and Outlook.com email, direct messages on Instagram, Snapchat, and Discord, and communications via Microsoft Xbox.

The European Parliament also ensured that content intended to be encrypted must remain untouched, ruling out client-side scanning on the smartphone before sending. The draft of the permanent regulation no longer contains a general obligation to scan, including encrypted content. Critics warn, however, that mandatory obligations for providers could allow scanning to return through the back door.

Procedural controversy

Parliament President Roberta Metsola, of the European People's Party (EPP/EVP), wanted to prevent a legal vacuum and pushed for the EU Council to reconsider the exception. The EPP group demanded the regulation be pushed through Parliament in an expedited procedure early in the week, an unusual approach. Some members of Parliament believe that Metsola may have violated Parliament's rules of procedure with this maneuver.

The Greens described the procedural maneuver as a "schwarzer Tag für Demokratie, Bürgerrechte und Kinderschutz." The Pirate Party called the procedural trick a "Farce." The AfD told the dpa news agency that the move was a "demokratischer Skandal." Civil rights activist and former MEP Patrick Breyer called the procedure a farce that harms democracy. The Greens also rejected the regulation and criticized that the March vote was not respected.

In Austria, FPÖ, NEOS, and Grüne announced they would vote against the extension of the exemption regulation. The FPÖ rejects the chat control as "anlasslose Massenüberwachung" unrelated to fundamental rights protection. The NEOS demanded that platforms be required to monitor messages, as in the Commission's original proposal. SPÖ EU delegation leader Andreas Schieder stated that the provisional voluntary review was not what they wanted but they would agree to it, and that platforms should assume responsibility.

Arguments for and against

Supporters such as the German Union parties (CDU/CSU) argue that without the regulation platforms would lack a legal basis in the fight against depictions of child abuse, constituting a dangerous protection gap. ÖVP MEP Lukas Mandl said it was important that platforms continue to be allowed to scan and that children be protected. Mandl stated after the vote that he had no understanding for child protection being made a negotiating matter, called this inappropriate, and said a few dilution amendments had found narrow majorities.

Opponents argue that the blanket scanning constitutes mass surveillance, represents a major intrusion into privacy, is error-prone, and overloads law enforcement with false alarms. According to Patrick Breyer, around 99 percent of the content reported by Meta consists of already-known material, which generally cannot stop ongoing abuse. According to the Bundeslagebild of the German Federal Criminal Police Office (BKA), 48 percent of incoming reports were not relevant under criminal law. The error rates of the filters for scanning lie at up to 20 percent for some providers, according to heise online.

The European Commission acknowledged in its own evaluation that the benefit of mass scans cannot really be demonstrated. The Commission and member states desire Client Side Scanning directly on devices to circumvent encryption. Commission President Ursula von der Leyen has been pursuing her personal project of network control in the name of child protection for over 15 years. According to the European Commission, Europe is the world's largest hub for depictions of child sexual abuse on the internet, and two corresponding images or videos are shared online every second.

Next steps in Brussels

The German child protection organization Kinderschutzbund prefers targeted investigations rather than suspicion-less mass scanning. Opponents argue that judicially ordered targeted surveillance and user-initiated reporting of suspicious cases are already the most effective tools against child abuse. Data protection advocates and civil rights activists view the measure as a step towards comprehensive mass surveillance.

The Council of EU member states must approve the Parliament's amendments, including the exemption for encryption, within three months before the regulation can enter into force finally. If the Council does not accept all amendments, a conciliation procedure will be launched to agree on the law. The decision now lies with the Council: member states must decide whether to accept the amendments or send the matter back to a conciliation committee.

Major US platforms stated they would continue their scans even after the European legal basis expired. Under US law, American providers must report discovered abuse material to the US reporting center NCMEC. European messenger service providers have never employed such scanning. The regulation affects all providers of large email, cloud and messenger services.

Long-term legislation ahead

Work on the regular legislative procedure to establish a long-term legal framework to protect children from sexualized violence online is ongoing, with negotiations set to resume in September. From September, EU institutions will negotiate in parallel on a permanent regulation referred to by critics as 'Chat Control 2.0'. In the previously discussed plans for 'Chat Control 2.0', mandatory client-side scanning of messages was proposed, in which software on the device checks messages for content before sending and then encrypts them end-to-end.

The article was written by WDR digital expert Jörg Schieb and published on WDR.de on 10 July 2026. The author argues that the EU's handling of the chat control vote reveals serious democratic deficits in the European Union. The author states that "Unsere Demokratie" is then keinen Deut besser, and that whoever treats a Parliament in this way forfeits any right to point fingers at autocrats in Washington or Budapest.

Author's verdict

The European Parliament has now expressed a majority against the extension of the chat control exemption three times. The same Parliament had rejected the extension of the regulation in March, and shortly before the summer break Parliament President Roberta Metsola placed the issue back on the agenda via an expedited procedure. In March, the EPP attempted a maneuver and forced a renewed vote after the first rejection.

Greens MEP Lena Schilling said the Parliament's decision paves the way for the return of indiscriminate chat control and constitutes a major setback for fundamental rights, and that Commission figures themselves show the disproportionate nature of the measure, with billions of private messages scanned but only a fraction leading to hits. NEOS MEP Anna Stürgk said that by rejecting end-to-end encryption, a majority in the Parliament understood that mass surveillance cannot be a solution because it is in absolute contradiction to fundamental rights, and called for a permanent solution that effectively protects children while preserving civil liberties.