A controversial rule is back
The European Parliament has voted to bring back a rule that lets big tech companies scan users’ private messages for child sexual abuse material (CSAM). The decision, made on July 10th, 2026, came just before summer recess and has reignited a fierce privacy debate.
Critics call the process “Chat Control.” Supporters say it’s a necessary tool to protect children. The law, which first took effect in 2021, expired in April after Parliament failed to agree on a path forward amid widespread privacy concerns.
Now, with Thursday’s vote, companies like Google, Microsoft, and Meta have legal cover to continue scanning until 2028. But the way the vote happened has many people worried.
How did the vote pass?
The vote used an unusual legislative procedure. It required an absolute majority to kill the provision. That means all lawmakers who weren’t present in the chamber were counted as “yes” votes. So even though more present members opposed the measure than supported it, the rule passed.
Parliament President Roberta Metsola had pushed hard for renewing the rule. She and other officials argued it was urgent. The rule doesn’t allow scanning on encrypted platforms like Signal, but critics say the broader implications are still troubling.
This isn’t the first time Parliament considered the measure. Three months ago, under normal voting conditions, lawmakers rejected it. The procedural maneuver this time felt like an end-run around that decision.
What critics are saying
Privacy advocates are furious. Rand Hammoud of Europe’s Center for Democracy and Technology called the tactics “highly politicised procedural efforts” in a blog post. He accused lawmakers of “overstepping Parliament’s own mandate and previous vote.”
Simeon de Brouwer, a policy adviser at European Digital Rights, put it more bluntly. He said Chat Control allows tech companies to “snoop without a warrant, with little to no oversight, and with no legal basis, on millions of conversations.”
That’s a strong claim. But it reflects the deep unease many feel about giving corporations the power to inspect private messages.
The bigger battle: Chat Control 2.0
Thursday’s vote is just the opening skirmish. A much larger fight is brewing over what insiders call Chat Control 2.0.
In its most extreme form, 2.0 could force service providers to scan conversations and hosted content, including end-to-end encrypted communications. That would be a massive shift from the voluntary, limited scanning allowed under the current rule.
Lawmakers have been negotiating a permanent framework since November 2023. Progress has been slow. Law enforcement agencies, however, are pushing hard for a permanent solution.
Europol’s position
When the law lapsed in April, Catherine De Bolle, the executive director of Europol, issued a statement. She said that “enabling online service providers to continue detecting and reporting suspected CSAM to the competent authorities is vital for the protection of children.”
That’s a powerful argument. No one wants to make it easier for predators to operate. But de Brouwer and others say the tradeoffs are too high.
What happens next?
The renewed rule gives big tech legal protection to continue scans until 2028. But the debate over Chat Control 2.0 is far from over.
If you care about digital privacy rights, this is a story to watch. The outcome could reshape how European governments balance child protection against surveillance concerns.
For now, the scans continue. The legal cover is in place. And the critics are watching closely.
