An Unprecedented Resurrection

On July 9, 2026, the European Parliament narrowly missed the opportunity to permanently bury "Chat Control 1.0" — the nickname given to Regulation (EU) 2021/1232, which allows messaging service providers to voluntarily scan users' private communications to detect child sexual abuse material (CSAM).

The result of the vote is staggering: 314 MEPs voted to reject the Council's text, against 276 who opposed it and 17 abstentions. A majority of voters therefore desired to stop the surveillance — but the rules of the second reading procedure require an absolute majority of 361 votes from all members of Parliament to block the text. This threshold was not reached. The regulation is therefore deemed adopted, and mass, suspicionless scanning of private communications resumes legally until April 2028.

A Rocky Path

The story of this temporary derogation is chaotic. Adopted in July 2021, it was initially set to expire in August 2024 but was extended for the first time until April 2026, while permanent regulation ("Chat Control 2.0") was negotiated.

But nothing went as planned:

  • March 2, 2026: the LIBE committee rejects the extension by 38 votes to 28.
  • March 26, 2026: the Parliament in plenary categorically refuses the extension (311 against, 228 for, 92 abstentions).
  • April 4, 2026: Chat Control 1.0 expires. Google, Meta, Microsoft, and Snap announce they will continue scanning their users without legal basis.
  • June 26, 2026: in a move described as "unprecedented," the Council decides to resurrect the expired law by presenting a formally new regulation but with identical content, via an expedited procedure.
  • July 2, 2026: the Council adopts its position.
  • July 7, 2026: the Parliament votes on the urgency (331–303), skipping the parliamentary committee stage.
  • July 9, 2026: final vote — the rejection fails by 47 votes.

"A Procedural Sleight of Hand"

Former Pirate Party MEP Patrick Breyer, a long-time opponent of the text, denounces an undemocratic maneuver: as long as governments can prolong through this route what he calls "the convenient status quo of voluntary and indiscriminate mass scanning," they have no incentive to accept the more targeted framework emerging from Parliament.

Green MEP Markéta Gregorová stated to Euronews: "Normally, when Parliament rejects a text, the Council ceases to work on it. Now, we are forced into a second vote."

The President of Parliament Roberta Metsola has also been criticized for facilitating the urgent procedure, in what opponents consider a circumvention of the democratic vote from March.

What Does Chat Control 1.0 Scan?

The derogation allows providers to voluntarily scan private messages of unaccused users to detect CSAM. In practice, it is primarily used by unencrypted American services: Gmail, Facebook/Instagram Messenger, Skype, Snapchat, iCloud Mail, and Xbox.

On July 9, an amendment aimed at exempting end-to-end encrypted services was adopted. Another amendment proposing to limit scanning to suspects identified by judicial authority garnered 322 votes but did not reach the absolute majority either.

Chat Control 2.0: The Permanent Sword of Damocles

In parallel, the permanent regulation — dubbed "Chat Control 2.0" (CSAR) — remains stalled after five unsuccessful trialogue rounds. The last, on June 29, 2026, failed over the central issue of suspicionless scanning.

The Parliament demands that scanning be limited to specific users or groups suspected with prior judicial authorization. The Council, on the other hand, supports a broader approach that includes risk mitigation obligations, which critics argue amounts to encouraging mass scanning.

Notably, the Legal Service of the Council itself warned in June 2026 that generalized "voluntary" scanning could be incompatible with Article 7 of the Charter of Fundamental Rights of the EU in the absence of reasonable suspicion and judicial authorization.

Negotiations on Chat Control 2.0 will resume in September 2026 under the Irish presidency.

In Summary

July 9, 2026, will go down as a dark date for privacy advocates in Europe. A text that Parliament had democratically rejected three months prior was resurrected by the Council and then adopted due to the failure to achieve an absolute majority — even though more MEPs voted against than for. Mass surveillance of private communications is therefore legal in the European Union until April 2028, while the battle over permanent regulation continues.

Researchers Carmela Troncoso and Bart Preneel, joined by over 800 academics in open letters, remind us that available scanning technologies produce "unacceptably high error rates." The issue is therefore not only legal — it is technical and ethical.