EU Governments Fast-Track a Chat Scanning Law Parliament Never Signed Off On

The fight over whether EU messaging apps can scan private chats just took a sharp procedural turn. With a broader overhaul known as Chat Control 2.0 stalled for months in the European Parliament, the Council of Ministers has decided to stop waiting and instead resurrect an older, already-expired rule through what amounts to a legislative side door.

At issue is a regulation that let tech companies voluntarily search private messages, webmail, and VoIP calls for child sexual abuse material and grooming behavior, using tools like AI detection and hash matching. That rule, often called Chat Control 1.0, expired on April 3 after the Council and Parliament failed to agree on extending it. Since then, providers have technically lost their carve-out from the EU's E-Privacy Directive, the law that protects the confidentiality of digital communications and normally bars anyone from intercepting or analyzing message content and metadata without cause.

Rather than negotiate an extension, the Council adopted a new position on Thursday through a written procedure, according to reporting by heise. The catch: because a regulation that has already expired can't formally be "extended," the Council is instead presenting what is functionally the same policy dressed up as a brand-new legislative proposal.

Why the Council Says This Is Urgent

From the Council's perspective, the lapse in voluntary scanning has left a dangerous gap. Officials argue the detection tools are essential for spotting abuse early, pulling victims out of ongoing harm, and stopping illegal images and videos from spreading further online. They also frame the move as a way to prevent a patchwork of conflicting national rules from filling the vacuum left by the expired EU-wide framework.

Notably, providers have reportedly kept submitting abuse reports even without a legal mandate to do so, which the Council points to as evidence the system still works and shouldn't be allowed to collapse.

The Timing Critics Call the Real Story

What's drawing pushback isn't the underlying child-protection goal. It's the mechanism and the calendar. The Council wants its new proposal on Parliament's agenda as soon as Tuesday, folded into an urgent procedure, right before lawmakers scatter for the summer recess. If Parliament agrees to fast-track it, a vote could land on the final session day before the break, historically a moment when many MEPs have already left Brussels.

The math makes that especially consequential. The proposal is already sitting in its second reading, a stage where the Council's position can only be blocked or changed if an absolute majority of all MEPs vote against it, not just a majority of those present. Getting that many lawmakers back in their seats during the last days before summer recess is, in practical terms, a steep climb. Critics see the timing as less a coincidence than a strategy: present a fait accompli to a thinned-out chamber that struggled to agree on this exact issue for months.

What the Rule Would Actually Require

The Council maintains that the revived measure is narrowly scoped, insisting it does not amount to blanket, suspicionless surveillance of everyone's messages. Under the proposal, any content or traffic data that gets flagged and processed must be permanently deleted within twelve months, unless it leads to a confirmed case warranting further investigation.

Even with that safeguard, the scale of intrusion is real. The mechanism still involves scanning private communications across widely used platforms, and it does so without a warrant or individualized suspicion triggering the search in the first place. That tension, child protection versus the default privacy of everyone using encrypted or private messaging, is the same one that has stalled Chat Control 2.0 for years and shows no sign of resolving with this shortcut.

What emerges instead is a stopgap, not a settlement. Even if the Council's maneuver succeeds, it revives a temporary voluntary framework rather than establishing the durable, negotiated law that both sides say they eventually want. The bigger fight over mandatory scanning, encryption, and what EU governments can compel platforms to search remains exactly where it was, just delayed again. What changes now is the immediate question of whether Parliament, distracted and depleted before its summer break, gets a real chance to weigh in before this becomes settled policy by default.