The EU Just Extended Big Tech's License to Scan Your Messages — Using a Vote It Lost Weeks Ago
A procedural quirk let the European Parliament revive voluntary CSAM scanning through 2028, even though more lawmakers present voted against it than for it.
The European Parliament voted Thursday to bring back a law letting tech companies scan private messages for child sexual abuse material, extending permission for the practice through 2028. The catch: more lawmakers in the room voted against the measure than for it.
That's not a typo, and it's not a conspiracy theory. It's how an obscure legislative procedure works. The vote required an absolute majority to kill the provision, and under those rules, any lawmaker who simply wasn't present counts as a "yes." So even with more present members opposed than in favor, the measure survived and passed. The vote landed the day before Parliament's summer recess.
The rule in question is voluntary and dates back to 2021. It lets companies like Google, Microsoft and Meta scan messages on their platforms to detect CSAM, but it doesn't apply to encrypted services like Signal. It's the thing critics have nicknamed "Chat Control," and it had actually lapsed back in April after Parliament failed to agree on how to proceed amid growing privacy concerns. Tech firms kept scanning anyway during the gap, even as European officials warned that doing so without legal backing was risky.
What makes Thursday's outcome sting for privacy advocates is the timing and the math. Parliament had already rejected this exact measure three months earlier, under normal voting conditions. Reviving it now, via a procedural mechanism that flips absence into implicit support, right before lawmakers scatter for the summer, has drawn sharp criticism.
Rand Hammoud of Europe's Center for Democracy and Technology called the maneuvering "highly politicised procedural efforts" in a blog post, and pointed the finger at Parliament President Roberta Metsola for pushing it through. Hammoud accused lawmakers of "overstepping Parliament's own mandate and previous vote." Metsola had been among the officials urgently pressing to get the rule renewed.
A bigger fight is still coming
As contentious as Thursday's vote was, it's really just a stopgap. The real battle is over what insiders are calling Chat Control 2.0, a permanent framework that would replace the temporary, voluntary scanning system entirely. Lawmakers have been negotiating this version since November 2023, without much to show for it.
The stakes with 2.0 are considerably higher. According to Simeon de Brouwer, a policy adviser at European Digital Rights, the most extreme version of the proposal could force service providers to scan conversations and hosted content across the board, including messages sent through end-to-end encryption. That would mark a fundamental shift from the current voluntary, non-encrypted-only regime to something far more sweeping.
Law enforcement has pushed hard for a permanent scanning mandate. When the original law expired in April, Europol's executive director, Catherine De Bolle, put out a statement calling it "vital for the protection of children" that online platforms be able to keep detecting and reporting suspected CSAM to authorities.
De Brouwer sees it differently, arguing the privacy tradeoffs are too steep. He described Chat Control as giving tech companies the ability to "snoop without a warrant, with little to no oversight, and with no legal basis, on millions of conversations."
That tension, child safety enforcement versus mass surveillance of private communications, is exactly why this issue keeps stalling in Brussels. Lawmakers broadly agree CSAM detection matters. They can't agree on how far the tools used to do it should be allowed to reach, especially once encryption enters the picture.
For now, the immediate effect of Thursday's vote is straightforward: Google, Microsoft, Meta and other providers have clear legal cover to keep running voluntary CSAM scans on unencrypted messaging through 2028. The much harder question, whether Europe eventually forces scanning inside encrypted apps as well, remains unresolved and is likely to be the defining fight over online privacy in the EU for the next several years.
