A single vote in the European Parliament earlier this year appeared to settle one of the continent's most contentious digital rights disputes - at least temporarily. It did not. The Council of the European Union is now pursuing a legislative route to revive a legal framework that allows technology companies to scan private messages for child sexual abuse material, reopening a fight over the limits of surveillance inside encrypted communications that affects every person in Europe who uses WhatsApp, Signal, Messenger, or any comparable service.
How a One-Vote Margin Became a Constitutional Problem
On March 26, the European Parliament voted 307 to 306, with 24 abstentions, against extending the temporary exemption that had permitted platforms to voluntarily scan private person-to-person communications for known child abuse material. The exemption, first introduced in 2021 when stricter ePrivacy rules came into force, expired on April 3. With it went the legal basis companies including Meta, Google, Microsoft and TikTok had relied upon to run automated detection systems across EU user communications.
For privacy advocates, the expiry represented a hard-won outcome after years of resistance to what critics described as the infrastructure of mass surveillance dressed in the language of child protection. That outcome has since proven fragile. EU ambassadors subsequently agreed to pursue a Council-led extension through a separate legislative pathway, an approach the Council's own Legal Service cautioned against in a formal opinion issued on June 10. That opinion concluded the latest proposal still constituted generalised scanning of private communications and would conflict with Article 7 of the EU Charter of Fundamental Rights, which protects private and family life. Negotiations continued regardless.
Two Proposals, One Persistent Controversy
Public confusion around this debate is partly structural. Two distinct legislative proposals are regularly conflated, and they carry different implications.
The first, informally called Chat Control 1.0, is the temporary exemption the Council is attempting to preserve. It allowed voluntary scanning - companies could use hashing algorithms and AI tools to compare message content against databases of known abuse material, or flag suspected grooming behaviour, without being required to do so by law. The second proposal, Chat Control 2.0 or the Child Sexual Abuse Regulation, is a permanent framework still under negotiation. This is the version that has drawn sharper alarm from security researchers because it would introduce client-side scanning - a mechanism that examines message content on a user's device before end-to-end encryption is applied.
The distinction matters enormously. End-to-end encryption means, by design, that only the sender and recipient can read a message. Client-side scanning would create a point of inspection before that protection takes effect. Cryptographers argue this does not technically break encryption but achieves a functionally equivalent outcome: a third party gains access to message content. Once that architectural concession is built into a platform, they warn, its scope and the range of entities with potential access to it become difficult to constrain by policy alone.
The Scale Problem and the Limits of Automated Detection
Supporters of the scanning frameworks point to concrete outcomes. Before the temporary exemption lapsed, technology companies generated reports on suspected abuse material that contributed to criminal investigations, arrests and, in some cases, the identification of victims. The Council and several member states have argued, with some legitimacy, that allowing the legal basis to expire creates gaps that offenders can exploit - particularly as encrypted messaging has become the default communication channel for organised abuse networks.
The counter-argument is not that detection is undesirable but that the mechanism is disproportionate at scale. Automated systems operating across billions of daily messages, even those with high accuracy rates, produce error volumes that matter in practice. Earlier voluntary programmes produced documented instances of false positives - ordinary family photographs, for example, flagged for manual human review before being cleared. Scaled to an entire continent's private communications, that error rate translates into a significant and ongoing intrusion into the lives of people who have done nothing wrong. Privacy organisations argue that any such system requires mandatory judicial oversight before content is accessed, strict transparency requirements and enforceable limits on data retention - safeguards the current proposals do not adequately provide.
What Happens Next, and Why It Matters Beyond This Law
Political discussions within the Council were expected to continue through July under the Cypriot presidency. Whether the temporary extension survives, and in what form, will shape the immediate legal environment for encrypted messaging across the EU. But the dispute has acquired a significance beyond any single regulation.
The European Parliament voted. The Council is attempting to preserve substantially the same policy through an alternative procedure, despite formal legal concerns from its own advisers. That sequence raises questions about institutional balance within the EU's legislative architecture - specifically, whether a narrow parliamentary vote against a proposal can effectively be bypassed when a majority of member state governments favour a different outcome.
For the broader question of digital rights in Europe, the trajectory of Chat Control has become a reference point. It tests whether the EU's stated commitment to the General Data Protection Regulation's principles extends, in practice, to the content of private communication. It also reflects a wider tension emerging in democratic societies: as AI-powered detection tools become more capable and more widely deployed, the legal frameworks governing their use are struggling to keep pace with either the technology or the expectations of the people subject to it. How Europe resolves this particular dispute will carry weight well beyond its borders.
