The European Union's long-running debate over scanning private communications was moving on two distinct legal tracks, a distinction that helps explain apparently conflicting reports that one measure had ended while another remained under negotiation.
The first track concerned Regulation (EU) 2021/1232, a temporary exception to the ePrivacy Directive. That measure gave communications providers a legal basis to scan messages voluntarily for child sexual abuse material. It was originally due to expire in August 2024 and was later extended to April 2026 while legislators struggled to agree on a permanent framework.
The European Commission proposed keeping the temporary arrangement until April 2028. Parliament's civil-liberties committee rejected that extension by 38 votes to 28. The full Parliament then supported a narrower compromise by 458 votes to 103: an extension only to 2027, detection confined to known material, encrypted communications excluded, and scanning limited to users or groups identified by a competent judicial authority. Negotiations broke down after the Council rejected those conditions.
A subsequent parliamentary vote produced an unusual outcome. An amendment opposing the extension won 311 votes against 228, with 92 abstentions, but the legal basis nevertheless expired because the institutions had not agreed on a replacement. The Council then advanced a formally new measure with substantially the same temporary function. Parliament agreed by 331 votes to 303, with 11 abstentions, to use a fast-track procedure. Under the procedure described by the campaign group Fight Chat Control, opponents needed an absolute majority of 361 votes to stop the proposal. The final tally was 314 votes to reject, 276 against rejection and 17 abstentions, so the measure advanced despite more participating members voting against it. An amendment protecting end-to-end encrypted services did pass.
That procedural history also left service providers navigating a changing legal basis.
The second track was the proposed permanent Child Sexual Abuse Regulation, first presented in 2022. Earlier versions would have made detection and reporting mandatory, including measures critics said could undermine encryption. A later Council compromise dropped detection orders and shifted toward risk-assessment and mitigation duties, while retaining voluntary scanning.
Five rounds of talks among Parliament, Council and Commission had not resolved the central issue by the event date. The Council Legal Service was reported to have warned that voluntary generalised scanning could conflict with the EU Charter without reasonable suspicion and prior judicial authorisation. Negotiators made progress on excluding mandatory age verification, but no overall agreement emerged. The result was not one settled “Chat Control” law, but a temporary regime being revived alongside a permanent proposal still under negotiation.
