The European Parliament voted to reinstate a law allowing companies like Google, Microsoft, and Meta to voluntarily scan user messages for child sexual abuse material, extending the authorization through 2028 despite more present members voting against it than for it.
The European Parliament has voted to reinstate a rule giving companies such as Google, Microsoft, and Meta legal permission to scan users' messages for child sexual abuse material, a practice critics refer to as Chat Control, extending the authorization through 2028.
Thursday's vote came on the day before the Parliament's summer recess and relied on an unusual procedural mechanism that required an absolute majority to defeat the measure. Under that procedure, all absent lawmakers are counted as voting in favor, meaning the provision passed even though more members who were physically present voted against it than for it.
The underlying law, which permits voluntary scanning but does not apply to end-to-end encrypted platforms such as Signal, originally took effect in 2021. It expired in April after Parliament failed to reach consensus on a path forward amid sustained objections from privacy advocates.
Despite the lapse, major technology companies had continued conducting the scans, though European officials cautioned firms that doing so without legal backing carried risk. The renewed authorization now provides what officials described as clear legal cover for the scans to continue.
Parliament President Roberta Metsola had been among those who urgently prioritized renewing the rule. A blog post from Rand Hammoud of Europe's Center for Democracy and Technology criticized the procedural approach as an "unprecedented tactic," saying it involved "overstepping Parliament's own mandate and previous vote." Hammoud characterized the legislative maneuvering as "highly politicised procedural efforts" fueled by Metsola.
Critics are further alarmed because Parliament had rejected the same measure just three months earlier under standard voting procedures.
Even as the dispute over Thursday's vote continues, a more consequential fight is unfolding over a permanent successor framework that insiders refer to as Chat Control 2.0. In its most expansive form, that proposal could require service providers to scan conversations and hosted content — including communications protected by end-to-end encryption, according to Simeon de Brouwer, a policy adviser at the advocacy group European Digital Rights.
Lawmakers have been negotiating the permanent framework since November 2023, but de Brouwer said via email that little progress has been made.
Law enforcement officials have argued forcefully for allowing the scans on a continuing basis. When the original law lapsed in April, Europol Executive Director Catherine De Bolle issued a statement saying that "enabling online service providers to continue detecting and reporting suspected CSAM to the competent authorities is vital for the protection of children."
De Brouwer pushed back sharply on that framing, arguing that Chat Control allows tech companies to "snoop without a warrant, with little to no oversight, and with no legal basis, on millions of conversations."
The renewed authorization runs through 2028, giving lawmakers a window to settle on a permanent framework — though the fractured vote and the procedural controversy surrounding Thursday's decision suggest that reaching broad consensus will remain difficult. How the Chat Control 2.0 negotiations proceed, and whether any final agreement addresses the encryption question, will determine the scope of surveillance obligations facing technology platforms operating across the European Union.
Sara Montes de Oca is the Editor in Chief of TechEchelon. Previously a correspondent and producer in Washington, D.C., covering business, finance, and politics.
More from Sara →Dutch National Police say they have found "strong indications" that Dutch-speaking hackers carried out the February breach at telecom provider Odido, which exposed the personal data of 6.2 million customers after a social engineering and phishing attack.
Researchers disclosed two new Microsoft 365 threats on July 9: the Helix data-extortion group, which uses voice phishing and SharePoint exfiltration, and the Forg365 phishing-as-a-service platform, which integrates AI-assisted lure generation with adversary-in-the-middle and device-code attack methods.
Japanese telecom giant KDDI has revealed that a zero-day exploit targeting a shared email platform exposed the email addresses of 12.2 million people and the passwords of more than 7.6 million, affecting customers across five internet service providers.
Written for readers who already know the basics — markets, AI, and the policy decisions that shape both.