Chat Control 1.0: voluntary message scanning

From 2021, providers of web-based email and chat services are permitted to search private messages on a voluntary basis. They will search these messages for material depicting child sexual abuse or attempts to make contact with children, and report any findings to the police or specialist organisations. This is permitted under a temporary derogation from the ePrivacy Directive, nicknamed ‘Chat Control 1.0’. It is not an obligation, merely a permission. Parliament and the Council failed to agree on an extension in time, and the derogation therefore expired on 3 April 2026.

In March, the proposal for an extension was rejected by the Parliament (228 in favour, 311 against), as we reported in a previous article. The Council then adopted its own position on 2 July, and the second reading began. During this stage, Parliament may reject or amend the Council’s text only by an absolute majority of all MEPs, i.e. 361 votes.

At the request of the EPP, the procedure was fast-tracked. The deadline for tabling amendments was reduced to a single day, and the text was put to a vote two days later. Normally, Parliament has three to four months for the second reading. The request was approved by 331 votes to 304, with 11 MEPs abstaining. The EPP supported it by an overwhelming majority (172 in favour, 1 against, 2 abstentions). Both the S&D (80 in favour, 39 against, 5 abstentions) and Renew (28 in favour, 46 against) were split in their voting. All 48 Greens/EFA MEPs voted against. The ECR was mostly against (17 in favour, 52 against), PfE was split almost evenly (34 in favour, 35 against) and the ESN was unanimously against. The Left also voted against (29 against, 1 abstention). Markéta Gregorová (Greens/EFA, Pirates) criticised the EPP in the group’s press release for, as the largest group, bringing back to the table a proposal that Parliament had already rejected once.

During the vote on the substance of the matter, the Council’s proposal to reject the text initially failed to pass. It received 314 votes in favour and 276 against, but this was not enough to reach the required 361. Of the 26 votes on amendments, only two passed the threshold (369:236 and 362:235). Both remove communications protected by end-to-end encryption from the scope of the regulation. Proposals seeking to further restrict scanning – for example, limiting it to suspects with court authorisation – were rejected. Gregorová welcomed the fact that an absolute majority had been secured in favour of retaining encryption.

Subsequently, The Left, the far-left group, at the request of Manon Aubry, called for a further vote to reject the text, this time with two amendments. This too failed to pass: 276 MEPs voted in favour, 286 against and 30 abstained. This brought the second reading to a close. The EPP voted against the rejection by an overwhelming majority (4 in favour, 158 against, 2 abstentions) and the S&D by a majority (20 in favour, 62 against, 18 abstentions). Renew was split (38 in favour, 29 against). The Greens/EFA supported the rejection by an overwhelming majority (43 in favour, none against, 4 abstentions). The EPP, S&D, Renew and Greens/EFA – in other words, the pro-European majority – thus found themselves at odds. The ESN also voted unanimously in favour of rejection, as did PfE by an overwhelming majority (58 in favour, 7 against) and The Left unanimously. The ECR was split (27 in favour, 30 against, 5 abstentions). Tomas Tobé (EPP) said in plenary (in English): “We now have some amendments adopted. We have a text. (…) On behalf of the EPP, I want to make it clear: we stand with the children.”

The Council approved the text with both amendments in July. The regulation will apply until 3 April 2028. It is intended to bridge the gap until a long-term framework, proposed by the Commission in May 2022, is agreed. The technologies used are designed to interfere with privacy as little as possible. They are only permitted to detect suspicious patterns in the text, not its content. Previously unknown material may only be flagged following human review. Data is retained for a maximum of 12 months from the detection of a suspicion, and users have the right to information and to lodge a complaint. Audio communications are not scanned.